{"id":51225619,"url":"https://github.com/junior/istio-probe","last_synced_at":"2026-06-28T11:01:48.712Z","repository":{"id":367607830,"uuid":"1279854055","full_name":"junior/istio-probe","owner":"junior","description":"In-cluster diagnostics page to test \u0026 validate Istio after an upgrade — resource counts, control-plane version, mesh routing","archived":false,"fork":false,"pushed_at":"2026-06-26T17:14:44.000Z","size":426,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-26T19:10:40.524Z","etag":null,"topics":["diagnostics","istio","kubernetes","observability","service-mesh"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/junior.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-25T04:20:28.000Z","updated_at":"2026-06-26T17:14:47.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/junior/istio-probe","commit_stats":null,"previous_names":["junior/istio-probe"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/junior/istio-probe","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/junior%2Fistio-probe","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/junior%2Fistio-probe/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/junior%2Fistio-probe/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/junior%2Fistio-probe/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/junior","download_url":"https://codeload.github.com/junior/istio-probe/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/junior%2Fistio-probe/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34885802,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-28T02:00:05.809Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["diagnostics","istio","kubernetes","observability","service-mesh"],"created_at":"2026-06-28T11:01:44.922Z","updated_at":"2026-06-28T11:01:48.707Z","avatar_url":"https://github.com/junior.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# istio-probe\n\nA tiny in-cluster diagnostics page to **test \u0026 validate Istio after an upgrade**. Deploy it\nbehind the Istio ingress gateway, open it, and one page shows the request the mesh forwarded\nplus a live inventory — **counts of every Istio resource type** (VirtualServices, Gateways,\nDestinationRules, …), istiod version + readiness, the ingress gateway, mesh mTLS mode, and\ninjected-namespace count. One static Go binary, standard library only, distroless and non-root.\n\n![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)\n![Go](https://img.shields.io/badge/Go-1.26-00ADD8?logo=go\u0026logoColor=white)\n![image](https://img.shields.io/badge/image-distroless%20%C2%B7%20non--root-3b5bdb.svg)\n![CI](https://github.com/junior/istio-probe/actions/workflows/ci.yml/badge.svg)\n\n![istio-probe screenshot](docs/screenshot.png)\n\n## What it shows\n\n- **Istio resources** — a live count of every type: VirtualService, Gateway, DestinationRule,\n  ServiceEntry, Sidecar, EnvoyFilter, WorkloadEntry/Group, PeerAuthentication, AuthorizationPolicy,\n  RequestAuthentication, Telemetry, WasmPlugin.\n- **Control plane** — istiod **version** (from its image tag) + readiness, the ingress gateway,\n  mesh **mTLS mode** (from the root-namespace PeerAuthentication), and how many namespaces have\n  sidecar injection enabled.\n- **Request through the mesh** — the forwarded request with the Envoy/B3 headers highlighted\n  (`x-request-id`, `x-b3-*`, `x-envoy-*`, `x-forwarded-*`) + a banner confirming it arrived via\n  the mesh. Plus the Kubernetes version and pod identity.\n\nEndpoints: **`/`** (page) · **`/api/info`** (everything as JSON) · **`/healthz`**.\n\n## How it reads the cluster\n\nIt uses the **pod's ServiceAccount** token against the in-cluster Kubernetes API — no kubeconfig,\nno long-lived credentials. That needs a small **read-only** ClusterRole (`get`/`list` on the Istio\nCRDs + Deployments + Namespaces); it's in [`k8s/rbac.yaml`](k8s/rbac.yaml) and never writes anything.\n\n## Deploy\n\n```bash\n# 1) edit k8s/rbac.yaml: set the ClusterRoleBinding subject namespace to where you deploy\nkubectl apply -f k8s/rbac.yaml\nkubectl apply -f k8s/deployment.yaml\nkubectl apply -f k8s/service.yaml\n# 2) expose it via the Istio ingress gateway (edit the host first)\nkubectl apply -f k8s/gateway.yaml\n```\n\nThen browse the host — the green banner + Envoy headers confirm Istio routed to the pod, and the\ncards show the inventory. Or, quickly, without the gateway:\n\n```bash\nkubectl port-forward deploy/istio-probe 8080:8080   # → http://localhost:8080\n```\n\n## Configuration\n\n| Variable | Default | Purpose |\n|----------|---------|---------|\n| `ISTIO_NAMESPACE` | `istio-system` | where istiod / the ingress gateway run |\n| `PORT` | `8080` | listen port |\n| `PROBE_FACT_*` | — | each becomes a row in a **Facts** card (e.g. `PROBE_FACT_Mesh_ID`) |\n| `PROBE_DEMO` | `false` | fill sample values for local previews (clearly flagged) |\n\n## Run locally (no cluster)\n\n```bash\ndocker run --rm -p 8080:8080 -e PROBE_DEMO=1 ghcr.io/junior/istio-probe   # sample data\n# against a real cluster, run where you have kube access (it reads in-cluster config when present)\n```\n\n## Security\n\nSingle static binary on `distroless/static:nonroot` — **uid 65532**, **read-only root\nfilesystem**, **all capabilities dropped**, `RuntimeDefault` seccomp, no shell (~10 MB). Cluster\naccess is the pod's auto-rotating ServiceAccount token with a **read-only** ClusterRole.\n\n## Develop\n\n```bash\ngo run .              # → http://localhost:8080  (try PROBE_DEMO=1)\ngo test ./...\ngo vet ./... \u0026\u0026 gofmt -l .\n```\n\n## Releasing\n\nImages publish to **GHCR** via [`.github/workflows/release.yml`](.github/workflows/release.yml)\n— multi-platform (`linux/amd64`, `linux/arm64`), tagged `latest` + the semver version:\n\n```bash\ngit tag v0.1.0 \u0026\u0026 git push origin v0.1.0\n```\n\n## License\n\n[MIT](LICENSE) — built by [Adao Oliveira Jr](https://adao.dev).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjunior%2Fistio-probe","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjunior%2Fistio-probe","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjunior%2Fistio-probe/lists"}