diff --git a/content/en/docs/reference/commands/galley/index.html b/content/en/docs/reference/commands/galley/index.html index 39a7a6f673..dd02364ad7 100644 --- a/content/en/docs/reference/commands/galley/index.html +++ b/content/en/docs/reference/commands/galley/index.html @@ -31,12 +31,12 @@ remove_toc_prefix: 'galley ' --log_caller <string> -Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] (default ``) +Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, default, grpcAdapter, mcp, model, processing, rbac, resource, server, source, validation, validationController, validationServer] (default ``) --log_output_level <string> -Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`) +Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, analysis, attributes, default, grpcAdapter, mcp, model, processing, rbac, resource, server, source, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`) --log_rotate <string> @@ -61,7 +61,7 @@ remove_toc_prefix: 'galley ' --log_stacktrace_level <string> -Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`) +Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, analysis, attributes, default, grpcAdapter, mcp, model, processing, rbac, resource, server, source, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`) --log_target <stringArray> @@ -101,12 +101,12 @@ remove_toc_prefix: 'galley ' --log_caller <string> -Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] (default ``) +Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, default, grpcAdapter, mcp, model, processing, rbac, resource, server, source, validation, validationController, validationServer] (default ``) --log_output_level <string> -Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`) +Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, analysis, attributes, default, grpcAdapter, mcp, model, processing, rbac, resource, server, source, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`) --log_rotate <string> @@ -131,7 +131,7 @@ remove_toc_prefix: 'galley ' --log_stacktrace_level <string> -Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`) +Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, analysis, attributes, default, grpcAdapter, mcp, model, processing, rbac, resource, server, source, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`) --log_target <stringArray> @@ -271,12 +271,12 @@ remove_toc_prefix: 'galley ' --log_caller <string> -Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] (default ``) +Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, default, grpcAdapter, mcp, model, processing, rbac, resource, server, source, validation, validationController, validationServer] (default ``) --log_output_level <string> -Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`) +Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, analysis, attributes, default, grpcAdapter, mcp, model, processing, rbac, resource, server, source, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`) --log_rotate <string> @@ -301,7 +301,7 @@ remove_toc_prefix: 'galley ' --log_stacktrace_level <string> -Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`) +Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, analysis, attributes, default, grpcAdapter, mcp, model, processing, rbac, resource, server, source, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`) --log_target <stringArray> @@ -384,11 +384,6 @@ remove_toc_prefix: 'galley ' File containing the x509 private key matching --tlsCertFile. (default `/etc/certs/key.pem`) ---useOldProcessor - -Use the old processing pipeline for config processing - - --validation-port <uint> HTTPS port of the validation service. (default `9443`) @@ -401,17 +396,17 @@ remove_toc_prefix: 'galley ' --validation.tls.caCertificates <string> -File containing the caBundle that signed the cert/key specified by --validation.tls.clientCertificate and --validation.tls.privateKey. (default ``) +File containing the caBundle that signed the cert/key specified by --validation.tls.clientCertificate and --validation.tls.privateKey. (default `/etc/certs/root-cert.pem`) --validation.tls.clientCertificate <string> -File containing the x509 Certificate for HTTPS validation. (default ``) +File containing the x509 Certificate for HTTPS validation. (default `/etc/certs/cert-chain.pem`) --validation.tls.privateKey <string> -File containing the x509 private key matching --validation.tls.clientCertificate. (default ``) +File containing the x509 private key matching --validation.tls.clientCertificate. (default `/etc/certs/key.pem`) --watchConfigFiles @@ -478,12 +473,12 @@ validation: --log_caller <string> -Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] (default ``) +Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, default, grpcAdapter, mcp, model, processing, rbac, resource, server, source, validation, validationController, validationServer] (default ``) --log_output_level <string> -Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`) +Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, analysis, attributes, default, grpcAdapter, mcp, model, processing, rbac, resource, server, source, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`) --log_rotate <string> @@ -508,7 +503,7 @@ validation: --log_stacktrace_level <string> -Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`) +Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, analysis, attributes, default, grpcAdapter, mcp, model, processing, rbac, resource, server, source, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`) --log_target <stringArray> @@ -551,6 +546,30 @@ These environment variables affect the behavior of the galley comma 1m0s + +MCP_SOURCE_REQ_BURST_SIZE +Integer +100 + + + +MCP_SOURCE_REQ_FREQ +Time Duration +1s + + + +SOURCE_SERVER_STREAM_BURST_SIZE +Integer +100 + + + +SOURCE_SERVER_STREAM_FREQ +Time Duration +1s + +

Exported metrics

@@ -575,6 +594,7 @@ These environment variables affect the behavior of the galley comma galley_source_kube_event_success_totalCountThe number of times a kubernetes source successfully handled an event galley_validation_cert_key_update_errorsCountGalley validation webhook certificate updates errors galley_validation_cert_key_updatesCountGalley validation webhook certificate updates +galley_validation_config_delete_errorCountk8s webhook configuration delete error galley_validation_config_loadCountk8s webhook configuration (re)loads galley_validation_config_load_errorCountk8s webhook configuration (re)load error galley_validation_config_update_errorCountk8s webhook configuration update error diff --git a/content/en/docs/reference/commands/istio_ca/index.html b/content/en/docs/reference/commands/istio_ca/index.html index 1877781d44..4551d13aea 100644 --- a/content/en/docs/reference/commands/istio_ca/index.html +++ b/content/en/docs/reference/commands/istio_ca/index.html @@ -85,11 +85,11 @@ remove_toc_prefix: 'istio_ca ' --log_caller <string> -Comma-separated list of scopes for which to include caller information, scopes can be any of [all, caSecretController, configMapController, default, k8sController, monitor, pkiCaLog, rootCertRotator, serverCaLog] (default ``) +Comma-separated list of scopes for which to include caller information, scopes can be any of [all, configmapcontroller, default, monitor, pkica, rootcertrotator, secretcontroller, serverca] (default ``) --log_output_level <string> -Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, caSecretController, configMapController, default, k8sController, monitor, pkiCaLog, rootCertRotator, serverCaLog] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`) +Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, configmapcontroller, default, monitor, pkica, rootcertrotator, secretcontroller, serverca] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`) --log_rotate <string> @@ -109,7 +109,7 @@ remove_toc_prefix: 'istio_ca ' --log_stacktrace_level <string> -Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, caSecretController, configMapController, default, k8sController, monitor, pkiCaLog, rootCertRotator, serverCaLog] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`) +Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, configmapcontroller, default, monitor, pkica, rootcertrotator, secretcontroller, serverca] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`) --log_target <stringArray> @@ -219,11 +219,11 @@ remove_toc_prefix: 'istio_ca ' --log_caller <string> -Comma-separated list of scopes for which to include caller information, scopes can be any of [all, caSecretController, configMapController, default, k8sController, monitor, pkiCaLog, rootCertRotator, serverCaLog] (default ``) +Comma-separated list of scopes for which to include caller information, scopes can be any of [all, configmapcontroller, default, monitor, pkica, rootcertrotator, secretcontroller, serverca] (default ``) --log_output_level <string> -Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, caSecretController, configMapController, default, k8sController, monitor, pkiCaLog, rootCertRotator, serverCaLog] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`) +Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, configmapcontroller, default, monitor, pkica, rootcertrotator, secretcontroller, serverca] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`) --log_rotate <string> @@ -243,7 +243,7 @@ remove_toc_prefix: 'istio_ca ' --log_stacktrace_level <string> -Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, caSecretController, configMapController, default, k8sController, monitor, pkiCaLog, rootCertRotator, serverCaLog] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`) +Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, configmapcontroller, default, monitor, pkica, rootcertrotator, secretcontroller, serverca] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`) --log_target <stringArray> @@ -286,12 +286,12 @@ remove_toc_prefix: 'istio_ca ' --log_caller <string> -Comma-separated list of scopes for which to include caller information, scopes can be any of [all, caSecretController, configMapController, default, k8sController, monitor, pkiCaLog, rootCertRotator, serverCaLog] (default ``) +Comma-separated list of scopes for which to include caller information, scopes can be any of [all, configmapcontroller, default, monitor, pkica, rootcertrotator, secretcontroller, serverca] (default ``) --log_output_level <string> -Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, caSecretController, configMapController, default, k8sController, monitor, pkiCaLog, rootCertRotator, serverCaLog] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`) +Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, configmapcontroller, default, monitor, pkica, rootcertrotator, secretcontroller, serverca] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`) --log_rotate <string> @@ -316,7 +316,7 @@ remove_toc_prefix: 'istio_ca ' --log_stacktrace_level <string> -Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, caSecretController, configMapController, default, k8sController, monitor, pkiCaLog, rootCertRotator, serverCaLog] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`) +Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, configmapcontroller, default, monitor, pkica, rootcertrotator, secretcontroller, serverca] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`) --log_target <stringArray> @@ -384,6 +384,12 @@ These environment variables affect the behavior of the istio_ca com The minimum workload certificate rotation grace period. +JWT_POLICY +String +third-party-jwt +The JWT validation policy. + + NAMESPACE String diff --git a/content/en/docs/reference/commands/istioctl/index.html b/content/en/docs/reference/commands/istioctl/index.html index b8604b7ffa..d4f369a44b 100644 --- a/content/en/docs/reference/commands/istioctl/index.html +++ b/content/en/docs/reference/commands/istioctl/index.html @@ -4,7 +4,7 @@ source_repo: https://github.com/istio/istio title: istioctl description: Istio control interface. generator: pkg-collateral-docs -number_of_entries: 75 +number_of_entries: 76 max_toc_level: 2 remove_toc_prefix: 'istioctl ' --- @@ -38,7 +38,7 @@ debug and diagnose their Istio mesh. --log_output_level <string> -Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info,validation:error,processing:error,source:error,analysis:warn`) +Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`) --namespace <string> @@ -62,7 +62,7 @@ debug and diagnose their Istio mesh. --all-namespaces - +-A Analyze all namespaces @@ -76,11 +76,6 @@ debug and diagnose their Istio mesh. The name of the kubeconfig context to use (default ``) ---discovery --d -'true' to enable service discovery, 'false' to disable it. Defaults to true if --use-kube is set, false otherwise. Analyzers requiring resources made available by enabling service discovery will be skipped. - - --failure-threshold <Level> The severity level of analysis at which to set a non-zero exit code. Valid values: [Info Warn Error] (default `Warn`) @@ -103,7 +98,7 @@ debug and diagnose their Istio mesh. --log_output_level <string> -Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info,validation:error,processing:error,source:error,analysis:warn`) +Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`) --meshConfigFile <string> @@ -126,9 +121,19 @@ debug and diagnose their Istio mesh. The severity level of analysis at which to display messages. Valid values: [Info Warn Error] (default `Info`) +--suppress <stringArray> +-S +Suppress reporting a message code on a specific resource. Values are supplied in the form <code>=<resource> (e.g. '--suppress "IST0102=DestinationRule primary-dr.default"'). Can be repeated. You can include the wildcard character '*' to support a partial match (e.g. '--suppress "IST0102=DestinationRule *.default" ). (default `[]`) + + +--timeout <duration> + +the duration to wait before failing (default `30s`) + + --use-kube -k -Use live Kubernetes cluster for analysis +Use live Kubernetes cluster for analysis. Set --use-kube=false to analyze files only. --verbose @@ -139,20 +144,21 @@ debug and diagnose their Istio mesh.

Examples


-# Analyze yaml files
-istioctl analyze a.yaml b.yaml
-
 # Analyze the current live cluster
-istioctl analyze -k
+istioctl analyze
 
 # Analyze the current live cluster, simulating the effect of applying additional yaml files
-istioctl analyze -k a.yaml b.yaml
+istioctl analyze a.yaml b.yaml
 
-# Analyze yaml files, overriding service discovery to enabled
-istioctl analyze -d true a.yaml b.yaml services.yaml
+# Analyze yaml files without connecting to a live cluster
+istioctl analyze --use-kube=false a.yaml b.yaml
 
-# Analyze the current live cluster, overriding service discovery to disabled
-istioctl analyze -k -d false
+# Analyze the current live cluster and suppress PodMissingProxy for pod mypod in namespace 'testing'.
+istioctl analyze -S "IST0103=Pod mypod.testing"
+
+# Analyze the current live cluster and suppress PodMissingProxy for all pods in namespace 'testing',
+# and suppress MisplacedAnnotation on deployment foobar in namespace default.
+istioctl analyze -S "IST0103=Pod *.testing" -S "IST0107=Deployment foobar.default"
 
 # List available analyzers
 istioctl analyze -L
@@ -190,7 +196,7 @@ A group of commands used to interact with Istio authentication policies.
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -237,7 +243,7 @@ and check if TLS settings are compatible between them.
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -287,7 +293,7 @@ istioctl authn tls-check foo-656bd7df7c-5zp4s.default bar
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -332,7 +338,7 @@ istioctl authn tls-check foo-656bd7df7c-5zp4s.default bar
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -384,7 +390,7 @@ istioctl d [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -429,7 +435,7 @@ istioctl d [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -477,7 +483,7 @@ istioctl d [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -525,7 +531,7 @@ istioctl d [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -568,7 +574,7 @@ istioctl d [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -611,7 +617,7 @@ istioctl d [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -654,7 +660,7 @@ istioctl d [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -697,7 +703,7 @@ istioctl d [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -740,7 +746,7 @@ istioctl d [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -782,7 +788,7 @@ istioctl deregister my-svc 172.17.0.2
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -813,6 +819,16 @@ istioctl deregister my-svc 172.17.0.2
 The name of the kubeconfig context to use  (default ``)
 
 
+--injectConfigFile <string>
+
+injection configuration filename. Cannot be used with --injectConfigMapName  (default ``)
+
+
+--injectConfigMapName <string>
+
+ConfigMap name for Istio sidecar injection, key should be "config".  (default `istio-sidecar-injector`)
+
+
 --istioNamespace <string>
 -i
 Istio system namespace  (default `istio-system`)
@@ -825,15 +841,103 @@ istioctl deregister my-svc 172.17.0.2
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
+
+
+--meshConfigFile <string>
+
+mesh configuration filename. Takes precedence over --meshConfigMapName if set  (default ``)
+
+
+--meshConfigMapName <string>
+
+ConfigMap name for Istio mesh configuration, key should be "mesh"  (default `istio`)
 
 
 --namespace <string>
 -n
 Config namespace  (default ``)
 
+
+--valuesFile <string>
+
+injection values configuration filename.  (default ``)
+
 
