home / networking / istioctl

istioctl

38k

Istio CLI for installing and upgrading meshes, inspecting proxy and ztunnel state, and debugging service mesh configuration on Kubernetes.

$curl -sL https://istio.io/downloadIstioctl | sh -
Language
Go
Stars
38,088
Category
Networking
Agent
Ready
Agent Compatibility
JSON Output
Agent Skill
MCP Support
AI Analysis

istioctl is the operational CLI for working with an Istio service mesh from the shell. It spans install and upgrade work, deep proxy and ambient-mesh inspection, and config analysis against live clusters or exported dumps.

What It Enables
  • Install, upgrade, uninstall, or render Istio control-plane manifests, then run prechecks before changing a cluster.
  • Inspect Envoy config dumps, ztunnel state, authorization policy effects, and waypoint status to troubleshoot routing, policy, and ambient mesh behavior.
  • Analyze or validate Istio resources, create multicluster remote secrets, and generate VM or non-Kubernetes workload onboarding config.
Agent Fit
  • Useful in agent loops because the command surface is broad, non-TUI, and parameterized around kubeconfig, context, namespace, and revision flags.
  • Important inspection paths such as proxy-config, ztunnel-config, and tag list support JSON or YAML output, and some commands can read exported config-dump files instead of talking to a live pod.
  • Most value still depends on cluster credentials and a running mesh, while dashboard helpers and some experimental commands are less suitable for unattended automation.
Caveats
  • Real use is Kubernetes-centric and often requires an Istio control plane already installed; without cluster access the tool falls back to a smaller file-based subset.
  • Istio recommends matching the istioctl version to the control-plane version, and many commands default to human-readable tables rather than structured output.