Master istioctl: Essential Commands for Debugging and Diagnosing Service Mesh Issues

Using istioctl command-line tool

istioctl provides commands for debugging and diagnosing an Istio service mesh, including auto‑completion for Bash/ZSH.

istioctl auto‑completion

Add the completion script to ~/.bash_profile.

Source the istioctl.bash file from the tools directory.

Viewing mesh status

Use istioctl proxy-status or istioctl ps to list sidecar proxies and their sync state (SYNCED, NOT SENT, STALE).

Getting proxy configuration

Retrieve listener, route, cluster and endpoint details with istioctl proxy-config sub‑commands (e.g., istioctl pc listener, istioctl pc route, istioctl pc cluster, istioctl pc endpoint).

Inspecting Envoy details

Examples show how to list listeners for a pod, examine bootstrap configuration, and understand traffic flow from listener → route → cluster → endpoint.

Validating mTLS and policies

Apply a PeerAuthentication resource to enforce strict mTLS on a service and verify the effect with istioctl x describe pod, which reports TLS mode and any conflicts.

Using istioctl describe

Check whether a pod is part of the mesh, view applied DestinationRules and VirtualServices, and detect mismatched subsets or routing errors.

Analyzing configuration

Run istioctl analyze on the cluster or a set of YAML files to detect missing sidecar injection, TLS conflicts, and other configuration issues.

Component introspection and logging

ControlZ provides a web UI for Mixer, Pilot, and other components; logging can be scoped, filtered, and rotated using --log_output_level, --log_target, and related flags.

istioctl proxy-config listener mypod -n default

istioctl analyze --all-namespaces