 
+
istioctl experimental add-to-mesh deployment

+
istioctl experimental add-to-mesh deployment restarts pods with the Istio sidecar.  Use 'add-to-mesh'
+to test deployments for compatibility with Istio.  If your deployment does not function after
+using 'add-to-mesh' you must re-deploy it and troubleshoot it for Istio compatibility.
+See https://istio.io/docs/setup/kubernetes/additional-setup/requirements/
+THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
+

+
istioctl experimental add-to-mesh deployment [flags]
+

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
FlagsShorthandDescription
--context <string>The name of the kubeconfig context to use  (default ``)
--injectConfigFile <string>injection configuration filename. Cannot be used with --injectConfigMapName  (default ``)
--injectConfigMapName <string>ConfigMap name for Istio sidecar injection, key should be "config".  (default `istio-sidecar-injector`)
--istioNamespace <string>-iIstio system namespace  (default `istio-system`)
--kubeconfig <string>-cKubernetes configuration file  (default ``)
--log_output_level <string>Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
--meshConfigFile <string>mesh configuration filename. Takes precedence over --meshConfigMapName if set  (default ``)
--meshConfigMapName <string>ConfigMap name for Istio mesh configuration, key should be "mesh"  (default `istio`)
--namespace <string>-nConfig namespace  (default ``)
--valuesFile <string>injection values configuration filename.  (default ``)

+
Examples

+
istioctl experimental add-to-mesh deployment productpage-v1
+

 
istioctl experimental add-to-mesh external-service

 
istioctl experimental add-to-mesh external-service create a ServiceEntry and\ 
 a Service without selector for the specified external service in Istio service mesh.
@@ -862,6 +966,16 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 The name of the kubeconfig context to use  (default ``)
 
 
+--injectConfigFile <string>
+
+injection configuration filename. Cannot be used with --injectConfigMapName  (default ``)
+
+
+--injectConfigMapName <string>
+
+ConfigMap name for Istio sidecar injection, key should be "config".  (default `istio-sidecar-injector`)
+
+
 --istioNamespace <string>
 -i
 Istio system namespace  (default `istio-system`)
@@ -879,7 +993,17 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
+
+
+--meshConfigFile <string>
+
+mesh configuration filename. Takes precedence over --meshConfigMapName if set  (default ``)
+
+
+--meshConfigMapName <string>
+
+ConfigMap name for Istio mesh configuration, key should be "mesh"  (default `istio`)
 
 
 --namespace <string>
@@ -891,6 +1015,11 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 -s
 Service account to link to the service  (default `default`)
 
+
+--valuesFile <string>
+
+injection values configuration filename.  (default ``)
+
 
 
 
Examples

@@ -943,7 +1072,7 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --meshConfigFile <string>
@@ -985,7 +1114,7 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 
 
 --all-namespaces
-
+-A
 Analyze all namespaces 
 
 
@@ -999,11 +1128,6 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 The name of the kubeconfig context to use  (default ``)
 
 
---discovery
--d
-'true' to enable service discovery, 'false' to disable it. Defaults to true if --use-kube is set, false otherwise. Analyzers requiring resources made available by enabling service discovery will be skipped. 
-
-
 --failure-threshold <Level>
 
 The severity level of analysis at which to set a non-zero exit code. Valid values: [Info Warn Error]  (default `Warn`)
@@ -1026,7 +1150,7 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --meshConfigFile <string>
@@ -1041,7 +1165,7 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 
 --output <string>
 -o
-Output format: one of [yaml log json]  (default `log`)
+Output format: one of [log json yaml]  (default `log`)
 
 
 --output-threshold <Level>
@@ -1049,9 +1173,19 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 The severity level of analysis at which to display messages. Valid values: [Info Warn Error]  (default `Info`)
 
 
+--suppress <stringArray>
+-S
+Suppress reporting a message code on a specific resource. Values are supplied in the form <code>=<resource> (e.g. '--suppress "IST0102=DestinationRule primary-dr.default"'). Can be repeated. You can include the wildcard character '*' to support a partial match (e.g. '--suppress "IST0102=DestinationRule *.default" ).  (default `[]`)
+
+
+--timeout <duration>
+
+the duration to wait before failing  (default `30s`)
+
+
 --use-kube
 -k
-Use live Kubernetes cluster for analysis 
+Use live Kubernetes cluster for analysis. Set --use-kube=false to analyze files only. 
 
 
 --verbose
@@ -1062,20 +1196,21 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 
 
Examples

 

-# Analyze yaml files
-istioctl analyze a.yaml b.yaml
-
 # Analyze the current live cluster
-istioctl analyze -k
+istioctl analyze
 
 # Analyze the current live cluster, simulating the effect of applying additional yaml files
-istioctl analyze -k a.yaml b.yaml
+istioctl analyze a.yaml b.yaml
 
-# Analyze yaml files, overriding service discovery to enabled
-istioctl analyze -d true a.yaml b.yaml services.yaml
+# Analyze yaml files without connecting to a live cluster
+istioctl analyze --use-kube=false a.yaml b.yaml
 
-# Analyze the current live cluster, overriding service discovery to disabled
-istioctl analyze -k -d false
+# Analyze the current live cluster and suppress PodMissingProxy for pod mypod in namespace 'testing'.
+istioctl analyze -S "IST0103=Pod mypod.testing"
+
+# Analyze the current live cluster and suppress PodMissingProxy for all pods in namespace 'testing',
+# and suppress MisplacedAnnotation on deployment foobar in namespace default.
+istioctl analyze -S "IST0103=Pod *.testing" -S "IST0107=Deployment foobar.default"
 
 # List available analyzers
 istioctl analyze -L
@@ -1113,7 +1248,7 @@ istioctl analyze -L
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1126,8 +1261,11 @@ istioctl analyze -L
 
  # Check Envoy authorization configuration for pod httpbin-88ddbcfdd-nt5jb:
   istioctl x authz check httpbin-88ddbcfdd-nt5jb
 
-  # Convert the v1alpha1 RBAC policies in the current cluster to v1beta1 authorization policies:
-  istioctl x authz convert > v1beta1-authz.yaml
+  # Convert the v1alpha1 RBAC policies in the current cluster:
+  istioctl x authz convert > authorization-policies.yaml
+
+  # Convert the v1alpha1 RBAC policies in the file with the given services and root namespace:
+  istioctl x authz convert -f rbac-policies.yaml -s my-service.yaml -r istio-system > authorization-policies.yaml
 
 

 
istioctl experimental authz check

@@ -1162,7 +1300,7 @@ with authorization and the rules used in the authorization.

 
 --file <string>
 -f
-Check the Envoy config dump from a file  (default ``)
+The json file with Envoy config dump to be checked  (default ``)
 
 
 --istioNamespace <string>
@@ -1177,7 +1315,7 @@ with authorization and the rules used in the authorization.

 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1194,20 +1332,18 @@ with authorization and the rules used in the authorization.

   istioctl x authz check -f httpbin_config_dump.json
 

 
istioctl experimental authz convert

-
Convert Istio v1alpha1 RBAC policy to v1beta1 authorization policy. The command talks to Kubernetes
-API server to get all the information needed to complete the conversion, including the v1alpha1 RBAC policies in the current
-cluster, the Istio config-map for root namespace configuration and the k8s Service translating the
+
Convert Istio v1alpha1 RBAC policy to v1beta1 authorization policy. By default,
+The command talks to Istio Pilot and Kubernetes API server to get all the information
+needed for the conversion, including the v1alpha1 RBAC policies in the current cluster,
+the value of the root namespace and the Kubernetes services that provide the mapping from the
 service name to workload selector.

-
The tool can also be used in offline mode without talking to the Kubernetes API server. In this mode,
-all needed information is provided through the command line.

-
Note: The converter tool makes a best effort attempt to keep the syntax unchanged when
-converting v1alph1 RBAC policy to v1beta1 policy. However, in some cases, strict
-mapping with equivalent syntax is not possible (e.g., constraints no longer valid
-in the new workload oriented model, converting a service name containing a wildcard
-to workload selector).

-
Please always review the converted policies, and remove the "===PLEASE REVIEW THE GENERATED POLICY AND REMOVE THIS LINE BEFORE APPLYING IT==="
-string on top of the converted policies before apply them.

-
THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
+
The tool can also be used in an offline mode when specified with flag -f. In this mode,
+the tool doesn't access the network and all needed information is provided
+through the command line.

+
Note: The converter tool makes a best effort attempt to keep the syntax unchanged during
+the conversion. However, in some cases, strict mapping with equivalent syntax is not
+possible (e.g., constraints no longer supported in the new workload oriented model).

+
PLEASE ALWAYS REVIEW THE CONVERTED POLICIES BEFORE APPLYING.
 

 
istioctl experimental authz convert [flags]
 

@@ -1221,6 +1357,11 @@ string on top of the converted policies before apply them.

 
 
 
+--allowNoClusterRbacConfig
+
+Continue the conversion even if there is no ClusterRbacConfig in the cluster 
+
+
 --context <string>
 
 The name of the kubeconfig context to use  (default ``)
@@ -1228,7 +1369,7 @@ string on top of the converted policies before apply them.

 
 --file <stringSlice>
 -f
-v1alpha1 RBAC policy that needs to be converted to v1beta1 authorization policy  (default `[]`)
+The yaml file with v1alpha1 RBAC policies to be converted  (default `[]`)
 
 
 --istioNamespace <string>
@@ -1243,17 +1384,7 @@ string on top of the converted policies before apply them.

 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
-
-
---meshConfigFile <string>
--m
-Istio MeshConfig file that provides the root namespace value  (default ``)
-
-
---meshConfigMapName <string>
-
-ConfigMap name for Istio mesh configuration  (default `istio`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1261,19 +1392,24 @@ string on top of the converted policies before apply them.

 Config namespace  (default ``)
 
 
+--rootNamespace <string>
+-r
+Override the root namespace used in the conversion  (default `istio-system`)
+
+
 --service <stringSlice>
 -s
-Kubernetes Service resource that provides the mapping between service and workload  (default `[]`)
+The yaml file with Kubernetes services for the mapping from the service name to workload selector, used with -f  (default `[]`)
 
 
 
 
Examples

 
  # Convert the v1alpha1 RBAC policy in the current cluster:
-  istioctl x authz convert > v1beta1-authz.yaml
+  istioctl x authz convert > authorization-policies.yaml
 
-  # Convert the v1alpha1 RBAC policy provided through command line: 
+  # Convert the v1alpha1 RBAC policy in the given file: 
   istioctl x authz convert -f v1alpha1-policy-1.yaml,v1alpha1-policy-2.yaml
-  --service services.yaml --meshConfigFile meshConfig.yaml > v1beta1-authz.yaml
+  -s my-services.yaml -r my-root-namespace > authorization-policies.yaml
 
 

 
istioctl experimental convert-ingress

@@ -1307,7 +1443,7 @@ string on top of the converted policies before apply them.

 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1362,7 +1498,7 @@ string on top of the converted policies before apply them.

 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1422,7 +1558,7 @@ istioctl --Kubeconfig=c0.yaml x create-remote-secret --auth-type=plugin --auth-p
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1465,7 +1601,7 @@ istioctl --Kubeconfig=c0.yaml x create-remote-secret --auth-type=plugin --auth-p
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1513,7 +1649,7 @@ the configuration objects that affect that pod.

 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1567,7 +1703,7 @@ the configuration objects that affect that service.

 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1618,7 +1754,7 @@ also provides the inverse of "istioctl kube-inject -f".

 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1689,7 +1825,7 @@ calculated over a time interval of 1 minute.
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1736,7 +1872,7 @@ istioctl experimental metrics productpage-v1.foo reviews-v1.bar ratings-v1.baz
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1781,7 +1917,7 @@ istioctl experimental metrics productpage-v1.foo reviews-v1.bar ratings-v1.baz
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1831,7 +1967,7 @@ istioctl experimental metrics productpage-v1.foo reviews-v1.bar ratings-v1.baz
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1881,7 +2017,7 @@ istioctl experimental metrics productpage-v1.foo reviews-v1.bar ratings-v1.baz
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1924,7 +2060,7 @@ istioctl experimental metrics productpage-v1.foo reviews-v1.bar ratings-v1.baz
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -1962,7 +2098,7 @@ istioctl experimental metrics productpage-v1.foo reviews-v1.bar ratings-v1.baz
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -2012,7 +2148,7 @@ istioctl experimental metrics productpage-v1.foo reviews-v1.bar ratings-v1.baz
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -2078,7 +2214,7 @@ because in previous versions webhooks manage their own configurations.

 
 --injection-service <string>
 
-The service name of the injection webhook to manage.  (default `istio-sidecar-injector`)
+The service name of the injection webhook to manage.  (default `istio-pilot`)
 
 
 --istioNamespace <string>
@@ -2093,7 +2229,7 @@ because in previous versions webhooks manage their own configurations.

 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -2184,7 +2320,7 @@ istioctl experimental post-install webhook enable --validation --webhook-secret
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -2246,7 +2382,7 @@ istioctl experimental post-install webhook status --validation --validation-conf
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -2255,6 +2391,51 @@ istioctl experimental post-install webhook status --validation --validation-conf
 
 
 
+
istioctl experimental remove-from-mesh deployment

+
istioctl experimental remove-from-mesh deployment restarts pods with the Istio sidecar un-injected.
+THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
+

+
istioctl experimental remove-from-mesh deployment [flags]
+

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
FlagsShorthandDescription
--context <string>The name of the kubeconfig context to use  (default ``)
--istioNamespace <string>-iIstio system namespace  (default `istio-system`)
--kubeconfig <string>-cKubernetes configuration file  (default ``)
--log_output_level <string>Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
--namespace <string>-nConfig namespace  (default ``)

+
Examples

+
istioctl experimental remove-from-mesh deployment productpage-v1
+

 
istioctl experimental remove-from-mesh external-service

 
istioctl experimental remove-from-mesh external-service remove the ServiceEntry and\ 
 the kubernetes Service for the specified external service(eg:services running on VM) from Istio service mesh.
@@ -2290,7 +2471,7 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -2335,7 +2516,7 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -2371,14 +2552,14 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 Console/log output only, make no changes. 
 
