Interview › Istio & Service Mesh
How do you use istioctl proxy-config and proxy-status to debug Envoy?
Istio & Service Mesh · Intermediate level
Answer
I use istioctl proxy-status to check whether proxies are connected and synced with istiod. I use istioctl proxy-config to inspect the actual Envoy configuration for listeners, routes, clusters, endpoints, bootstrap, and secrets.
Technical explanation
proxy-status quickly shows stale or disconnected proxies, which points to control-plane or network issues.
proxy-config answers what the proxy is actually enforcing, not what I intended to configure.
For routing bugs, route and cluster output usually finds the problem faster than reading YAML alone.
Hands-on example
Commands:
$ istioctl proxy-status
$ istioctl proxy-config listeners deploy/frontend -n app
$ istioctl proxy-config routes deploy/frontend -n app
$ istioctl proxy-config clusters deploy/frontend -n app
$ istioctl proxy-config secrets deploy/frontend -n app
If a proxy is STALE, restart only after checking why it cannot receive or apply config.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More Istio & Service Mesh interview questions
- What is Istio, and what are the core capabilities it provides?
- What is the difference between the Istio control plane and data plane?
- What is istiod, and what does it do?
- What is Envoy, and what role does it play in Istio?
- What is the sidecar pattern, and how does Istio inject the proxy?
- How does automatic sidecar injection work (namespace label, webhook)?
- What is the Istio ambient (sidecarless) mode, and how does it differ from sidecar mode?
- What is the difference between ztunnel and a waypoint proxy in ambient mode?