istioctl diff        #Compare manifests and generate diff
istioctl generate    #Generates an Istio install manifest
istioctl install     #Applies an Istio manifest, installing or reconfiguring Istio on a cluster.

istioctl operator dump

istioctl remote-clusters

#Aliases: admin, istiod
istioctl admin log

Examples:
  # Update resources on the fly before applying.
  kubectl apply -f <(istioctl kube-inject -f <resource.yaml>)

  # Create a persistent version of the deployment with Istio sidecar injected.
  istioctl kube-inject -f deployment.yaml -o deployment-injected.yaml

  # Update an existing deployment.
  kubectl get deployment -o yaml | istioctl kube-inject -f - | kubectl apply -f -

  # Capture cluster configuration for later use with kube-inject
  kubectl -n istio-system get cm istio-sidecar-injector  -o jsonpath="{.data.config}" > /tmp/inj-template.tmpl
  kubectl -n istio-system get cm istio -o jsonpath="{.data.mesh}" > /tmp/mesh.yaml
  kubectl -n istio-system get cm istio-sidecar-injector -o jsonpath="{.data.values}" > /tmp/values.json

  # Use kube-inject based on captured configuration
  istioctl kube-inject -f samples/bookinfo/platform/kube/bookinfo.yaml \
    --injectConfigFile /tmp/inj-template.tmpl \
    --meshConfigFile /tmp/mesh.yaml \
    --valuesFile /tmp/values.json


Flags:
      --authority string           XDS Subject Alternative Name (for example istiod.istio-system.svc)
      --cert-dir string            XDS Endpoint certificate directory
  -f, --filename string            Input Kubernetes resource filename
  -h, --help                       help for kube-inject
      --injectConfigFile string    Injection configuration filename. Cannot be used with --injectConfigMapName
      --insecure                   Skip server certificate and domain verification. (NOT SECURE!)
      --meshConfigFile string      Mesh configuration filename. Takes precedence over --meshConfigMapName if set
      --meshConfigMapName string   ConfigMap name for Istio mesh configuration, key should be "mesh" (default "istio")
      --operatorFileName string    Path to file containing IstioOperator custom resources. If configs from files like meshConfigFile, valuesFile are provided, they will be overridden by iop config values.
  -o, --output string              Modified output Kubernetes resource filename
      --plaintext                  Use plain-text HTTP/2 when connecting to server (no TLS).
  -r, --revision string            Control plane revision
      --timeout duration           The duration to wait before failing (default 30s)
      --valuesFile string          Injection values configuration filename.
      --webhookConfig string       MutatingWebhookConfiguration name for Istio (default "istio-sidecar-injector")
      --xds-address string         XDS Endpoint
      --xds-label string           Istiod pod label selector
      --xds-port int               Istiod pod port (default 15012)

# 목록 조회
istioctl profile list

# 현재 프로필 조회
istioctl profile dump
# 특정 프로필 조회
istioctl profile dump $profile

# 두 프로필 비교
istioctl profile diff $profile1 $profile2

istioctl tag list

Examples:
  # Create a secret to access cluster c0's apiserver and install it in cluster c1.
  istioctl --kubeconfig=c0.yaml create-remote-secret --name c0 \
    | kubectl --kubeconfig=c1.yaml apply -f -

  # Delete a secret that was previously installed in c1
  istioctl --kubeconfig=c0.yaml create-remote-secret --name c0 \
    | kubectl --kubeconfig=c1.yaml delete -f -

  # Create a secret access a remote cluster with an auth plugin
  istioctl --kubeconfig=c0.yaml create-remote-secret --name c0 --auth-type=plugin --auth-plugin-name=gcp \
    | kubectl --kubeconfig=c1.yaml apply -f -

Flags:
      --auth-plugin-config stringToString   Authenticator plug-in configuration. --auth-type=plugin must be set with this option (default [])
      --auth-plugin-name string             Authenticator plug-in name. --auth-type=plugin must be set with this option
      --auth-type RemoteSecretAuthType      Type of authentication to use. supported values = [bearer-token plugin] (default bearer-token)
      --create-service-account              If true, the service account needed for creating the remote secret will be created if it doesn't exist. (default true)
  -h, --help                                help for create-remote-secret
  -d, --manifests string                    Specify a path to a directory of charts and profiles
                                            (e.g. ~/Downloads/istio-1.21.1/manifests).
      --name string                         Name of the local cluster whose credentials are stored in the secret. If a name is not specified the kube-system namespace's UUID of the local cluster will be used.
      --secret-name string                  The name of the specific secret to use from the service-account. Needed when there are multiple secrets in the service account.
      --server string                       The address and port of the Kubernetes API server.
      --service-account string              Create a secret with this service account's credentials. Default value is "istio-reader-service-account" if --type is "remote", "istiod" if --type is "config".
      --type SecretType                     Type of the generated secret. supported values = [remote config] (default remote)

