---
WARNING: THIS IS AN AUTO-GENERATED FILE, DO NOT EDIT. PLEASE MODIFY THE ORIGINAL SOURCE IN THE 'https://github.com/istio/istio' REPO
source_repo: https://github.com/istio/istio
title: install-cni
description: Install and configure Istio CNI plugin on a node, detect and repair pod which is broken by race condition.
generator: pkg-collateral-docs
number_of_entries: 8
max_toc_level: 2
remove_toc_prefix: 'install-cni '
---
<p>Install and configure Istio CNI plugin on a node, detect and repair pod which is broken by race condition.</p>
<pre class="language-bash"><code>install-cni [flags]
</code></pre>
<table class="command-flags">
<thead>
<tr>
<th>Flags</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>--chained-cni-plugin</code></td>
<td>Whether to install CNI plugin as a chained or standalone </td>
</tr>
<tr>
<td><code>--cni-conf-name &lt;string&gt;</code></td>
<td>Name of the CNI configuration file  (default ``)</td>
</tr>
<tr>
<td><code>--cni-net-dir &lt;string&gt;</code></td>
<td>Directory on the host where CNI network plugins are installed  (default `/etc/cni/net.d`)</td>
</tr>
<tr>
<td><code>--cni-network-config &lt;string&gt;</code></td>
<td>CNI configuration template as a string  (default ``)</td>
</tr>
<tr>
<td><code>--cni-network-config-file &lt;string&gt;</code></td>
<td>CNI config template as a file  (default ``)</td>
</tr>
<tr>
<td><code>--ctrlz_address &lt;string&gt;</code></td>
<td>The IP Address to listen on for the ControlZ introspection facility. Use &#39;*&#39; to indicate all addresses.  (default `localhost`)</td>
</tr>
<tr>
<td><code>--ctrlz_port &lt;uint16&gt;</code></td>
<td>The IP port to use for the ControlZ introspection facility  (default `9876`)</td>
</tr>
<tr>
<td><code>--kube-ca-file &lt;string&gt;</code></td>
<td>CA file for kubeconfig. Defaults to the same as install-cni pod  (default ``)</td>
</tr>
<tr>
<td><code>--kubecfg-file-name &lt;string&gt;</code></td>
<td>Name of the kubeconfig file which CNI plugin will use when interacting with API server  (default `ZZZ-istio-cni-kubeconfig`)</td>
</tr>
<tr>
<td><code>--kubeconfig-mode &lt;int&gt;</code></td>
<td>File mode of the kubeconfig file  (default `384`)</td>
</tr>
<tr>
<td><code>--log-level &lt;string&gt;</code></td>
<td>Fallback value for log level in CNI config file, if not specified in helm template  (default `warn`)</td>
</tr>
<tr>
<td><code>--log-uds-address &lt;string&gt;</code></td>
<td>The UDS server address which CNI plugin will copy log ouptut to  (default `/var/run/istio-cni/log.sock`)</td>
</tr>
<tr>
<td><code>--log_as_json</code></td>
<td>Whether to format output as JSON or in plain console-friendly format </td>
</tr>
<tr>
<td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, default, install, klog, repair]  (default ``)</td>
</tr>
<tr>
<td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, default, install, klog, repair] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)</td>
</tr>
<tr>
<td><code>--log_rotate &lt;string&gt;</code></td>
<td>The path for the optional rotating log file  (default ``)</td>
</tr>
<tr>
<td><code>--log_rotate_max_age &lt;int&gt;</code></td>
<td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit)  (default `30`)</td>
</tr>
<tr>
<td><code>--log_rotate_max_backups &lt;int&gt;</code></td>
<td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit)  (default `1000`)</td>
</tr>
<tr>
<td><code>--log_rotate_max_size &lt;int&gt;</code></td>
<td>The maximum size in megabytes of a log file beyond which the file is rotated  (default `104857600`)</td>
</tr>
<tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, default, install, klog, repair] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)</td>
</tr>
<tr>
<td><code>--log_target &lt;stringArray&gt;</code></td>
<td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr  (default `[stdout]`)</td>
</tr>
<tr>
<td><code>--monitoring-port &lt;int&gt;</code></td>
<td>HTTP port to serve prometheus metrics  (default `15014`)</td>
</tr>
<tr>
<td><code>--mounted-cni-net-dir &lt;string&gt;</code></td>
<td>Directory on the container where CNI networks are installed  (default `/host/etc/cni/net.d`)</td>
</tr>
<tr>
<td><code>--repair-broken-pod-label-key &lt;string&gt;</code></td>
<td>The key portion of the label which will be set by the ace repair if label pods is true  (default `cni.istio.io/uninitialized`)</td>
</tr>
<tr>
<td><code>--repair-broken-pod-label-value &lt;string&gt;</code></td>
<td>The value portion of the label which will be set by the race repair if label pods is true  (default `true`)</td>