 
---filename <string>
+--filename <stringSlice>
 -f
-Path to file containing IstioControlPlane CustomResource  (default ``)
+Path to file containing IstioControlPlane CustomResource  (default `[]`)
 
 
 --force
 
-Apply the upgrade without eligibility checks and testing for changes in profile default values 
+Apply the upgrade without eligibility checks 
 
 
 --istioNamespace <string>
@@ -2393,7 +2574,7 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --logtostderr
@@ -2407,7 +2588,7 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 
 
 --skip-confirmation
-
+-y
 If skip-confirmation is set, skips the prompting confirmation for value changes in this upgrade 
 
 
@@ -2418,7 +2599,7 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 
 --versionsURI <string>
 -u
-URI for operator versions to Istio versions map  (default `https://raw.githubusercontent.com/istio/operator/master/data/versions.yaml`)
+URI for operator versions to Istio versions map  (default ``)
 
 
 --wait
@@ -2463,7 +2644,7 @@ THIS COMMAND IS STILL UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -2555,7 +2736,7 @@ kube-inject on deployments to get the most up-to-date changes.
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --meshConfigFile <string>
@@ -2641,7 +2822,7 @@ istioctl kube-inject -f samples/bookinfo/platform/kube/bookinfo.yaml \
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --logtostderr
@@ -2684,9 +2865,10 @@ istioctl kube-inject -f samples/bookinfo/platform/kube/bookinfo.yaml \
 Console/log output only, make no changes. 
 
 
---filename <string>
+--filename <stringSlice>
 -f
-Path to file containing IstioControlPlane CustomResource  (default ``)
+Path to file containing IstioOperator CustomResource
+This flag can be specified multiple times to overlay multiple files. Multiple files are overlaid in left to right order.  (default `[]`)
 
 
 --force
@@ -2706,7 +2888,7 @@ istioctl kube-inject -f samples/bookinfo/platform/kube/bookinfo.yaml \
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --logtostderr
@@ -2724,15 +2906,16 @@ istioctl kube-inject -f samples/bookinfo/platform/kube/bookinfo.yaml \
 Maximum seconds to wait for all Istio resources to be ready. The --wait flag must be set for this flag to apply  (default `5m0s`)
 
 
---set <stringSlice>
+--set <stringArray>
 -s
-Set a value in IstioControlPlane CustomResource. e.g. --set policy.enabled=true.
-Overrides the corresponding path value in the selected profile or passed through IstioControlPlane CR
-customization file  (default `[]`)
+Override an IstioOperator value, e.g. to choose a profile
+(--set profile=demo), enable or disable components (--set components.policy.enabled=true), or override Istio 
+settings (--set values.global.mtls.enabled=true). See documentation for more info: 
+https://istio.io/docs/reference/config/istio.operator.v1alpha12.pb/#IstioControlPlaneSpec  (default `[]`)
 
 
 --skip-confirmation
-
+-y
 skipConfirmation determines whether the user is prompted for confirmation. 
 If set to true, the user is not prompted and a Yes response is assumed in all cases. 
 
@@ -2748,6 +2931,12 @@ If set to true, the user is not prompted and a Yes response is assumed in all ca
 
 
 
+
Examples

+
istioctl manifest apply  # installs the default profile on the current Kubernetes cluster context
+istioctl manifest apply --set values.global.mtls.enabled=true --set values.global.controlPlaneSecurityEnabled=true
+istioctl manifest apply --set profile=demo
+istioctl manifest apply --set installPackagePath=~/istio-releases/istio-1.4.3/install/kubernetes/operator/charts
+

 
istioctl manifest diff

 
The diff subcommand compares manifests from two files or directories.

 
istioctl manifest diff <file|dir> <file|dir> [flags]
@@ -2794,7 +2983,7 @@ If set to true, the user is not prompted and a Yes response is assumed in all ca
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --logtostderr
@@ -2853,9 +3042,10 @@ e.g.
 Console/log output only, make no changes. 
 
 
---filename <string>
+--filename <stringSlice>
 -f
-Path to file containing IstioControlPlane CustomResource  (default ``)
+Path to file containing IstioOperator CustomResource
+This flag can be specified multiple times to overlay multiple files. Multiple files are overlaid in left to right order.  (default `[]`)
 
 
 --force
@@ -2875,7 +3065,7 @@ e.g.
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --logtostderr
@@ -2893,11 +3083,12 @@ e.g.
 Manifest output directory path  (default ``)
 
 
---set <stringSlice>
+--set <stringArray>
 -s
-Set a value in IstioControlPlane CustomResource. e.g. --set policy.enabled=true.
-Overrides the corresponding path value in the selected profile or passed through IstioControlPlane CR
-customization file  (default `[]`)
+Override an IstioOperator value, e.g. to choose a profile
+(--set profile=demo), enable or disable components (--set components.policy.enabled=true), or override Istio 
+settings (--set values.global.mtls.enabled=true). See documentation for more info: 
+https://istio.io/docs/reference/config/istio.operator.v1alpha12.pb/#IstioControlPlaneSpec  (default `[]`)
 
 
 --verbose
@@ -2907,7 +3098,7 @@ customization file  (default `[]`)
 
 
 
istioctl manifest migrate

-
The migrate subcommand migrates a configuration from Helm values format to IstioControlPlane format.

+
The migrate subcommand migrates a configuration from Helm values or IstioControlPlane format to IstioOperator format.

 
istioctl manifest migrate [<filepath>] [flags]
 

 
@@ -2942,7 +3133,7 @@ customization file  (default `[]`)
-
+
@@ -2997,7 +3188,7 @@ customization file  (default `[]`)
-
+
@@ -3017,7 +3208,222 @@ customization file  (default `[]`)
-
+
+
+
+

 

 --log_output_level <string>
 Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 

 

 --logtostderr
 

 --log_output_level <string>
 Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 

 

 --logtostderr
 

 --versionsURI <string>
 -uURI for operator versions to Istio versions map  (default `https://raw.githubusercontent.com/istio/operator/master/data/versions.yaml`)URI for operator versions to Istio versions map  (default ``)

+
istioctl operator

+
The operator subcommand installs, removes and shows the status of the operator controller.

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
FlagsShorthandDescription
--context <string>The name of the kubeconfig context to use  (default ``)
--istioNamespace <string>-iIstio system namespace  (default `istio-system`)
--kubeconfig <string>-cKubernetes configuration file  (default ``)
--log_output_level <string>Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
--namespace <string>-nConfig namespace  (default ``)

+
istioctl operator init

+
The init subcommand installs the Istio operator controller in the cluster.

+
istioctl operator init [flags]
+

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
FlagsShorthandDescription
--context <string>The name of the kubeconfig context to use  (default ``)
--dry-runConsole/log output only, make no changes. 
--filename <string>-fPath to file containing IstioOperator CustomResource
+This flag can be specified multiple times to overlay multiple files. Multiple files are overlaid in left to right order.  (default ``)
--hub <string>The hub for the operator controller image  (default `unknown`)
--istioNamespace <string>-iIstio system namespace  (default `istio-system`)
--kubeconfig <string>-cKubernetes configuration file  (default ``)
--log_output_level <string>Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
--logtostderrSend logs to stderr. 
--namespace <string>-nConfig namespace  (default ``)
--operatorNamespace <string>The namespace the operator controller is installed into  (default `istio-operator`)
--readiness-timeout <duration>Maximum seconds to wait for the Istio operator to be ready. The --wait flag must be set for this flag to apply  (default `5m0s`)
--tag <string>The tag for the operator controller image  (default `unknown`)
--verboseVerbose output. 
--wait-wWait, if set will wait until all Pods, Services, and minimum number of Pods of a Deployment are in a ready state before the command exits. It will wait for a maximum duration of --readiness-timeout seconds 

+
istioctl operator remove

+
The remove subcommand removes the Istio operator controller from the cluster.

+
istioctl operator remove [flags]
+

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
FlagsShorthandDescription
--context <string>The name of the kubeconfig context to use  (default ``)
--dry-runConsole/log output only, make no changes. 
--filename <string>-fPath to file containing IstioOperator CustomResource
+This flag can be specified multiple times to overlay multiple files. Multiple files are overlaid in left to right order.  (default ``)
--forceProceed even with errors 
--hub <string>The hub for the operator controller image  (default `unknown`)
--istioNamespace <string>-iIstio system namespace  (default `istio-system`)
--kubeconfig <string>-cKubernetes configuration file  (default ``)
--log_output_level <string>Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
--logtostderrSend logs to stderr. 
--namespace <string>-nConfig namespace  (default ``)
--operatorNamespace <string>The namespace the operator controller is installed into  (default `istio-operator`)
--readiness-timeout <duration>Maximum seconds to wait for the Istio operator to be ready. The --wait flag must be set for this flag to apply  (default `5m0s`)
--tag <string>The tag for the operator controller image  (default `unknown`)
--verboseVerbose output. 
--wait-wWait, if set will wait until all Pods, Services, and minimum number of Pods of a Deployment are in a ready state before the command exits. It will wait for a maximum duration of --readiness-timeout seconds 
 

 
 

@@ -3055,7 +3461,7 @@ customization file  (default `[]`)
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --logtostderr
@@ -3110,7 +3516,7 @@ customization file  (default `[]`)
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --logtostderr
@@ -3158,9 +3564,10 @@ customization file  (default `[]`)
 Console/log output only, make no changes. 
 
 
---filename <string>
+--filename <stringSlice>
 -f
-Path to file containing IstioControlPlane CustomResource  (default ``)
+Path to file containing IstioOperator CustomResource
+This flag can be specified multiple times to overlay multiple files. Multiple files are overlaid in left to right order.  (default `[]`)
 
 
 --helm-values
@@ -3180,7 +3587,7 @@ customization file  (default `[]`)
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --logtostderr
@@ -3235,7 +3642,7 @@ customization file  (default `[]`)
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --logtostderr
@@ -3283,7 +3690,7 @@ customization file  (default `[]`)
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -3340,7 +3747,7 @@ customization file  (default `[]`)
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -3413,7 +3820,7 @@ istioctl proxy-config c [<pod-name[.namespace]>] [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -3502,7 +3909,7 @@ istioctl proxy-config ep [<pod-name[.namespace]>] [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -3591,7 +3998,7 @@ istioctl proxy-config l [<pod-name[.namespace]>] [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -3669,7 +4076,7 @@ istioctl proxy-config l [<pod-name[.namespace]>] [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -3742,7 +4149,7 @@ istioctl proxy-config r [<pod-name[.namespace]>] [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --name <string>
@@ -3815,7 +4222,7 @@ istioctl proxy-config r [<pod-name[.namespace]>] [flags]
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -3876,7 +4283,7 @@ Retrieves last sent and last acknowledged xDS sync from Pilot to each Envoy in t
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -3944,7 +4351,7 @@ Retrieves last sent and last acknowledged xDS sync from Pilot to each Envoy in t
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -3958,6 +4365,86 @@ Retrieves last sent and last acknowledged xDS sync from Pilot to each Envoy in t
 
 
 
+
istioctl upgrade

+
The upgrade command checks for upgrade version eligibility and, if eligible, upgrades the Istio control plane components in-place. Warning: traffic may be disrupted during upgrade. Please ensure PodDisruptionBudgets are defined to maintain service continuity.

+
istioctl upgrade [flags]
+

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
FlagsShorthandDescription
--context <string>The name of the kubeconfig context to use  (default ``)
--dry-runConsole/log output only, make no changes. 
--filename <stringSlice>-fPath to file containing IstioControlPlane CustomResource  (default `[]`)
--forceApply the upgrade without eligibility checks 
--istioNamespace <string>-iIstio system namespace  (default `istio-system`)
--kubeconfig <string>-cKubernetes configuration file  (default ``)
--log_output_level <string>Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
--logtostderrSend logs to stderr. 
--namespace <string>-nConfig namespace  (default ``)
--skip-confirmation-yIf skip-confirmation is set, skips the prompting confirmation for value changes in this upgrade 
--verboseVerbose output. 
--versionsURI <string>-uURI for operator versions to Istio versions map  (default ``)
--wait-wWait, if set will wait until all Pods, Services, and minimum number of Pods of a Deployment are in a ready state before the command exits. It will wait for a maximum duration of 10m0s 

 
istioctl validate

 
Validate Istio policy and rules (NOTE: validate is deprecated and will be removed in 1.6. Use 'istioctl analyze' to validate configuration.)

 
istioctl validate -f FILENAME [options] [flags]
@@ -3994,7 +4481,7 @@ Retrieves last sent and last acknowledged xDS sync from Pilot to each Envoy in t
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -4071,7 +4558,7 @@ Retrieves last sent and last acknowledged xDS sync from Pilot to each Envoy in t
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -4125,7 +4612,7 @@ Retrieves last sent and last acknowledged xDS sync from Pilot to each Envoy in t
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cacheLog, citadelClientLog, configMapController, conversions, default, googleCAClientLog, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, patch, processing, rbac, resource, runtime, sdsServiceLog, secretFetcherLog, source, stsClientLog, tpath, translator, util, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, cache, citadelclient, configmapcontroller, default, googleca, grpcAdapter, installer, mcp, model, patch, processing, rbac, resource, sds, secretfetcher, source, stsclient, tpath, translator, util, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info,validation:error,processing:error,source:error,analysis:warn,installer:warn,translator:warn`)
 
 
 --namespace <string>
@@ -4192,6 +4679,12 @@ These environment variables affect the behavior of the istioctl com
 Service name of istiod. If empty the istiod listener, certs will be disabled.
 
 
+ISTIO_GPRC_MAXRECVMSGSIZE
+Integer
+4194304
+Sets the max receive buffer size of gRPC stream in bytes.
+
+
 ISTIO_GPRC_MAXSTREAMS
 Integer
 100000
@@ -4204,6 +4697,12 @@ These environment variables affect the behavior of the istioctl com
 Selects the attribute expression language runtime for Mixer.
 
 
+JWT_POLICY
+String
+third-party-jwt
+The JWT validation policy.
+
+
 K8S_INGRESS_NS
 String
 
@@ -4228,6 +4727,12 @@ These environment variables affect the behavior of the istioctl com
 
 
 
+PILOT_CERT_PROVIDER
+String
+citadel
+the provider of Pilot DNS certificate.
+
+
 PILOT_DEBOUNCE_AFTER
 Time Duration
 100ms
@@ -4276,6 +4781,12 @@ These environment variables affect the behavior of the istioctl com
 If enabled, Pilot will include EDS pushes in the push debouncing, configured by PILOT_DEBOUNCE_AFTER and PILOT_DEBOUNCE_MAX. EDS pushes may be delayed, but there will be fewer pushes. By default this is enabled
 
 
+PILOT_ENABLE_EDS_FOR_HEADLESS_SERVICES
+Boolean
+false
+If enabled, for headless service in Kubernetes, pilot will send endpoints over EDS, allowing the sidecar to load balance among pods in the headless service. This feature should be enabled if applications access all services explicitly via a HTTP proxy port in the sidecar.
+
+
 PILOT_ENABLE_FALLTHROUGH_ROUTE
 Boolean
 true
@@ -4312,10 +4823,16 @@ These environment variables affect the behavior of the istioctl com
 EnableRedisFilter enables injection of `envoy.filters.network.redis_proxy` in the filter chain.
 
