istioctl

Istio configuration command line utility.

Create, list, modify, and delete configuration resources in the Istio system.

Available routing and traffic management configuration types:

[routerule ingressrule egressrule destinationpolicy]

See https://istio.io/docs/reference/ for an overview of routing rules and destination policies.

istioctl context-create

Create a kubeconfig file suitable for use with istioctl in a non kubernetes environment

istioctl context-create --api-server http://<ip>:<port> [flags]

Examples

# Create a config file for the api server.
istioctl context-create --api-server http://127.0.0.1:8080

istioctl create

Create policies and rules

istioctl create [flags]

Examples

istioctl create -f example-routing.yaml

istioctl delete

Delete policies or rules

istioctl delete <type> <name> [<name2> ... <nameN>] [flags]

Examples

# Delete a rule using the definition in example-routing.yaml.
istioctl delete -f example-routing.yaml

# Delete the rule productpage-default
istioctl delete routerule productpage-default

istioctl deregister

De-registers a service instance

istioctl deregister <svcname> <ip> [flags]

istioctl gen-deploy

istioctl gen-deploy produces deployment files to run the minimum Istio control for the set of features requested by the --feature flag. If no features are provided, we create deployments for the default control plane: Pilot, Mixer, CA, and Ingress Proxies, with mTLS enabled.

istioctl gen-deploy [flags]

Examples

istioctl gen-deploy --features routing,policy,sidecar-injector -o helm

istioctl get

Retrieve policies and rules

istioctl get <type> [<name>] [flags]

Examples

# List all route rules
istioctl get routerules

# List all destination policies
istioctl get destinationpolicies

# Get a specific rule named productpage-default
istioctl get routerule productpage-default

istioctl kube-inject

kube-inject manually injects envoy sidecar into kubernetes workloads. Unsupported resources are left unmodified so it is safe to run kube-inject over a single file that contains multiple Service, ConfigMap, Deployment, etc. definitions for a complex application. Its best to do this when the resource is initially created.

k8s.io/docs/concepts/workloads/pods/pod-overview/#pod-templates is updated for Job, DaemonSet, ReplicaSet, and Deployment YAML resource documents. Support for additional pod-based resource types can be added as necessary.

The Istio project is continually evolving so the Istio sidecar configuration may change unannounced. When in doubt re-run istioctl kube-inject on deployments to get the most up-to-date changes.

To override the sidecar injection template built into istioctl, the parameters --injectConfigFile or --injectConfigMapName can be used. Both options override any other template configuration parameters, eg. --hub and --tag. These options would typically be used with the file/configmap created with a new Istio release.

istioctl kube-inject [flags]

Examples

# Update resources on the fly before applying.
kubectl apply -f <(istioctl kube-inject -f <resource.yaml>)

# Create a persistent version of the deployment with Envoy sidecar
# injected.
istioctl kube-inject -f deployment.yaml -o deployment-injected.yaml

# Update an existing deployment.
kubectl get deployment -o yaml | istioctl kube-inject -f - | kubectl apply -f -

# Create a persistent version of the deployment with Envoy sidecar
# injected configuration from kubernetes configmap 'istio-inject'
istioctl kube-inject -f deployment.yaml -o deployment-injected.yaml --injectConfigMapName istio-inject

istioctl proxy-config

Retrieves the static/bootstrap proxy configuration for the specified pod when running in Kubernetes. Support for other environments to follow.

istioctl proxy-config <pod-name> [flags]

Examples

# Retrieve config for productpage-v1-bb8d5cbc7-k7qbm pod
istioctl proxy-config productpage-v1-bb8d5cbc7-k7qbm

istioctl register

Registers a service instance (e.g. VM) joining the mesh

istioctl register <svcname> <ip> [name1:]port1 [name2:]port2 ... [flags]

istioctl replace

Replace existing policies and rules

istioctl replace [flags]

Examples

istioctl replace -f example-routing.yaml

istioctl version

Prints out build version information

istioctl version [flags]