</tr>
<tr>
<td><code>--repair-delete-pods</code></td>
<td>Controller will delete pods when detecting pod broken by race condition </td>
</tr>
<tr>
<td><code>--repair-enabled</code></td>
<td>Whether to enable race condition repair or not </td>
</tr>
<tr>
<td><code>--repair-field-selectors &lt;string&gt;</code></td>
<td>A set of field selectors in label=value format that will be added to the pod list filters  (default ``)</td>
</tr>
<tr>
<td><code>--repair-init-container-exit-code &lt;int&gt;</code></td>
<td>Expected exit code for the init container when crash-looping because of CNI misconfiguration  (default `126`)</td>
</tr>
<tr>
<td><code>--repair-init-container-name &lt;string&gt;</code></td>
<td>The name of the istio init container (will crash-loop if CNI is not configured for the pod)  (default `istio-validation`)</td>
</tr>
<tr>
<td><code>--repair-init-container-termination-message &lt;string&gt;</code></td>
<td>The expected termination message for the init container when crash-looping because of CNI misconfiguration  (default ``)</td>
</tr>
<tr>
<td><code>--repair-label-pods</code></td>
<td>Controller will label pods when detecting pod broken by race condition </td>
</tr>
<tr>
<td><code>--repair-label-selectors &lt;string&gt;</code></td>
<td>A set of label selectors in label=value format that will be added to the pod list filters  (default ``)</td>
</tr>
<tr>
<td><code>--repair-node-name &lt;string&gt;</code></td>
<td>The name of the managed node (will manage all nodes if unset)  (default ``)</td>
</tr>
<tr>
<td><code>--repair-run-as-daemon</code></td>
<td>Controller will run in a loop </td>
</tr>
<tr>
<td><code>--repair-sidecar-annotation &lt;string&gt;</code></td>
<td>An annotation key that indicates this pod contains an istio sidecar. All pods without this annotation will be ignored.The value of the annotation is ignored.  (default `sidecar.istio.io/status`)</td>
</tr>
<tr>
<td><code>--skip-cni-binaries &lt;istio-cni&gt;</code></td>
<td>Binaries that should not be installed. Currently Istio only installs one binary istio-cni  (default `[]`)</td>
</tr>
<tr>
<td><code>--skip-tls-verify</code></td>
<td>Whether to use insecure TLS in kubeconfig file </td>
</tr>
<tr>
<td><code>--update-cni-binaries</code></td>
<td>Whether to refresh existing binaries when installing CNI </td>
</tr>
</tbody>
</table>
<h2 id="install-cni-completion">install-cni completion</h2>
<p>
Generate the autocompletion script for install-cni for the specified shell.
See each sub-command&#39;s help for details on how to use the generated script.
</p>
<table class="command-flags">
<thead>
<tr>
<th>Flags</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>--ctrlz_address &lt;string&gt;</code></td>
<td>The IP Address to listen on for the ControlZ introspection facility. Use &#39;*&#39; to indicate all addresses.  (default `localhost`)</td>
</tr>
<tr>
<td><code>--ctrlz_port &lt;uint16&gt;</code></td>
<td>The IP port to use for the ControlZ introspection facility  (default `9876`)</td>
</tr>
<tr>
<td><code>--log_as_json</code></td>
<td>Whether to format output as JSON or in plain console-friendly format </td>
</tr>
<tr>
<td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, default, install, klog, repair]  (default ``)</td>
</tr>
<tr>
<td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, default, install, klog, repair] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)</td>
</tr>
<tr>
<td><code>--log_rotate &lt;string&gt;</code></td>
<td>The path for the optional rotating log file  (default ``)</td>
</tr>
<tr>
<td><code>--log_rotate_max_age &lt;int&gt;</code></td>
<td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit)  (default `30`)</td>
</tr>
<tr>
<td><code>--log_rotate_max_backups &lt;int&gt;</code></td>
<td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit)  (default `1000`)</td>
</tr>
<tr>
<td><code>--log_rotate_max_size &lt;int&gt;</code></td>
<td>The maximum size in megabytes of a log file beyond which the file is rotated  (default `104857600`)</td>
</tr>
<tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, default, install, klog, repair] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)</td>
</tr>
<tr>
<td><code>--log_target &lt;stringArray&gt;</code></td>
<td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr  (default `[stdout]`)</td>
</tr>
</tbody>
</table>
<h2 id="install-cni-completion-bash">install-cni completion bash</h2>
<p>
Generate the autocompletion script for the bash shell.</p>
<p>This script depends on the &#39;bash-completion&#39; package.