 
-PILOT_ENABLE_UNSAFE_REGEX
+PILOT_ENABLE_TCP_METADATA_EXCHANGE
+Boolean
+true
+If enabled, metadata exchange will be enabled for TCP using ALPN and Network Metadata Exchange filters in Envoy
+
+
+PILOT_FILTER_GATEWAY_CLUSTER_CONFIG
 Boolean
 false
-If enabled, pilot will generate Envoy configuration that does not use safe_regex but the older, deprecated regex field. This should only be enabled to support legacy deployments that have not yet been migrated to the new safe regular expressions.
+
 
 
 PILOT_HTTP10
@@ -4384,6 +4901,12 @@ These environment variables affect the behavior of the istioctl com
 Sets the mesh-wide trace sampling percentage. Should be 0.0 - 100.0. Precision to 0.01. Default is 100, not recommended for production use.
 
 
+PILOT_USE_ENDPOINT_SLICE
+Boolean
+false
+If enabled, Pilot will use EndpointSlices as the source of endpoints for Kubernetes services. By default, this is false, and Endpoints will be used. This requires the Kubernetes EndpointSlice controller to be enabled. Currently this is mutual exclusive - either Endpoints or EndpointSlices will be used
+
+
 POD_NAME
 String
 
@@ -4493,8 +5016,10 @@ These environment variables affect the behavior of the istioctl com
 pilot_no_ipLastValuePods not found in the endpoint table, possibly invalid.
 pilot_proxy_convergence_timeDistributionDelay in seconds between config change and a proxy receiving all required configuration.
 pilot_proxy_queue_timeDistributionTime in seconds, a proxy is in the push queue before being dequeued.
+pilot_push_triggersSumTotal number of times a push was triggered, labeled by reason for the push.
 pilot_rds_expired_nonceSumTotal number of RDS messages with an expired nonce.
 pilot_servicesLastValueTotal services known to pilot.
+pilot_total_k8s_object_errorsSumTotal Errors converting k8s CRDs
 pilot_total_rejected_configsSumTotal number of configs that Pilot had to reject or ignore.
 pilot_total_xds_internal_errorsSumTotal number of internal XDS errors in pilot.
 pilot_total_xds_rejectsSumTotal number of XDS responses from pilot rejected by proxy.
diff --git a/content/en/docs/reference/commands/mixs/index.html b/content/en/docs/reference/commands/mixs/index.html
index 9abb403425..67262f0a97 100644
--- a/content/en/docs/reference/commands/mixs/index.html
+++ b/content/en/docs/reference/commands/mixs/index.html
@@ -32,11 +32,11 @@ nexus for policy evaluation and telemetry reporting.

 
 
 --log_caller <string>
-Comma-separated list of scopes for which to include caller information, scopes can be any of [adapters, all, api, attributes, default, grpcAdapter, loadshedding, mcp]  (default ``)
+Comma-separated list of scopes for which to include caller information, scopes can be any of [adapters, all, api, attributes, default, grpcAdapter, loadshedding, mcp, validation]  (default ``)
 
 
 --log_output_level <string>
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [adapters, all, api, attributes, default, grpcAdapter, loadshedding, mcp] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [adapters, all, api, attributes, default, grpcAdapter, loadshedding, mcp, validation] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
 
 
 --log_rotate <string>
@@ -56,7 +56,7 @@ nexus for policy evaluation and telemetry reporting.

 
 
 --log_stacktrace_level <string>
-Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [adapters, all, api, attributes, default, grpcAdapter, loadshedding, mcp] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
+Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [adapters, all, api, attributes, default, grpcAdapter, loadshedding, mcp, validation] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
 
 
 --log_target <stringArray>
@@ -184,12 +184,12 @@ nexus for policy evaluation and telemetry reporting.

 
 --log_caller <string>
 
-Comma-separated list of scopes for which to include caller information, scopes can be any of [adapters, all, api, attributes, default, grpcAdapter, loadshedding, mcp]  (default ``)
+Comma-separated list of scopes for which to include caller information, scopes can be any of [adapters, all, api, attributes, default, grpcAdapter, loadshedding, mcp, validation]  (default ``)
 
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [adapters, all, api, attributes, default, grpcAdapter, loadshedding, mcp] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [adapters, all, api, attributes, default, grpcAdapter, loadshedding, mcp, validation] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
 
 
 --log_rotate <string>
@@ -214,7 +214,7 @@ nexus for policy evaluation and telemetry reporting.

 
 --log_stacktrace_level <string>
 
-Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [adapters, all, api, attributes, default, grpcAdapter, loadshedding, mcp] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
+Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [adapters, all, api, attributes, default, grpcAdapter, loadshedding, mcp, validation] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
 
 
 --log_target <stringArray>
diff --git a/content/en/docs/reference/commands/operator/index.html b/content/en/docs/reference/commands/operator/index.html
index f258ff15f7..0bc52e2926 100644
--- a/content/en/docs/reference/commands/operator/index.html
+++ b/content/en/docs/reference/commands/operator/index.html
@@ -41,7 +41,7 @@ remove_toc_prefix: 'operator '
 
 
 --base-chart-path <string>
-The absolute path to a directory containing nested charts, e.g. /etc/istio-operator/helm.  This will be used as the base path for any IstioControlPlane instances specifying a relative ChartPath.  (default ``)
+The absolute path to a directory containing nested charts, e.g. /etc/istio-operator/helm.  This will be used as the base path for any IstioOperator instances specifying a relative ChartPath.  (default ``)
 
 
 --ctrlz_address <string>
@@ -53,7 +53,7 @@ remove_toc_prefix: 'operator '
 
 
 --default-chart-path <string>
-A path relative to base-chart-path containing charts to be used when no ChartPath is specified by an IstioControlPlane resource, e.g. 1.1.0/istio  (default ``)
+A path relative to base-chart-path containing charts to be used when no ChartPath is specified by an IstioOperator resource, e.g. 1.1.0/istio  (default ``)
 
 
 --kubeconfig <string>
diff --git a/content/en/docs/reference/commands/pilot-agent/index.html b/content/en/docs/reference/commands/pilot-agent/index.html
index e07f6605c1..92eb3193bc 100644
--- a/content/en/docs/reference/commands/pilot-agent/index.html
+++ b/content/en/docs/reference/commands/pilot-agent/index.html
@@ -23,11 +23,11 @@ remove_toc_prefix: 'pilot-agent '
 
 
 --log_caller <string>
-Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cacheLog, citadelClientLog, configMapController, default, googleCAClientLog, model, rbac, sdsServiceLog, secretFetcherLog, stsClientLog, validation, vaultClientLog]  (default ``)
+Comma-separated list of scopes for which to include caller information, scopes can be any of [all, authn, cache, citadelclient, configmapcontroller, default, googleca, model, rbac, sds, secretfetcher, stsclient, stsserver, token, validation, vault]  (default ``)
 
 
 --log_output_level <string>
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, cacheLog, citadelClientLog, configMapController, default, googleCAClientLog, model, rbac, sdsServiceLog, secretFetcherLog, stsClientLog, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, authn, cache, citadelclient, configmapcontroller, default, googleca, model, rbac, sds, secretfetcher, stsclient, stsserver, token, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
 
 
 --log_rotate <string>
@@ -47,7 +47,7 @@ remove_toc_prefix: 'pilot-agent '
 
 
 --log_stacktrace_level <string>
-Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, cacheLog, citadelClientLog, configMapController, default, googleCAClientLog, model, rbac, sdsServiceLog, secretFetcherLog, stsClientLog, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
+Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, authn, cache, citadelclient, configmapcontroller, default, googleca, model, rbac, sds, secretfetcher, stsclient, stsserver, token, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
 
 
 --log_target <stringArray>
@@ -157,11 +157,11 @@ remove_toc_prefix: 'pilot-agent '
 
 
 --log_caller <string>
-Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cacheLog, citadelClientLog, configMapController, default, googleCAClientLog, model, rbac, sdsServiceLog, secretFetcherLog, stsClientLog, validation, vaultClientLog]  (default ``)
+Comma-separated list of scopes for which to include caller information, scopes can be any of [all, authn, cache, citadelclient, configmapcontroller, default, googleca, model, rbac, sds, secretfetcher, stsclient, stsserver, token, validation, vault]  (default ``)
 
 
 --log_output_level <string>
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, cacheLog, citadelClientLog, configMapController, default, googleCAClientLog, model, rbac, sdsServiceLog, secretFetcherLog, stsClientLog, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, authn, cache, citadelclient, configmapcontroller, default, googleca, model, rbac, sds, secretfetcher, stsclient, stsserver, token, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
 
 
 --log_rotate <string>
@@ -181,7 +181,7 @@ remove_toc_prefix: 'pilot-agent '
 
 
 --log_stacktrace_level <string>
-Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, cacheLog, citadelClientLog, configMapController, default, googleCAClientLog, model, rbac, sdsServiceLog, secretFetcherLog, stsClientLog, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
+Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, authn, cache, citadelclient, configmapcontroller, default, googleca, model, rbac, sds, secretfetcher, stsclient, stsserver, token, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
 
 
 --log_target <stringArray>
@@ -221,7 +221,7 @@ remove_toc_prefix: 'pilot-agent '
 
 
 --serviceregistry <string>
-Select the platform for service registry, options are {Kubernetes, Consul, MCP, Mock}  (default `Kubernetes`)
+Select the platform for service registry, options are {Kubernetes, Consul, Mock}  (default `Kubernetes`)
 
 
 --statsdUdpAddress <string>
@@ -232,10 +232,18 @@ remove_toc_prefix: 'pilot-agent '
 HTTP Port on which to serve pilot agent status. If zero, agent status will not be provided.  (default `0`)
 
 
+--stsPort <int>
+HTTP Port on which to serve Security Token Service (STS). If zero, STS service will not be provided.  (default `0`)
+
+
 --templateFile <string>
 Go template bootstrap config  (default ``)
 
 
+--tokenManagerPlugin <string>
+Token provider specific plugin name.  (default ``)
+
+
 --trust-domain <string>
 The domain to use for identities  (default ``)
 
@@ -263,11 +271,11 @@ remove_toc_prefix: 'pilot-agent '
 
 
 --log_caller <string>
-Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cacheLog, citadelClientLog, configMapController, default, googleCAClientLog, model, rbac, sdsServiceLog, secretFetcherLog, stsClientLog, validation, vaultClientLog]  (default ``)
+Comma-separated list of scopes for which to include caller information, scopes can be any of [all, authn, cache, citadelclient, configmapcontroller, default, googleca, model, rbac, sds, secretfetcher, stsclient, stsserver, token, validation, vault]  (default ``)
 
 
 --log_output_level <string>
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, cacheLog, citadelClientLog, configMapController, default, googleCAClientLog, model, rbac, sdsServiceLog, secretFetcherLog, stsClientLog, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, authn, cache, citadelclient, configmapcontroller, default, googleca, model, rbac, sds, secretfetcher, stsclient, stsserver, token, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
 
 
 --log_rotate <string>
@@ -287,7 +295,7 @@ remove_toc_prefix: 'pilot-agent '
 
 
 --log_stacktrace_level <string>
-Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, cacheLog, citadelClientLog, configMapController, default, googleCAClientLog, model, rbac, sdsServiceLog, secretFetcherLog, stsClientLog, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
+Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, authn, cache, citadelclient, configmapcontroller, default, googleca, model, rbac, sds, secretfetcher, stsclient, stsserver, token, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
 
 
 --log_target <stringArray>
@@ -316,12 +324,12 @@ remove_toc_prefix: 'pilot-agent '
 
 --log_caller <string>
 
-Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cacheLog, citadelClientLog, configMapController, default, googleCAClientLog, model, rbac, sdsServiceLog, secretFetcherLog, stsClientLog, validation, vaultClientLog]  (default ``)
+Comma-separated list of scopes for which to include caller information, scopes can be any of [all, authn, cache, citadelclient, configmapcontroller, default, googleca, model, rbac, sds, secretfetcher, stsclient, stsserver, token, validation, vault]  (default ``)
 
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, cacheLog, citadelClientLog, configMapController, default, googleCAClientLog, model, rbac, sdsServiceLog, secretFetcherLog, stsClientLog, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [all, authn, cache, citadelclient, configmapcontroller, default, googleca, model, rbac, sds, secretfetcher, stsclient, stsserver, token, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
 
 
 --log_rotate <string>
@@ -346,7 +354,7 @@ remove_toc_prefix: 'pilot-agent '
 
 --log_stacktrace_level <string>
 
-Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, cacheLog, citadelClientLog, configMapController, default, googleCAClientLog, model, rbac, sdsServiceLog, secretFetcherLog, stsClientLog, validation, vaultClientLog] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
+Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, authn, cache, citadelclient, configmapcontroller, default, googleca, model, rbac, sds, secretfetcher, stsclient, stsserver, token, validation, vault] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
 
 
 --log_target <stringArray>
@@ -416,7 +424,7 @@ These environment variables affect the behavior of the pilot-agent
 
 INITIAL_BACKOFF_MSEC
 Integer
-10
+2000
 
 
 
@@ -450,6 +458,12 @@ These environment variables affect the behavior of the pilot-agent
 
 
 
+ISTIO_GPRC_MAXRECVMSGSIZE
+Integer
+4194304
+Sets the max receive buffer size of gRPC stream in bytes.
+
+
 ISTIO_GPRC_MAXSTREAMS
 Integer
 100000
@@ -504,6 +518,12 @@ These environment variables affect the behavior of the pilot-agent
 
 
 
+JWT_POLICY
+String
+third-party-jwt
+The JWT validation policy.
+
+
 NAMESPACE
 String
 istio-system
@@ -522,6 +542,12 @@ These environment variables affect the behavior of the pilot-agent
 
 
 
+PILOT_CERT_PROVIDER
+String
+citadel
+the provider of Pilot DNS certificate.
+
+
 PILOT_DEBOUNCE_AFTER
 Time Duration
 100ms
@@ -570,6 +596,12 @@ These environment variables affect the behavior of the pilot-agent
 If enabled, Pilot will include EDS pushes in the push debouncing, configured by PILOT_DEBOUNCE_AFTER and PILOT_DEBOUNCE_MAX. EDS pushes may be delayed, but there will be fewer pushes. By default this is enabled
 
 
+PILOT_ENABLE_EDS_FOR_HEADLESS_SERVICES
+Boolean
+false
+If enabled, for headless service in Kubernetes, pilot will send endpoints over EDS, allowing the sidecar to load balance among pods in the headless service. This feature should be enabled if applications access all services explicitly via a HTTP proxy port in the sidecar.
+
+
 PILOT_ENABLE_FALLTHROUGH_ROUTE
 Boolean
 true
@@ -606,10 +638,16 @@ These environment variables affect the behavior of the pilot-agent
 EnableRedisFilter enables injection of `envoy.filters.network.redis_proxy` in the filter chain.
 