#Aliases: d

istioctl d controlz      -- Open ControlZ web UI
istioctl d istiod-debug  -- Open Istio debug web UI
istioctl d envoy         -- Open Envoy admin web UI
istioctl d proxy         -- Open admin web UI for a proxy

istioctl d grafana       -- Open Grafana web UI using "app.kubernetes.io/name=grafana"
istioctl d jaeger        -- Open Jaeger web UI using "app=jaeger"
istioctl d kiali         -- Open Kiali web UI
istioctl d prometheus    -- Open Prometheus web UI
istioctl d skywalking    -- Open SkyWalking UI
istioctl d zipkin        -- Open Zipkin web UI

#istiod
istioctl dashboard controlz deploy/istiod
istioctl dashboard istiod-debug deploy/istiod

#envoy description #pod
istioctl dashboard envoy postgresql-0.datastore

## Istio 설치 상태 확인
istioctl verify-install

## 클러스터 정보 및 로그 캡처 지원 도구입니다.
istioctl bug-report

## Istio 구성 분석 및 검증 메시지 인쇄
istioctl analyze -n $namespace

## Istio policy 및 rules 파일 검증
#Aliases: validate, v
istioctl validate -f $policy_or_rules_yaml
istioctl v -f $policy_or_rules_yaml

#gateway pod로 cluster proxy config 조회
#Aliases: cluster, clusters, c
## 전체 조회
istioctl pc c -n $namespace $gatewayPod
istioctl pc c -n $namespace $gatewayPod -o json | jq '.[]'

#Pod Listener proxy config 조회
#Aliases: listener, listeners, l
## 전체 조회
istioctl pc l -n $namespace $pod
## Listner filter address
istioctl pc l -n $namespace $pod --address $address
istioctl pc l -n $namespace $pod --address $address -o json | jq '.[]'
## Listner filter port
istioctl pc l -n $namespace $pod --port $port
istioctl pc l -n $namespace $pod --port $port -o json | jq '.[]'

istioctl proxy-status
istioctl ps

authz           (Inspect Istio AuthorizationPolicy)
check-inject    (Check the injection status or inject-ability of a given resource, explains why it is (or will be) injected or not)
config          (Configure istioctl defaults)
describe        (Describe resource and related Istio configuration)
envoy-stats     (Retrieves Envoy metrics in the specified pod)
injector        (List sidecar injector and sidecar versions)
internal-debug  (Retrieves the debug information of istio)
metrics         (Prints the metrics for the specified workload(s) when running in Kubernetes.)
precheck        (Check whether Istio can safely be installed or upgraded)
proxy-status    (Retrieves the synchronization status of each Envoy in the mesh)
version         (Prints out build version information)
wait            (Wait for an Istio resource)
waypoint        (Manage waypoint configuration)
workload        (Commands to assist in configuring and deploying workloads running on VMs and other non-Kubernetes environments)
mhkim@fredric:~/playgrounds-fredric/iac/2.helm/cicd/argo-workflows$ istioctl experimental
authz           (Inspect Istio AuthorizationPolicy)
check-inject    (Check the injection status or inject-ability of a given resource, explains why it is (or will be) injected or not)
config          (Configure istioctl defaults)
describe        (Describe resource and related Istio configuration)
envoy-stats     (Retrieves Envoy metrics in the specified pod)
injector        (List sidecar injector and sidecar versions)
internal-debug  (Retrieves the debug information of istio)
metrics         (Prints the metrics for the specified workload(s) when running in Kubernetes.)
precheck        (Check whether Istio can safely be installed or upgraded)
proxy-status    (Retrieves the synchronization status of each Envoy in the mesh)
version         (Prints out build version information)
wait            (Wait for an Istio resource)
waypoint        (Manage waypoint configuration)
workload        (Commands to assist in configuring and deploying workloads running on VMs and other non-Kubernetes environments)

--context string          Kubernetes configuration context
  -h, --help                    help for istioctl
  -i, --istioNamespace string   Istio system namespace (default "istio-system")
  -c, --kubeconfig string       Kubernetes configuration file
  -n, --namespace string        Kubernetes namespace
      --vklog Level             number for the log level verbosity. Like -v flag. ex: --vklog=9