Diagnose your Configuration with Istioctl Analyze
istioctl analyze
is a diagnostic tool that can detect potential issues with your
Istio configuration. It can run against a live cluster or a set of local configuration files.
It can also run against a combination of the two, allowing you to catch problems before you
apply changes to a cluster.
Getting started in under a minute
You can analyze your current live Kubernetes cluster by running:
And that’s it! It’ll give you any recommendations that apply.
For example, if you forgot to enable Istio injection (a very common issue), you would get the following ‘Info’ message:
Fix the issue:
Then try again:
Analyzing live clusters, local files, or both
Analyze the current live cluster, simulating the effect of applying additional yaml files
like bookinfo-gateway.yaml
and destination-rule-all.yaml
in the samples/bookinfo/networking
directory:
Analyze the entire networking
folder:
Analyze all yaml files in the networking
folder:
The above examples are doing analysis on a live cluster. The tool also supports performing analysis
of a set of local Kubernetes yaml configuration files, or on a combination of local files and a
live cluster. When analyzing a set of local files, the file-set is expected to be fully self-contained.
Typically, this is used to analyze the entire set of configuration files that are intended to be deployed
to a cluster. To use this feature, simply add the --use-kube=false
flag.
Analyze all yaml files in the networking
folder:
You can run istioctl analyze --help
to see the full set of options.
Advanced
Enabling validation messages for resource status
Starting with v1.5, Istio can be set up to perform configuration analysis alongside
the configuration distribution that it is primarily responsible for, via the istiod.enableAnalysis
flag.
This analysis uses the same logic and error messages as when using istioctl analyze
.
Validation messages from the analysis are written to the status subresource of the affected Istio resource.
For example. if you have a misconfigured gateway on your “ratings” virtual service,
running kubectl get virtualservice ratings
would give you something like:
enableAnalysis
runs in the background, and will keep the status field of a resource up to date
with its current validation status. Note that this isn’t a replacement for istioctl analyze
:
- Not all resources have a custom status field (e.g. Kubernetes
namespace
resources), so messages attached to those resources won’t show validation messages. enableAnalysis
only works on Istio versions starting with 1.5, whileistioctl analyze
can be used with older versions.- While it makes it easy to see what’s wrong with a particular resource, it’s harder to get a holistic view of validation status in the mesh.
You can enable this feature with:
Ignoring specific analyzer messages via CLI
Sometimes you might find it useful to hide or ignore analyzer messages in certain cases. For example, imagine a situation where a message is emitted about a resource you don’t have permissions to update:
Because you don’t have permissions to update the namespace, you cannot resolve the message
by annotating the namespace. Instead, you can direct istioctl analyze
to suppress the above message on the resource:
The syntax used for suppression is the same syntax used throughout istioctl
when referring to
resources: <kind> <name>.<namespace>
, or just <kind> <name>
for cluster-scoped resources like
Namespace
. If you want to suppress multiple objects, you can either repeat the --suppress
argument or use wildcards:
Ignoring specific analyzer messages via annotations
You can also ignore specific analyzer messages using an annotation on the resource.
For example, to ignore code IST0107 (MisplacedAnnotation
) on resource deployment/my-deployment
:
To ignore multiple codes for a resource, separate each code with a comma:
Helping us improve this tool
We’re continuing to add more analysis capability and we’d love your help in identifying more use cases. If you’ve discovered some Istio configuration “gotcha”, some tricky situation that caused you some problems, open an issue and let us know. We might be able to automatically flag this problem so that others can discover and avoid the problem in the first place.
To do this, open an issue7 describing your scenario. For example:
- Look at all the virtual services
- For each, look at their list of gateways
- If some of the gateways don’t exist, produce an error
We already have an analyzer for this specific scenario, so this is just an example to illustrate what kind of information you should provide.
Q&A
What Istio release does this tool target?
Like other
istioctl
tools, we generally recommend using a downloaded version that matches the version deployed in your cluster.For the time being, analysis is generally backwards compatible, so that you can, for example, run the 1.23 version of
istioctl analyze
against a cluster running an older Istio 1.x version and expect to get useful feedback. Analysis rules that are not meaningful with an older Istio release will be skipped.If you decide to use the latest
istioctl
for analysis purposes on a cluster running an older Istio version, we suggest that you keep it in a separate folder from the version of the binary used to manage your deployed Istio release.What analyzers are supported today?
We’re still working to documenting the analyzers. In the meantime, you can see all the analyzers in the Istio source8.
You can also see what configuration analysis messages9 are supported to get an idea of what is currently covered.
Can analysis do anything harmful to my cluster?
Analysis never changes configuration state. It is a completely read-only operation that will never alter the state of a cluster.
What about analysis that goes beyond configuration?
Today, the analysis is purely based on Kubernetes configuration, but in the future we’d like to expand beyond that. For example, we could allow analyzers to also look at logs to generate recommendations.
Where can I find out how to fix the errors I’m getting?
The set of configuration analysis messages9 contains descriptions of each message along with suggested fixes.