 
-PILOT_ENABLE_UNSAFE_REGEX
+PILOT_ENABLE_TCP_METADATA_EXCHANGE
+Boolean
+true
+If enabled, metadata exchange will be enabled for TCP using ALPN and Network Metadata Exchange filters in Envoy
+
+
+PILOT_FILTER_GATEWAY_CLUSTER_CONFIG
 Boolean
 false
-If enabled, pilot will generate Envoy configuration that does not use safe_regex but the older, deprecated regex field. This should only be enabled to support legacy deployments that have not yet been migrated to the new safe regular expressions.
+
 
 
 PILOT_HTTP10
@@ -678,6 +716,18 @@ These environment variables affect the behavior of the pilot-agent
 Sets the mesh-wide trace sampling percentage. Should be 0.0 - 100.0. Precision to 0.01. Default is 100, not recommended for production use.
 
 
+PILOT_USE_ENDPOINT_SLICE
+Boolean
+false
+If enabled, Pilot will use EndpointSlices as the source of endpoints for Kubernetes services. By default, this is false, and Endpoints will be used. This requires the Kubernetes EndpointSlice controller to be enabled. Currently this is mutual exclusive - either Endpoints or EndpointSlices will be used
+
+
+PKCS8_KEY
+Boolean
+false
+Whether to generate PKCS#8 private keys
+
+
 PLUGINS
 String
 
@@ -710,7 +760,7 @@ These environment variables affect the behavior of the pilot-agent
 
 SECRET_GRACE_DURATION
 Time Duration
-1h0m0s
+12h0m0s
 
 
 
diff --git a/content/en/docs/reference/commands/pilot-discovery/index.html b/content/en/docs/reference/commands/pilot-discovery/index.html
index 0c6ab60d44..ff39a5ba80 100644
--- a/content/en/docs/reference/commands/pilot-discovery/index.html
+++ b/content/en/docs/reference/commands/pilot-discovery/index.html
@@ -43,11 +43,11 @@ remove_toc_prefix: 'pilot-discovery '
 
 
 --log_caller <string>
-Comma-separated list of scopes for which to include caller information, scopes can be any of [ads, all, analysis, attributes, authn, caSecretController, configMapController, conversions, default, grpcAdapter, k8sController, kube, kube-converter, mcp, meshconfig, model, pkiCaLog, processing, rbac, resource, rootCertRotator, runtime, server, serverCaLog, source, validation]  (default ``)
+Comma-separated list of scopes for which to include caller information, scopes can be any of [ads, all, attributes, authn, configmapcontroller, default, grpcAdapter, mcp, model, pkica, rbac, rootcertrotator, secretcontroller, serverca, validation, validationController, validationServer]  (default ``)
 
 
 --log_output_level <string>
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, caSecretController, configMapController, conversions, default, grpcAdapter, k8sController, kube, kube-converter, mcp, meshconfig, model, pkiCaLog, processing, rbac, resource, rootCertRotator, runtime, server, serverCaLog, source, validation] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, attributes, authn, configmapcontroller, default, grpcAdapter, mcp, model, pkica, rbac, rootcertrotator, secretcontroller, serverca, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
 
 
 --log_rotate <string>
@@ -67,7 +67,7 @@ remove_toc_prefix: 'pilot-discovery '
 
 
 --log_stacktrace_level <string>
-Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [ads, all, analysis, attributes, authn, caSecretController, configMapController, conversions, default, grpcAdapter, k8sController, kube, kube-converter, mcp, meshconfig, model, pkiCaLog, processing, rbac, resource, rootCertRotator, runtime, server, serverCaLog, source, validation] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
+Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [ads, all, attributes, authn, configmapcontroller, default, grpcAdapter, mcp, model, pkica, rbac, rootcertrotator, secretcontroller, serverca, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
 
 
 --log_target <stringArray>
@@ -119,11 +119,6 @@ remove_toc_prefix: 'pilot-discovery '
 The IP port to use for the ControlZ introspection facility  (default `9876`)
 
 
---disable-install-crds
-
-Disable discovery service from verifying the existence of CRDs at startup and then installing if not detected.  It is recommended to be disable for highly available setups. 
-
-
 --domain <string>
 
 DNS domain suffix  (default `cluster.local`)
@@ -139,6 +134,11 @@ remove_toc_prefix: 'pilot-discovery '
 Discovery service HTTP address  (default `:8080`)
 
 
+--httpsAddr <string>
+
+Injection and validation service HTTPS address  (default `:15017`)
+
+
 --keepaliveInterval <duration>
 
 The time interval if no activity on the connection it pings the peer to see if the transport is alive  (default `30s`)
@@ -166,12 +166,12 @@ remove_toc_prefix: 'pilot-discovery '
 
 --log_caller <string>
 
-Comma-separated list of scopes for which to include caller information, scopes can be any of [ads, all, analysis, attributes, authn, caSecretController, configMapController, conversions, default, grpcAdapter, k8sController, kube, kube-converter, mcp, meshconfig, model, pkiCaLog, processing, rbac, resource, rootCertRotator, runtime, server, serverCaLog, source, validation]  (default ``)
+Comma-separated list of scopes for which to include caller information, scopes can be any of [ads, all, attributes, authn, configmapcontroller, default, grpcAdapter, mcp, model, pkica, rbac, rootcertrotator, secretcontroller, serverca, validation, validationController, validationServer]  (default ``)
 
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, caSecretController, configMapController, conversions, default, grpcAdapter, k8sController, kube, kube-converter, mcp, meshconfig, model, pkiCaLog, processing, rbac, resource, rootCertRotator, runtime, server, serverCaLog, source, validation] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, attributes, authn, configmapcontroller, default, grpcAdapter, mcp, model, pkica, rbac, rootcertrotator, secretcontroller, serverca, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
 
 
 --log_rotate <string>
@@ -196,7 +196,7 @@ remove_toc_prefix: 'pilot-discovery '
 
 --log_stacktrace_level <string>
 
-Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [ads, all, analysis, attributes, authn, caSecretController, configMapController, conversions, default, grpcAdapter, k8sController, kube, kube-converter, mcp, meshconfig, model, pkiCaLog, processing, rbac, resource, rootCertRotator, runtime, server, serverCaLog, source, validation] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
+Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [ads, all, attributes, authn, configmapcontroller, default, grpcAdapter, mcp, model, pkica, rbac, rootcertrotator, secretcontroller, serverca, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
 
 
 --log_target <stringArray>
@@ -251,7 +251,7 @@ remove_toc_prefix: 'pilot-discovery '
 
 --registries <stringSlice>
 
-Comma separated list of platform service registries to read from (choose one or more from {Kubernetes, Consul, MCP, Mock})  (default `[Kubernetes]`)
+Comma separated list of platform service registries to read from (choose one or more from {Kubernetes, Consul, Mock})  (default `[Kubernetes]`)
 
 
 --resync <duration>
@@ -308,11 +308,11 @@ remove_toc_prefix: 'pilot-discovery '
 
 
 --log_caller <string>
-Comma-separated list of scopes for which to include caller information, scopes can be any of [ads, all, analysis, attributes, authn, caSecretController, configMapController, conversions, default, grpcAdapter, k8sController, kube, kube-converter, mcp, meshconfig, model, pkiCaLog, processing, rbac, resource, rootCertRotator, runtime, server, serverCaLog, source, validation]  (default ``)
+Comma-separated list of scopes for which to include caller information, scopes can be any of [ads, all, attributes, authn, configmapcontroller, default, grpcAdapter, mcp, model, pkica, rbac, rootcertrotator, secretcontroller, serverca, validation, validationController, validationServer]  (default ``)
 
 
 --log_output_level <string>
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, caSecretController, configMapController, conversions, default, grpcAdapter, k8sController, kube, kube-converter, mcp, meshconfig, model, pkiCaLog, processing, rbac, resource, rootCertRotator, runtime, server, serverCaLog, source, validation] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, attributes, authn, configmapcontroller, default, grpcAdapter, mcp, model, pkica, rbac, rootcertrotator, secretcontroller, serverca, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
 
 
 --log_rotate <string>
@@ -332,7 +332,7 @@ remove_toc_prefix: 'pilot-discovery '
 
 
 --log_stacktrace_level <string>
-Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [ads, all, analysis, attributes, authn, caSecretController, configMapController, conversions, default, grpcAdapter, k8sController, kube, kube-converter, mcp, meshconfig, model, pkiCaLog, processing, rbac, resource, rootCertRotator, runtime, server, serverCaLog, source, validation] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
+Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [ads, all, attributes, authn, configmapcontroller, default, grpcAdapter, mcp, model, pkica, rbac, rootcertrotator, secretcontroller, serverca, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
 
 
 --log_target <stringArray>
@@ -386,12 +386,12 @@ remove_toc_prefix: 'pilot-discovery '
 
 --log_caller <string>
 
-Comma-separated list of scopes for which to include caller information, scopes can be any of [ads, all, analysis, attributes, authn, caSecretController, configMapController, conversions, default, grpcAdapter, k8sController, kube, kube-converter, mcp, meshconfig, model, pkiCaLog, processing, rbac, resource, rootCertRotator, runtime, server, serverCaLog, source, validation]  (default ``)
+Comma-separated list of scopes for which to include caller information, scopes can be any of [ads, all, attributes, authn, configmapcontroller, default, grpcAdapter, mcp, model, pkica, rbac, rootcertrotator, secretcontroller, serverca, validation, validationController, validationServer]  (default ``)
 
 
 --log_output_level <string>
 
-Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, analysis, attributes, authn, caSecretController, configMapController, conversions, default, grpcAdapter, k8sController, kube, kube-converter, mcp, meshconfig, model, pkiCaLog, processing, rbac, resource, rootCertRotator, runtime, server, serverCaLog, source, validation] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
+Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,... where scope can be one of [ads, all, attributes, authn, configmapcontroller, default, grpcAdapter, mcp, model, pkica, rbac, rootcertrotator, secretcontroller, serverca, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)
 
 
 --log_rotate <string>
@@ -416,7 +416,7 @@ remove_toc_prefix: 'pilot-discovery '
 
 --log_stacktrace_level <string>
 
-Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [ads, all, analysis, attributes, authn, caSecretController, configMapController, conversions, default, grpcAdapter, k8sController, kube, kube-converter, mcp, meshconfig, model, pkiCaLog, processing, rbac, resource, rootCertRotator, runtime, server, serverCaLog, source, validation] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
+Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [ads, all, attributes, authn, configmapcontroller, default, grpcAdapter, mcp, model, pkica, rbac, rootcertrotator, secretcontroller, serverca, validation, validationController, validationServer] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)
 
 
 --log_target <stringArray>
@@ -454,18 +454,6 @@ These environment variables affect the behavior of the pilot-discoveryExpected audience in the tokens. 
 
 
-AUTHZ_FAILURE_LOG_BURST_SIZE
-Integer
-1
-
-
-
-AUTHZ_FAILURE_LOG_FREQ
-Time Duration
-1m0s
-
-
-
 BYPASS_OOP_MTLS_SAN_VERIFICATION
 Boolean
 false
@@ -496,12 +484,30 @@ These environment variables affect the behavior of the pilot-discoveryGrace period percentile for self-signed root cert.
 
 
+DEFER_VALIDATION_TO_DEPLOYMENT
+String
+
+When set, the controller defers reconciling the validatingwebhookconfiguration to the named deployment.
+
+
+INJECTION_WEBHOOK_CONFIG_NAME
+String
+istio-sidecar-injector
+Name of the mutatingwebhookconfiguration to patch, if istioctl is not used.
+
+
 ISTIOD_ADDR
 String
 
 Service name of istiod. If empty the istiod listener, certs will be disabled.
 
 
+ISTIO_GPRC_MAXRECVMSGSIZE
+Integer
+4194304
+Sets the max receive buffer size of gRPC stream in bytes.
+
+
 ISTIO_GPRC_MAXSTREAMS
 Integer
 100000
@@ -514,6 +520,12 @@ These environment variables affect the behavior of the pilot-discoverySelects the attribute expression language runtime for Mixer.
 
 
+JWT_POLICY
+String
+third-party-jwt
+The JWT validation policy.
+
+
 K8S_INGRESS_NS
 String
 
@@ -544,6 +556,12 @@ These environment variables affect the behavior of the pilot-discovery
 
 
+PILOT_CERT_PROVIDER
+String
+citadel
+the provider of Pilot DNS certificate.
+
+
 PILOT_DEBOUNCE_AFTER
 Time Duration
 100ms
@@ -592,6 +610,12 @@ These environment variables affect the behavior of the pilot-discoveryIf enabled, Pilot will include EDS pushes in the push debouncing, configured by PILOT_DEBOUNCE_AFTER and PILOT_DEBOUNCE_MAX. EDS pushes may be delayed, but there will be fewer pushes. By default this is enabled
 
 
+PILOT_ENABLE_EDS_FOR_HEADLESS_SERVICES
+Boolean
+false
+If enabled, for headless service in Kubernetes, pilot will send endpoints over EDS, allowing the sidecar to load balance among pods in the headless service. This feature should be enabled if applications access all services explicitly via a HTTP proxy port in the sidecar.
+
+
 PILOT_ENABLE_FALLTHROUGH_ROUTE
 Boolean
 true
@@ -628,10 +652,16 @@ These environment variables affect the behavior of the pilot-discoveryEnableRedisFilter enables injection of `envoy.filters.network.redis_proxy` in the filter chain.
 
