This tool works with Istio version 0.7.1 and above.
The istio-vet utility helps discover incompatible configuration of user applications and Istio components in a kubernetes cluster. Misconfigurations might cause unexpected or incorrect service mesh behavior which can be easily detected and fixed using this tool.
The istio-vet tool invokes a list of independent
performs validation on a subset of configurations and generates
on any misconfiguration.
Note that istio-vet and vetters only read configuration objects from the kubernetes API server.
meshversion inspects the version of running Istio components and the
sidecar version deployed in pods in the mesh. It generates the following
note on any version mismatch:
Summary: "Mismatched sidecar version - myapp-xyz-1234" Message: "WARNING: The pod myapp-xyz-1234 in namespace default is running with sidecar proxy version 0.2.10 but your environment is running Istio version 0.2.12. Consider upgrading the sidecar proxy in the pod."
The official docker image is
Container image can be deployed in a kubernetes cluster or run locally.
When run locally, kube config for the kubernetes cluster needs to be mounted inside the container.
docker run --rm -v $HOME/.kube/config:/root/.kube/config quay.io/aspenmesh/istio-vet:master
The istio-vet container can be deployed as a Job in a kubernetes cluster using the manifest file in the install directory.
kubectl apply -f install/kubernetes/istio-vet.yaml
To inspect the output of the istio-vet, use the following command:
kubectl -n istio-system logs -l "app=istio-vet" --tail=0
Note that the Job would have to be manually run every time to get the latest output from the istio-vet utility.
Please visit aspenmesh.io and sign-up to receive alerts, insights and analytics from your service mesh.
This repository contains code for the vet tool and supported vetters packages. It includes:
pkg/vet - This directory contains code for the vet utility which is the main binary produced by the repository.
pkg/vetters - This directory contains packages for individual vetters, helper utility package and the interface definitions for vetters to implement. It includes the following vetters:
meshversion - This vetter inspects the version of various installed Istio components and generates notes on mismatching versions. It also inspects the version of sidecar proxy running in pods in the mesh and compares it with the installed Istio version and reports back any version mismatch.
mtlsprobes - This vetter inspects if mTLS is enabled in Istio service mesh. It generates warnings if Liveness or Readiness probe is configured for a Pod in a mTLS enabled mesh.
serviceportprefix - This vetter inspects services in the Istio mesh and reports back if any service port name definition doesn't include Istio recognized port protocol prefixes.
podsinmesh - This vetter reports back the number of user pods in/out of the mesh. It also reports number of system pods running which are exempted from the mesh.
applabel - This vetter inspects the labels defined for the pods in the mesh and generates notes if the label
appis missing in any pod specification.
serviceassociation - This vetter generates warning if a pod in the mesh is associated with multiple services.
danglingroutedestinationhost - This vetter generates warnings if the route destination host in virtual service resource points to services which don't exists in the cluster.
conflictingvirtualservicehost - This vetter generates warnings if the same host is defined in multiple virtual service resources.
More details about vetters can be found in the individual vetters package documentation.
Individuals or business entities who contribute to this project must have completed and submitted the F5® Contributor License Agreement to firstname.lastname@example.org prior to their code submission being included in this project. Please include your github username in the CLA email.