Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Oct 19, 2026

Utilities

Analyze local Istio manifests for diagnostics

istio-analyze is an offline Istio manifest analyzer that returns native JSON diagnostics.

Agent
Locate missing mesh referencesKeep native diagnostic levelsReview manifests before deployment

overview

What istio-analyze does

Analyze local Kubernetes and Istio manifests offline and return native JSON diagnostics. No cluster access or deployment.

Analyze supplied Kubernetes/Istio YAML or JSON with Istio 1.31.1, --use-kube=false and --all-namespaces. The native JSON array includes Info, Warning and Error diagnostics. Findings are successful data; an empty array means no diagnostics from the analyzers for these supplied resources.

Input must contain 1 to 100 resource documents with string kind and apiVersion, at most 2 MiB. Safe YAML prechecks reject constructors and invalid shapes. Analysis has a 90-second timeout and 10 MiB JSON limit. Source-ingestion errors are rejected even when native JSON mode exits zero; existing output files are refused.

Packaged version: 1.31.1. Upstream license: Apache-2.0.

source github.com/istio/istio/tree/190ae921b848ec010b8be4457533837ed8fce258

use cases

Where istio-analyze fits

Locate missing mesh references

Find a VirtualService gateway reference absent from supplied resources.

Keep native diagnostic levels

Receive Info, Warning and Error findings in JSON.

Review manifests before deployment

Analyze files with an isolated environment and no cluster query.

reference

istio-analyze inputs and flags

1 inputs
NameTypeFlagDescription
inputFILE--inputLocal multi-document Kubernetes/Istio YAML or JSON, up to 2 MiB and 100 documents. No kubeconfig required.

Showing key inputs. istio-analyze exposes 1 inputs in total.

example

Run istio-analyze

istio-analyze · command
python3 /app/run.py --input ./input.txt ./output

guidance

Choosing istio-analyze

Use istio-analyze to inspect local resource relationships with built-in defaults. References missing from the supplied manifests can generate findings. Unknown kinds may be ignored; a clean array does not establish deployed mesh health or comprehensive Kubernetes schema validity.

faq

istio-analyze questions

input: Local multi-document Kubernetes/Istio YAML or JSON, up to 2 MiB and 100 documents. No kubeconfig required.

Analyze supplied Kubernetes/Istio YAML or JSON with Istio 1.31.1, --use-kube=false and --all-namespaces. The native JSON array includes Info, Warning and Error diagnostics. Findings are successful data; an empty array means no diagnostics from the analyzers for these supplied resources.

Input must contain 1 to 100 resource documents with string kind and apiVersion, at most 2 MiB. Safe YAML prechecks reject constructors and invalid shapes. Analysis has a 90-second timeout and 10 MiB JSON limit. Source-ingestion errors are rejected even when native JSON mode exits zero; existing output files are refused.

Use istio-analyze to inspect local resource relationships with built-in defaults. References missing from the supplied manifests can generate findings. Unknown kinds may be ignored; a clean array does not establish deployed mesh health or comprehensive Kubernetes schema validity.

The public image repository gives immutable image and ORAS download commands, the expected source/notices bundle checksum and pinned upstream source directions. The accompanying OCI bundle retains the original build recipe, runtime sources and full installed notices. The Git recipe keeps primary notices and an exact layer/hash index; it does not duplicate the full installed notice tree or mirror every upstream source archive. Image, source and license notice downloads.

related

More Utilities tools

  1. browser-fetch

    Headless Chromium render: requested URL, final URL, status, and title next to the page.

  2. cewl

    Spider a URL and return a wordlist for password crackers.

  3. csvkit

    SQL on one CSV. The table name is the file stem.

  4. dnsgen

    Wordlist and mined-word subdomain permutation.

  5. duckdb

    In-process SQL on CSV, JSON, and Parquet. No server.

  6. edge-tts

    Microsoft Edge neural speech from text or a script file. No API key.

Run istio-analyze yourself

The saved fixture produced two diagnostics and the verifier confirmed IST0101 for missing-gateway. This is a saved verifier summary, not a retained complete diagnostic array. The command shows the container entrypoint with example paths.

Open istio-analyze in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.