 
-PILOT_ENABLE_UNSAFE_REGEX
+PILOT_ENABLE_TCP_METADATA_EXCHANGE
+Boolean
+true
+If enabled, metadata exchange will be enabled for TCP using ALPN and Network Metadata Exchange filters in Envoy
+
+
+PILOT_FILTER_GATEWAY_CLUSTER_CONFIG
 Boolean
 false
-If enabled, pilot will generate Envoy configuration that does not use safe_regex but the older, deprecated regex field. This should only be enabled to support legacy deployments that have not yet been migrated to the new safe regular expressions.
+
 
 
 PILOT_HTTP10
@@ -700,6 +730,12 @@ These environment variables affect the behavior of the pilot-discoverySets the mesh-wide trace sampling percentage. Should be 0.0 - 100.0. Precision to 0.01. Default is 100, not recommended for production use.
 
 
+PILOT_USE_ENDPOINT_SLICE
+Boolean
+false
+If enabled, Pilot will use EndpointSlices as the source of endpoints for Kubernetes services. By default, this is false, and Endpoints will be used. This requires the Kubernetes EndpointSlice controller to be enabled. Currently this is mutual exclusive - either Endpoints or EndpointSlices will be used
+
+
 POD_NAME
 String
 
@@ -736,10 +772,10 @@ These environment variables affect the behavior of the pilot-discoveryUse the Istio JWT filter for JWT token verification.
 
 
-WEBHOOK
+VALIDATION_WEBHOOK_CONFIG_NAME
 String
-
-Name of webhook config to patch, if istioctl is not used.
+istiod-${namespace}
+Name of validatingwegbhookconfiguration to patch, if istioctl is not used.
 
 
 WORKLOAD_CERT_TTL
@@ -768,22 +804,9 @@ These environment variables affect the behavior of the pilot-discoverycitadel_server_root_cert_expiry_timestampLastValueThe unix timestamp, in seconds, when Citadel root cert will expire. We set it to negative in case of internal error.
 citadel_server_success_cert_issuance_countSumThe number of certificates issuances that have succeeded.
 endpoint_no_podLastValueEndpoints without an associated pod.
-galley_runtime_processor_event_span_duration_millisecondsDistributionThe duration between each incoming event
-galley_runtime_processor_events_processed_totalCountThe number of events that have been processed
-galley_runtime_processor_snapshot_events_totalDistributionThe number of events per snapshot
-galley_runtime_processor_snapshot_lifetime_duration_millisecondsDistributionThe duration of each snapshot
-galley_runtime_processor_snapshots_published_totalCountThe number of snapshots that have been published
-galley_runtime_state_type_instances_totalLastValueThe number of type instances per type URL
-galley_runtime_strategy_on_change_totalCountThe number of times the strategy's onChange has been called
-galley_runtime_strategy_timer_max_time_reached_totalCountThe number of times the max time has been reached
-galley_runtime_strategy_timer_quiesce_reached_totalCountThe number of times a quiesce has been reached
-galley_runtime_strategy_timer_resets_totalCountThe number of times the timer has been reset
-galley_source_kube_dynamic_converter_failure_totalCountThe number of times a dynamnic kubernetes source failed converting a resources
-galley_source_kube_dynamic_converter_success_totalCountThe number of times a dynamic kubernetes source successfully converted a resource
-galley_source_kube_event_error_totalCountThe number of times a kubernetes source encountered errored while handling an event
-galley_source_kube_event_success_totalCountThe number of times a kubernetes source successfully handled an event
 galley_validation_cert_key_update_errorsCountGalley validation webhook certificate updates errors
 galley_validation_cert_key_updatesCountGalley validation webhook certificate updates
+galley_validation_config_delete_errorCountk8s webhook configuration delete error
 galley_validation_config_loadCountk8s webhook configuration (re)loads
 galley_validation_config_load_errorCountk8s webhook configuration (re)load error
 galley_validation_config_update_errorCountk8s webhook configuration update error
@@ -844,8 +867,10 @@ These environment variables affect the behavior of the pilot-discoverypilot_no_ipLastValuePods not found in the endpoint table, possibly invalid.
 pilot_proxy_convergence_timeDistributionDelay in seconds between config change and a proxy receiving all required configuration.
 pilot_proxy_queue_timeDistributionTime in seconds, a proxy is in the push queue before being dequeued.
+pilot_push_triggersSumTotal number of times a push was triggered, labeled by reason for the push.
 pilot_rds_expired_nonceSumTotal number of RDS messages with an expired nonce.
 pilot_servicesLastValueTotal services known to pilot.
+pilot_total_k8s_object_errorsSumTotal Errors converting k8s CRDs
 pilot_total_rejected_configsSumTotal number of configs that Pilot had to reject or ignore.
 pilot_total_xds_internal_errorsSumTotal number of internal XDS errors in pilot.
 pilot_total_xds_rejectsSumTotal number of XDS responses from pilot rejected by proxy.
diff --git a/content/en/docs/reference/commands/sidecar-injector/index.html b/content/en/docs/reference/commands/sidecar-injector/index.html
index ef587d62a5..02e65c463f 100644
--- a/content/en/docs/reference/commands/sidecar-injector/index.html
+++ b/content/en/docs/reference/commands/sidecar-injector/index.html
@@ -386,12 +386,24 @@ These environment variables affect the behavior of the sidecar-injectorService name of istiod. If empty the istiod listener, certs will be disabled.
 
 
+ISTIO_GPRC_MAXRECVMSGSIZE
+Integer
+4194304
+Sets the max receive buffer size of gRPC stream in bytes.
+
+
 ISTIO_GPRC_MAXSTREAMS
 Integer
 100000
 Sets the maximum number of concurrent grpc streams.
 
 
+JWT_POLICY
+String
+third-party-jwt
+The JWT validation policy.
+
+
 PILOT_BLOCK_HTTP_ON_443
 Boolean
 true
@@ -404,6 +416,12 @@ These environment variables affect the behavior of the sidecar-injector
 
 
+PILOT_CERT_PROVIDER
+String
+citadel
+the provider of Pilot DNS certificate.
+
+
 PILOT_DEBOUNCE_AFTER
 Time Duration
 100ms
@@ -452,6 +470,12 @@ These environment variables affect the behavior of the sidecar-injectorIf enabled, Pilot will include EDS pushes in the push debouncing, configured by PILOT_DEBOUNCE_AFTER and PILOT_DEBOUNCE_MAX. EDS pushes may be delayed, but there will be fewer pushes. By default this is enabled
 
 
+PILOT_ENABLE_EDS_FOR_HEADLESS_SERVICES
+Boolean
+false
+If enabled, for headless service in Kubernetes, pilot will send endpoints over EDS, allowing the sidecar to load balance among pods in the headless service. This feature should be enabled if applications access all services explicitly via a HTTP proxy port in the sidecar.
+
+
 PILOT_ENABLE_FALLTHROUGH_ROUTE
 Boolean
 true
@@ -488,10 +512,16 @@ These environment variables affect the behavior of the sidecar-injectorEnableRedisFilter enables injection of `envoy.filters.network.redis_proxy` in the filter chain.
 
 
-PILOT_ENABLE_UNSAFE_REGEX
+PILOT_ENABLE_TCP_METADATA_EXCHANGE
+Boolean
+true
+If enabled, metadata exchange will be enabled for TCP using ALPN and Network Metadata Exchange filters in Envoy
+
+
+PILOT_FILTER_GATEWAY_CLUSTER_CONFIG
 Boolean
 false
-If enabled, pilot will generate Envoy configuration that does not use safe_regex but the older, deprecated regex field. This should only be enabled to support legacy deployments that have not yet been migrated to the new safe regular expressions.
+
 
 
 PILOT_HTTP10
@@ -560,6 +590,12 @@ These environment variables affect the behavior of the sidecar-injectorSets the mesh-wide trace sampling percentage. Should be 0.0 - 100.0. Precision to 0.01. Default is 100, not recommended for production use.
 
 
+PILOT_USE_ENDPOINT_SLICE
+Boolean
+false
+If enabled, Pilot will use EndpointSlices as the source of endpoints for Kubernetes services. By default, this is false, and Endpoints will be used. This requires the Kubernetes EndpointSlice controller to be enabled. Currently this is mutual exclusive - either Endpoints or EndpointSlices will be used
+
+
 TERMINATION_DRAIN_DURATION_SECONDS
 Integer
 5
diff --git a/content/en/docs/reference/config/annotations/index.html b/content/en/docs/reference/config/annotations/index.html
index 3261ed4415..8a25272011 100644
--- a/content/en/docs/reference/config/annotations/index.html
+++ b/content/en/docs/reference/config/annotations/index.html
@@ -29,6 +29,16 @@ Istio supports to control its behavior.
 		
 			
 				
+					
+				
+					galley.istio.io/analyze-suppress
+					[Any]
+					A comma separated list of configuration analysis message codes to suppress when Istio analyzers are run. For example, to suppress reporting of IST0103 (PodMissingProxy) and IST0108 (UnknownAnnotation) on a resource, apply the annotation 'galley.istio.io/analyze-suppress=IST0108,IST0103'. If the value is '*', then all configuration analysis messages are suppressed.
+				
+			
+		
+			
+				
 					
 				
 					install.operator.istio.io/chart-owner
@@ -217,6 +227,16 @@ Istio supports to control its behavior.
 		
 			
 				
+					
+				
+					sidecar.istio.io/enableCoreDump
+					[Pod]
+					Specifies whether or not an Envoy sidecar should enable core dump.
+				
+			
+		
+			
+				
 					
 				
 					sidecar.istio.io/inject
diff --git a/content/en/docs/reference/config/istio.mesh.v1alpha1/index.html b/content/en/docs/reference/config/istio.mesh.v1alpha1/index.html
index 237d61a711..3bce80dc6e 100644
--- a/content/en/docs/reference/config/istio.mesh.v1alpha1/index.html
+++ b/content/en/docs/reference/config/istio.mesh.v1alpha1/index.html
@@ -7,7 +7,7 @@ location: https://istio.io/docs/reference/config/istio.mesh.v1alpha1.html
 layout: protoc-gen-docs
 generator: protoc-gen-docs
 weight: 20
-number_of_entries: 73
+number_of_entries: 74
 ---
 
Configuration affecting the service mesh as a whole.

 
@@ -999,7 +999,7 @@ No
 
 
 values
-TypeMapStringInterface
+TypeMapStringInterface2
 
 
Overrides for default values.yaml. This is a validated pass-through to Helm templates.
 See the Helm installation options for schema details: https://istio.io/docs/reference/config/installation-options/.
@@ -1013,7 +1013,7 @@ No
 
 
 unvalidatedValues
-TypeMapStringInterface
+TypeMapStringInterface2
 
 
Unvalidated overrides for default values.yaml. Used for custom templates where new parameters are added.

 
@@ -4016,6 +4016,11 @@ No
 

 
GOTYPE: map[string]interface{}

 
+

+
TypeMapStringInterface2

+

+
GOTYPE: map[string]interface{}

+
 

 
WeightedPodAffinityTerm

 

diff --git a/content/en/docs/reference/config/istio.operator.v1alpha12.pb/index.html b/content/en/docs/reference/config/istio.operator.v1alpha12.pb/index.html
index b82a3ac3f5..1facf08302 100644
--- a/content/en/docs/reference/config/istio.operator.v1alpha12.pb/index.html
+++ b/content/en/docs/reference/config/istio.operator.v1alpha12.pb/index.html
@@ -1,6 +1,6 @@
 ---
-WARNING: THIS IS AN AUTO-GENERATED FILE, DO NOT EDIT. PLEASE MODIFY THE ORIGINAL SOURCE IN THE 'https://github.com/istio/operator' REPO
-source_repo: https://github.com/istio/operator
+WARNING: THIS IS AN AUTO-GENERATED FILE, DO NOT EDIT. PLEASE MODIFY THE ORIGINAL SOURCE IN THE 'https://github.com/istio/istio' REPO
+source_repo: https://github.com/istio/istio
 title: Installation Options (istioctl)
 description: Configuration options for Istio control plane installation using istioctl.
 location: https://istio.io/docs/reference/config/istio.operator.v1alpha12.pb.html
diff --git a/content/en/docs/reference/config/networking/destination-rule/index.html b/content/en/docs/reference/config/networking/destination-rule/index.html
index 2038f4ffc4..6dab512ff0 100644
--- a/content/en/docs/reference/config/networking/destination-rule/index.html
+++ b/content/en/docs/reference/config/networking/destination-rule/index.html
@@ -8,7 +8,7 @@ layout: protoc-gen-docs
 generator: protoc-gen-docs
 schema: istio.networking.v1alpha3.DestinationRule
 aliases: [/docs/reference/config/networking/v1alpha3/destination-rule]
-number_of_entries: 19
+number_of_entries: 20
 ---
 
DestinationRule defines policies that apply to traffic intended for a
 service after routing has occurred. These rules specify configuration
@@ -804,6 +804,18 @@ Explicitly specify the region traffic will land on when endpoints in local regio
 Should be used together with OutlierDetection to detect unhealthy endpoints.
 Note: if no OutlierDetection specified, this will not take effect.

 
+
+
+No
+
+
+
+enabled
+BoolValue
+
+
enable locality load balancing, this is DestinationRule-level and will override mesh wide settings in entirety.
+e.g. true means that turn on locality load balancing for this DestinationRule no matter what mesh wide settings is.

+
 
 
 No
@@ -952,15 +964,45 @@ spec:
 
 
 
-
-consecutiveErrors
-int32
+
+consecutiveGatewayErrors
+UInt32Value
 
-
Number of errors before a host is ejected from the connection
-pool. Defaults to 5. When the upstream host is accessed over HTTP, a
-502, 503, or 504 return code qualifies as an error. When the upstream host
-is accessed over an opaque TCP connection, connect timeouts and
-connection error/failure events qualify as an error.

+
Number of gateway errors before a host is ejected from the connection pool.
+When the upstream host is accessed over HTTP, a 502, 503, or 504 return
+code qualifies as a gateway error. When the upstream host is accessed over
+an opaque TCP connection, connect timeouts and connection error/failure
+events qualify as a gateway error.
+This feature is disabled by default or when set to the value 0.

+
+
Note that consecutivegatewayerrors and consecutive5xxerrors can be
+used separately or together. Because the errors counted by
+consecutivegatewayerrors are also included in consecutive5xxerrors,
+if the value of consecutivegatewayerrors is greater than or equal to
+the value of consecutive5xxerrors, consecutivegatewayerrors will have
+no effect.

+
+
+
+No
+
+
+
+consecutive5xxErrors
+UInt32Value
+
+
Number of 5xx errors before a host is ejected from the connection pool.
+When the upstream host is accessed over an opaque TCP connection, connect
+timeouts, connection error/failure and request failure events qualify as a
+5xx error.
+This feature defaults to 5 but can be disabled by setting the value to 0.

+
+
Note that consecutivegatewayerrors and consecutive5xxerrors can be
+used separately or together. Because the errors counted by
+consecutivegatewayerrors are also included in consecutive5xxerrors,
+if the value of consecutivegatewayerrors is greater than or equal to
+the value of consecutive5xxerrors, consecutivegatewayerrors will have
+no effect.

 
 
 
@@ -1455,3 +1497,33 @@ No
 
 
 

+
google.protobuf.UInt32Value

+

+
Wrapper message for uint32.

+
+
The JSON representation for UInt32Value is JSON number.

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
FieldTypeDescriptionRequired
valueuint32
+
The uint32 value.

+
+		
+No
+

+

diff --git a/content/en/docs/reference/config/networking/envoy-filter/index.html b/content/en/docs/reference/config/networking/envoy-filter/index.html
index b0586b168f..e4407ac5e0 100644
--- a/content/en/docs/reference/config/networking/envoy-filter/index.html
+++ b/content/en/docs/reference/config/networking/envoy-filter/index.html
@@ -1007,6 +1007,19 @@ after the selected filter or sub filter. If no filter is
 selected, the specified filter will be inserted at the end
 of the list.

 
+
+
+
+INSERT_FIRST
+
+
Insert operation on an array of named objects. This operation
+is typically useful only in the context of filters, where the
+order of filters matter. For clusters and virtual hosts,
+order of the element in the array does not matter. Insert
+first in the list based on the presence of selected filter or not.
+This is specifically useful when you want your filter first in the
+list based on a match condition specified in Match clause.

+
 
 
 
diff --git a/content/en/docs/reference/config/networking/virtual-service/index.html b/content/en/docs/reference/config/networking/virtual-service/index.html
index 130d9d9e42..bf3b896cb5 100644
--- a/content/en/docs/reference/config/networking/virtual-service/index.html
+++ b/content/en/docs/reference/config/networking/virtual-service/index.html
@@ -142,13 +142,13 @@ spec:
 
 
 
-
-allowOrigin
-string[]
+
+allowOrigins
+StringMatch[]
 
-
The list of origins that are allowed to perform CORS requests. The
-content will be serialized into the Access-Control-Allow-Origin
-header. Wildcard * will allow all origins.

+
String patterns that match allowed origins.
+An origin is allowed if any of the string matchers match.
+If a match is found, then the outgoing Access-Control-Allow-Origin would be set to the origin as provided by the client.

 
 
 
@@ -370,9 +370,9 @@ instead of “reviews.default.svc.cluster.local”), Istio will interpre
 the short name based on the namespace of the rule, not the service. A
 rule in the “default” namespace containing a host “reviews will be
 interpreted as “reviews.default.svc.cluster.local”, irrespective of
-the actual namespace associated with the reviews service. To avoid
-potential misconfigurations, it is recommended to always use fully
-qualified domain names over short names.

+the actual namespace associated with the reviews service. To avoid
+potential misconfiguration, it is recommended to always use fully
+qualified domain names over short names.

 
 
 
@@ -513,19 +513,6 @@ Yes
 
 
Percentage of requests to be aborted with the error code provided.

 
-
-
-No
-
-
-
-percent
-int32
-
-
Percentage of requests to be aborted with the error code provided (0-100).
-Use of integer percent value is deprecated. Use the double percentage
-field instead.

-
 
 
 No
@@ -795,9 +782,22 @@ No
 
 
One or more labels that constrain the applicability of a rule to
 workloads with the given labels. If the VirtualService has a list of
-gateways specified at the top, it must include the reserved gateway
+gateways specified in the top-level gateways field, it must include the reserved gateway
 mesh for this field to be applicable.

 
+
+
+No
+
+
+
+gateways
+string[]
+
+
Names of gateways where the rule should be applied. Gateway names
+in the top-level gateways field of the VirtualService (if any) are overridden. The gateway
+match is independent of sourceLabels.

+
 
 
 No
@@ -1352,54 +1352,6 @@ No
 
 
Header manipulation rules

 
-
-
-No
-
-
-
-removeResponseHeaders
-string[]
-
-
Use of remove_response_header is deprecated. Use the headers
-field instead.

-
-
-
-No
-
-
-
-appendResponseHeaders
-map<string, string>
-
-
Use of append_response_headers is deprecated. Use the headers
-field instead.

-
-
-
-No
-
-
-
-removeRequestHeaders
-string[]
-
-
Use of remove_request_headers is deprecated. Use the headers
-field instead.

-
-
-
-No
-
-
-
-appendRequestHeaders
-map<string, string>
-
-
Use of append_request_headers is deprecated. Use the headers
-field instead.

-
 
 
 No
@@ -1579,7 +1531,7 @@ No
 
 
One or more labels that constrain the applicability of a rule to
 workloads with the given labels. If the VirtualService has a list of
-gateways specified at the top, it should include the reserved gateway
+gateways specified in the top-level gateways field, it should include the reserved gateway
 mesh in order for this field to be applicable.

 
 
@@ -1591,8 +1543,8 @@ No
 gateways
 string[]
 
-
Names of gateways where the rule should be applied to. Gateway names
-at the top of the VirtualService (if any) are overridden. The gateway
+
Names of gateways where the rule should be applied. Gateway names
+in the top-level gateways field of the VirtualService (if any) are overridden. The gateway
 match is independent of sourceLabels.

 
 
@@ -1872,7 +1824,7 @@ No
 
 
One or more labels that constrain the applicability of a rule to
 workloads with the given labels. If the VirtualService has a list of
-gateways specified at the top, it should include the reserved gateway
+gateways specified in the top-level gateways field, it should include the reserved gateway
 mesh in order for this field to be applicable.

 
 
@@ -1884,8 +1836,8 @@ No
 gateways
 string[]
 
-
Names of gateways where the rule should be applied to. Gateway names
-at the top of the VirtualService (if any) are overridden. The gateway
+
Names of gateways where the rule should be applied. Gateway names
+in the top-level gateways field of the VirtualService (if any) are overridden. The gateway
 match is independent of sourceLabels.

 
 
diff --git a/content/en/docs/reference/config/security/authorization-policy/index.html b/content/en/docs/reference/config/security/authorization-policy/index.html
index ff94ebaae1..8a89f46cd8 100644
--- a/content/en/docs/reference/config/security/authorization-policy/index.html
+++ b/content/en/docs/reference/config/security/authorization-policy/index.html
@@ -9,22 +9,42 @@ generator: protoc-gen-docs
 schema: istio.security.v1beta1.AuthorizationPolicy
 weight: 20
 aliases: [/docs/reference/config/authorization/authorization-policy]
-number_of_entries: 7
+number_of_entries: 8
 ---
 
Istio Authorization Policy enables access control on workloads in the mesh.

 
-
For example, the following authorization policy applies to workloads matched with
-label selector “app: httpbin, version: v1”.

+
Authorization policy supports both allow and deny policies. When allow and
+deny policies are used for a workload at the same time, the deny policies are
+evaluated first. The evaluation is determined by the following rules:

 
-
It allows requests from:
-- service account “cluster.local/ns/default/sa/sleep” or
-- namespace “test”
-to access the workload with:
-- “GET” method at paths of prefix “/info” or,
-- “POST” method at path “/data”.
-when the request has a valid JWT token issued by “https://accounts.google.com”.

+
    
+
  1. If there are any DENY policies that match the request, deny the request.
    2. 
+
  2. If there are no ALLOW policies for the workload, allow the request.
    3. 
+
  3. If any of the ALLOW policies match the request, allow the request.
    4. 
+
  4. Deny the request.
    5. 
+

 
-
Any other requests will be rejected.

+
For example, the following authorization policy sets the action to “ALLOW”
+to create an allow policy. The default action is “ALLOW” but it is useful
+to be explicit in the policy.

+
+
It allows requests from:

+
+
    
+
  • service account “cluster.local/ns/default/sa/sleep” or
    • 
+
  • namespace “test”
    • 
+

+
+
to access the workload with:

+
+
    
+
  • “GET” method at paths of prefix “/info” or,
    • 
+
  • “POST” method at path “/data”.
    • 
+

+
+
when the request has a valid JWT token issued by “https://accounts.google.com”.

+
+
Any other requests will be denied.

 
 
apiVersion: security.istio.io/v1beta1
 kind: AuthorizationPolicy
@@ -32,10 +52,7 @@ metadata:
  name: httpbin
  namespace: foo
 spec:
- selector:
-   matchLabels:
-     app: httpbin
-     version: v1
+ action: ALLOW
  rules:
  - from:
    - source:
@@ -54,19 +71,34 @@ spec:
      values: ["https://accounts.google.com"]
 

 
-
Access control is enabled on a workload if there is any authorization policies selecting
-the workload. When access control is enabled, the default behavior is deny (deny-by-default)
-which means requests to the workload will be rejected if the request is not allowed by any of
-the authorization policies selecting the workload.

+
The following is another example that sets action to “DENY” to create a deny policy.
+It denies requests from the “dev” namespace to the “POST” method on all workloads
+in the “foo” namespace.

 
-
Currently AuthorizationPolicy only supports “ALLOW” action. This means that
-if multiple authorization policies apply to the same workload, the effect is additive.

+
apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+ name: httpbin
+ namespace: foo
+spec:
+ action: DENY
+ rules:
+ - from:
+   - source:
+       namespaces: ["dev"]
+   to:
+   - operation:
+       methods: ["POST"]
+

 
 
Authorization Policy scope (target) is determined by “metadata/namespace” and
-an optional “selector”.
-- “metadata/namespace” tells which namespace the policy applies. If set to root
-namespace, the policy applies to all namespaces in a mesh.
-- workload “selector” can be used to further restrict where a policy applies.

+an optional “selector”.

+
+
    
+
  • “metadata/namespace” tells which namespace the policy applies. If set to root
+namespace, the policy applies to all namespaces in a mesh.
    • 
+
  • workload “selector” can be used to further restrict where a policy applies.
    • 
+

 
 
For example,

 
@@ -92,6 +124,7 @@ metadata:
  name: policy
  namespace: foo
 spec:
+  {}
 

 
 
The following authorization policy applies to workloads containing label
@@ -122,6 +155,7 @@ metadata:
  name: deny-all
  namespace: foo
 spec:
+  {}
 

 
 
The following authorization policy allows all requests to workloads in namespace
@@ -164,13 +198,55 @@ No
 rules
 Rule[]
 
-
Optional. A list of rules to specify the allowed access to the workload.

+
Optional. A list of rules to match the request. A match occurs when at least
+one rule matches the request.

 
-
If not set, access is denied unless explicitly allowed by other authorization policy.

+
If not set, the match will never occur. This is equivalent to setting a
+default of deny for the target workloads.

 
 
 
 No
+
+
+
+action
+Action
+
+
Optional. The action to take if the request is matched with the rules.

+
+
+
+No
+
+
+
+
+
+
AuthorizationPolicy.Action

+

+
Action specifies the operation to take.

+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -195,7 +271,7 @@ No
 
+
+
+
+
+
+
@@ -218,7 +307,16 @@ Yes
 
Operation

-
Operation specifies the operations of a request.

+
Operation specifies the operations of a request. Fields in the operation are
+ANDed together.

+
+
For example, the following operation matches if the host has suffix “.example.com”
+and the method is “GET” or “HEAD” and the path doesn’t have prefix “/admin”.

+
+
hosts: ["*.example.com"]
+methods: ["GET", "HEAD"]
+not_paths: ["/admin*"]
+

 
 
NameDescription
ALLOW
+
Allow a request only if it matches the rules. This is the default type.

+
+
DENY
+
Deny a request if it matches any of the rules.

+
 		
 

 
string
 
 
The name of an Istio attribute.
-See the full list of supported attributes.

+See the full list of supported attributes.

 
 		
 
@@ -206,11 +282,24 @@ Yes
 values
 string[]
 
-
The allowed values for the attribute.

+
Optional. A list of allowed values for the attribute.
+Note: at least one of values or not_values must be set.

 
 		
 
-Yes
+No
+
notValuesstring[]
+
Optional. A list of negative match of values for the attribute.
+Note: at least one of values or not_values must be set.

+
+		
+No
 
 

 
 
 

@@ -238,6 +336,17 @@ Yes
 
 
If not set, any host is allowed. Must be used only with HTTP.

 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+

 

+No
+
notHostsstring[]
+
Optional. A list of negative match of hosts.

+
 		
 
 No
@@ -251,6 +360,17 @@ No
 
 
If not set, any port is allowed.

 
+		
+No
+
notPortsstring[]
+
Optional. A list of negative match of ports.

+
 		
 
 No
@@ -266,6 +386,17 @@ For gRPC service, this should be the fully-qualified name in the form of
 
 
If not set, any method is allowed. Must be used only with HTTP or gRPC.

 
+		
+No
+
notMethodsstring[]
+
Optional. A list of negative match of methods.

+
 		
 
 No
@@ -279,6 +410,17 @@ No
 
 
If not set, any path is allowed. Must be used only with HTTP.

 
+		
+No
+
notPathsstring[]
+
Optional. A list of negative match of paths.

+
 		
 
 No
@@ -289,14 +431,18 @@ No
 
 
Rule

 

-
Rule allows access from a list of sources to perform a list of operations when
-the condition is matched.

+
Rule matches requests from a list of sources that perform a list of operations subject to a
+list of conditions. A match occurs when at least one source, operation and condition
+matches the request. An empty rule is always matched.

 
-
Any string field in the rule supports Exact, Prefix, Suffix and Presence match:
-- Exact match: “abc” will match on value “abc”.
-- Prefix match: “abc” will match on value “abc” and “abcd”.
-- Suffix match: “abc” will match on value “abc” and “xabc”.
-- Presence match: “*” will match when value is not empty.

+
Any string field in the rule supports Exact, Prefix, Suffix and Presence match:

+
+
    
+
  • Exact match: “abc” will match on value “abc”.
    • 
+
  • Prefix match: “abc*” will match on value “abc” and “abcd”.
    • 
+
  • Suffix match: “*abc” will match on value “abc” and “xabc”.
    • 
+
  • Presence match: “*” will match when value is not empty.
    • 
+

 
 
@@ -408,7 +554,16 @@ No
 
Source

-
Source specifies the source identities of a request.

+
Source specifies the source identities of a request. Fields in the source are
+ANDed together.

+
+
For example, the following source matches if the principal is “admin” or “dev”
+and the namespace is “prod” or “test” and the ip is not “1.2.3.4”.

+
+
principals: ["admin", "dev"]
+namespaces: ["prod", "test"]
+not_ipblocks: ["1.2.3.4"]
+

 
 

 
 
 

@@ -425,10 +580,21 @@ No
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
+
+
+
-
-
-
+
+
+
-
-
-

 
string[]
 
 
Optional. A list of source peer identities (i.e. service account), which
-matches to the “source.principal” attribute.

+matches to the “source.principal” attribute. This field requires mTLS enabled.

 
 
If not set, any principal is allowed.

 
+		
+No
+
notPrincipalsstring[]
+
Optional. A list of negative match of source peer identities.

+
 		
 
 No
@@ -443,6 +609,17 @@ matches to the “request.auth.principal” attribute.

 
 
If not set, any request principal is allowed.

 
+		
+No
+
notRequestPrincipalsstring[]
+
Optional. A list of negative match of request identities.

+
 		
 
 No
@@ -453,10 +630,21 @@ No
 string[]
 
 
Optional. A list of namespaces, which matches to the “source.namespace”
-attribute.

+attribute. This field requires mTLS enabled.

 
 
If not set, any namespace is allowed.

 
+		
+No
+
notNamespacesstring[]
+
Optional. A list of negative match of namespaces.

+
 		
 
 No
@@ -471,6 +659,17 @@ Single IP (e.g. “1.2.3.4”) and CIDR (e.g. “1.2.3.0/24”)
 
 
If not set, any IP is allowed.

 
+		
+No
+
notIpBlocksstring[]
+
Optional. A list of negative match of IP blocks.

+
 		
 
 No
diff --git a/content/en/docs/reference/config/security/istio.authentication.v1alpha1/index.html b/content/en/docs/reference/config/security/istio.authentication.v1alpha1/index.html
index 013b5a0406..af5a0ef470 100644
--- a/content/en/docs/reference/config/security/istio.authentication.v1alpha1/index.html
+++ b/content/en/docs/reference/config/security/istio.authentication.v1alpha1/index.html
@@ -9,238 +9,10 @@ generator: protoc-gen-docs
 schema: istio.authentication.v1alpha1.Policy
 weight: 10
 aliases: [/docs/reference/config/istio.authentication.v1alpha1]
-number_of_entries: 11
+number_of_entries: 4
 ---
 
This package defines user-facing authentication policy.

 
-
Jwt

-

-
JSON Web Token (JWT) token format for authentication as defined by
-RFC 7519. See OAuth 2.0 and
-OIDC 1.0 for how this is used in the whole
-authentication flow.

-
-
For example:

-
-
A JWT for any requests:

-
-
issuer: https://example.com
-audiences:
-- bookstore_android.apps.googleusercontent.com
-  bookstore_web.apps.googleusercontent.com
-jwksUri: https://example.com/.well-known/jwks.json
-

-
-
A JWT for all requests except request at path /health_check and path with
-prefix /status/. This is useful to expose some paths for public access but
-keep others JWT validated.

-
-
issuer: https://example.com
-jwksUri: https://example.com/.well-known/jwks.json
-triggerRules:
-- excludedPaths:
-  - exact: /health_check
-  - prefix: /status/
-

-
-
A JWT only for requests at path /admin. This is useful to only require JWT
-validation on a specific set of paths but keep others public accessible.

-
-
issuer: https://example.com
-jwksUri: https://example.com/.well-known/jwks.json
-triggerRules:
-- includedPaths:
-  - prefix: /admin
-

-
-
A JWT only for requests at path of prefix /status/ but except the path of
-/status/version. This means for any request path with prefix /status/ except
-/status/version will require a valid JWT to proceed.

-
-
issuer: https://example.com
-jwksUri: https://example.com/.well-known/jwks.json
-triggerRules:
-- excludedPaths:
-  - exact: /status/version
-  includedPaths:
-  - prefix: /status/
-

-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
FieldTypeDescriptionRequired
issuerstring
-
Identifies the issuer that issued the JWT. See
-issuer
-Usually a URL or an email address.

-
-
Example: https://securetoken.google.com
-Example: 1234567-compute@developer.gserviceaccount.com

-
-		
-No
-
audiencesstring[]
-
The list of JWT
-audiences.
-that are allowed to access. A JWT containing any of these
-audiences will be accepted.

-
-
The service name will be accepted if audiences is empty.

-
-
Example:

-
-
audiences:
-- bookstore_android.apps.googleusercontent.com
-  bookstore_web.apps.googleusercontent.com
-

-
-		
-No
-
jwksUristring
-
URL of the provider’s public key set to validate signature of the
-JWT. See OpenID Discovery.

-
-
Optional if the key set document can either (a) be retrieved from
-OpenID
-Discovery of
-the issuer or (b) inferred from the email domain of the issuer (e.g. a
-Google service account).

-
-
Example: https://www.googleapis.com/oauth2/v1/certs

-
-
Note: Only one of jwks_uri and jwks should be used.

-
-		
-No
-
jwksstring
-
JSON Web Key Set of public keys to validate signature of the JWT.
-See https://auth0.com/docs/jwks.

-
-
Note: Only one of jwks_uri and jwks should be used.

-
-		
-No
-
jwtHeadersstring[]
-
JWT is sent in a request header. header represents the
-header name.

-
-
For example, if header=x-goog-iap-jwt-assertion, the header
-format will be x-goog-iap-jwt-assertion: <JWT>.

-
-		
-No
-
jwtParamsstring[]
-
JWT is sent in a query parameter. query represents the
-query parameter name.

-
-
For example, query=jwt_token.

-
-		
-No
-
triggerRulesTriggerRule[]
-
List of trigger rules to decide if this JWT should be used to validate the
-request. The JWT validation happens if any one of the rules matched.
-If the list is not empty and none of the rules matched, authentication will
-skip the JWT validation.
-Leave this empty to always trigger the JWT validation.

-
-		
-No
-

-

-
Jwt.TriggerRule

-

-
Trigger rule to match against a request. The trigger rule is satisfied if
-and only if both rules, excludedpaths and includepaths are satisfied.

-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
FieldTypeDescriptionRequired
excludedPathsStringMatch[]
-
List of paths to be excluded from the request. The rule is satisfied if
-request path does not match to any of the path in this list.

-
-		
-No
-
includedPathsStringMatch[]
-
List of paths that the request must include. If the list is not empty, the
-rule is satisfied if request path matches at least one of the path in the list.
-If the list is empty, the rule is ignored, in other words the rule is always satisfied.

-
-		
-No
-

-

 
MutualTls

 

 
TLS authentication params.

@@ -255,27 +27,28 @@ No
 

 
 
allowTlsbool
modeMode
 
-
WILL BE DEPRECATED, if set, will translates to TLS_PERMISSIVE mode.
-Set this flag to true to allow regular TLS (i.e without client x509
-certificate). If request carries client certificate, identity will be
-extracted and used (set to peer identity). Otherwise, peer identity will
-be left unset.
-When the flag is false (default), request must have client certificate.

+
Defines the mode of mTLS authentication.

 
 		
 
 No
 
 
modeMode
allowTlsbool
 
-
Defines the mode of mTLS authentication.

+
Deprecated. Please use mode = PERMISSIVE instead.
+If set, will translate to TLS_PERMISSIVE mode.
+Set this flag to true to allow regular TLS (i.e without client x509
+certificate). If request carries client certificate, identity will be
+extracted and used (set to peer identity). Otherwise, peer identity will
+be left unset.
+When the flag is false (default), request must have client certificate.

 
 		
 
@@ -309,36 +82,6 @@ No
 
 
Connection can be either plaintext or TLS with Client cert.

 
-

-

-
OriginAuthenticationMethod

-

-
OriginAuthenticationMethod defines authentication method/params for origin
-authentication. Origin could be end-user, device, delegate service etc.
-Currently, only JWT is supported for origin authentication.

-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@@ -346,9 +89,8 @@ No
 
PeerAuthenticationMethod

-
PeerAuthenticationMethod defines one particular type of authentication, e.g
-mutual TLS, JWT etc, (no authentication is one type by itself) that can
-be used for peer authentication.
+
PeerAuthenticationMethod defines one particular type of authentication. Only mTLS is supported
+at the moment.
 The type can be progammatically determine by checking the type of the
 “params” field.

 
@@ -459,18 +201,6 @@ spec:
 
 
 

-
-
-
-
-
-
@@ -486,11 +216,25 @@ Leave the list empty if peer authentication is not required

 No
 
-
+
+
+
+
+
+
+
-
+
-
+
-
+
FieldTypeDescriptionRequired
jwtJwt
-
Jwt params for the method.

-
-		
-No
 
 

 
 
 
targetsTargetSelector[]
-
List rules to select workloads that the policy should be applied on.
-If empty, policy will be used on all workloads in the same namespace.

-
-		
-No
-

 

 peers
 PeerAuthenticationMethod[]
 
targetsTargetSelector[]
+
Deprecated. Only mesh-level and namespace-level policies are supported.
+List rules to select workloads that the policy should be applied on.
+If empty, policy will be used on all workloads in the same namespace.

+
+		
+No
+

 peerIsOptional
 bool
 
-
Set this flag to true to accept request (for peer authentication perspective),
+
Deprecated. Should set mTLS to PERMISSIVE instead.
+Set this flag to true to accept request (for peer authentication perspective),
 even when none of the peer authentication methods defined above satisfied.
 Typically, this is used to delay the rejection decision to next layer (e.g
 authorization).
@@ -501,11 +245,12 @@ This flag is ignored if no authentication defined for peer (peers field is empty
 No
 

 

 origins
 OriginAuthenticationMethod[]
 
-
List of authentication methods that can be used for origin authentication.
+
Deprecated. Please use security/v1beta1/RequestAuthentication instead.
+List of authentication methods that can be used for origin authentication.
 Similar to peers, these will be evaluated in order; the first validate one
 will be used to set origin identity and attributes (i.e request.auth.user,
 request.auth.issuer etc). If none of these methods pass, request will be
@@ -519,11 +264,12 @@ Leave the list empty if origin authentication is not required.

 No
 		
 

 originIsOptional
 bool
 
-
Set this flag to true to accept request (for origin authentication perspective),
+
Deprecated. Please use security/v1beta1/RequestAuthentication instead.
+Set this flag to true to accept request (for origin authentication perspective),
 even when none of the origin authentication methods defined above satisfied.
 Typically, this is used to delay the rejection decision to next layer (e.g
 authorization).
@@ -534,11 +280,13 @@ This flag is ignored if no authentication defined for origin (origins field is e
 No
 

 

 principalBinding
 PrincipalBinding
 
-
Define whether peer or origin identity should be use for principal. Default
+
Deprecated. Source principal is always from peer, and request principal is always from
+RequestAuthentication.
+Define whether peer or origin identity should be use for principal. Default
 value is USE_PEER.
 If peer (or origin) identity is not available, either because of peer/origin
 authentication is not defined, or failed, principal will be left unset.
@@ -553,191 +301,3 @@ No
 

 

 

-
PortSelector

-

-
PortSelector specifies the name or number of a port to be used for
-matching targets for authentication policy. This is copied from
-networking API to avoid dependency.

-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
FieldTypeDescriptionRequired
numberuint32 (oneof)
-
Valid port number

-
-		
-Yes
-
namestring (oneof)
-
Port name

-
-		
-Yes
-

-

-
PrincipalBinding

-

-
Associates authentication with request principal.

-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
NameDescription
USE_PEER
-
Principal will be set to the identity from peer authentication.

-
-
USE_ORIGIN
-
Principal will be set to the identity from origin authentication.

-
-

-

-
StringMatch

-

-
Describes how to match a given string. Match is case-sensitive.

-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
FieldTypeDescriptionRequired
exactstring (oneof)
-
exact string match.

-
-		
-Yes
-
prefixstring (oneof)
-
prefix-based match.

-
-		
-Yes
-
suffixstring (oneof)
-
suffix-based match.

-
-		
-Yes
-
regexstring (oneof)
-
ECMAscript style regex-based match as defined by EDCA-262.
-Example: “^/pets/(.*?)?”

-
-		
-Yes
-

-

-
TargetSelector

-

-
TargetSelector defines a matching rule to a workload. A workload is selected
-if it is associated with the service name and service port(s) specified in the selector rule.

-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
FieldTypeDescriptionRequired
namestring
-
The name must be a short name from the service registry. The
-fully qualified domain name will be resolved in a platform specific manner.

-
-		
-Yes
-
portsPortSelector[]
-
Specifies the ports. Note that this is the port(s) exposed by the service, not workload instance ports.
-For example, if a service is defined as below, then 8000 should be used, not 9000.

-
-
kind: Service
-metadata:
-  ...
-spec:
-  ports:
-  - name: http
-    port: 8000
-    targetPort: 9000
-  selector:
-    app: backend
-

-
-
Leave empty to match all ports that are exposed.

-
-		
-No
-

-

diff --git a/content/en/docs/reference/config/security/istio.rbac.v1alpha1/index.html b/content/en/docs/reference/config/security/istio.rbac.v1alpha1/index.html
index b036676d60..d5b2aa53c4 100644
--- a/content/en/docs/reference/config/security/istio.rbac.v1alpha1/index.html
+++ b/content/en/docs/reference/config/security/istio.rbac.v1alpha1/index.html
@@ -24,7 +24,7 @@ the following standard fields:

 
 
    
 
  • services: a list of services.
    • 
-
  • methods: A list of HTTP methods. You can set the value to \* to include all HTTP methods.
+
  • methods: A list of HTTP methods. You can set the value to ["*"] to include all HTTP methods.
          This field should not be set for TCP services. The policy will be ignored.
          For gRPC services, only POST is allowed; other methods will result in denying services.
    • 
 
  • paths: HTTP paths or gRPC methods. Note that gRPC methods should be