If it is not installed already, you can install it via your OS&#39;s package manager.</p>
<p>To load completions in your current shell session:
$ source &lt;(install-cni completion bash)</p>
<p>To load completions for every new session, execute once:
Linux:
  $ install-cni completion bash &gt; /etc/bash_completion.d/install-cni
MacOS:
  $ install-cni completion bash &gt; /usr/local/etc/bash_completion.d/install-cni</p>
<p>You will need to start a new shell for this setup to take effect.
  </p>
<pre class="language-bash"><code>install-cni completion bash
</code></pre>
<table class="command-flags">
<thead>
<tr>
<th>Flags</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>--ctrlz_address &lt;string&gt;</code></td>
<td>The IP Address to listen on for the ControlZ introspection facility. Use &#39;*&#39; to indicate all addresses.  (default `localhost`)</td>
</tr>
<tr>
<td><code>--ctrlz_port &lt;uint16&gt;</code></td>
<td>The IP port to use for the ControlZ introspection facility  (default `9876`)</td>
</tr>
<tr>
<td><code>--log_as_json</code></td>
<td>Whether to format output as JSON or in plain console-friendly format </td>
</tr>
<tr>
<td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, default, install, klog, repair]  (default ``)</td>
</tr>
<tr>
<td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, default, install, klog, repair] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)</td>
</tr>
<tr>
<td><code>--log_rotate &lt;string&gt;</code></td>
<td>The path for the optional rotating log file  (default ``)</td>
</tr>
<tr>
<td><code>--log_rotate_max_age &lt;int&gt;</code></td>
<td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit)  (default `30`)</td>
</tr>
<tr>
<td><code>--log_rotate_max_backups &lt;int&gt;</code></td>
<td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit)  (default `1000`)</td>
</tr>
<tr>
<td><code>--log_rotate_max_size &lt;int&gt;</code></td>
<td>The maximum size in megabytes of a log file beyond which the file is rotated  (default `104857600`)</td>
</tr>
<tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, default, install, klog, repair] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)</td>
</tr>
<tr>
<td><code>--log_target &lt;stringArray&gt;</code></td>
<td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr  (default `[stdout]`)</td>
</tr>
<tr>
<td><code>--no-descriptions</code></td>
<td>disable completion descriptions </td>
</tr>
</tbody>
</table>
<h2 id="install-cni-completion-fish">install-cni completion fish</h2>
<p>
Generate the autocompletion script for the fish shell.</p>
<p>To load completions in your current shell session:
$ install-cni completion fish | source</p>
<p>To load completions for every new session, execute once:
$ install-cni completion fish &gt; ~/.config/fish/completions/install-cni.fish</p>
<p>You will need to start a new shell for this setup to take effect.
</p>
<pre class="language-bash"><code>install-cni completion fish [flags]
</code></pre>
<table class="command-flags">
<thead>
<tr>
<th>Flags</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>--ctrlz_address &lt;string&gt;</code></td>
<td>The IP Address to listen on for the ControlZ introspection facility. Use &#39;*&#39; to indicate all addresses.  (default `localhost`)</td>
</tr>
<tr>
<td><code>--ctrlz_port &lt;uint16&gt;</code></td>
<td>The IP port to use for the ControlZ introspection facility  (default `9876`)</td>
</tr>
<tr>
<td><code>--log_as_json</code></td>
<td>Whether to format output as JSON or in plain console-friendly format </td>
</tr>
<tr>
<td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, default, install, klog, repair]  (default ``)</td>
</tr>
<tr>
<td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, default, install, klog, repair] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)</td>
</tr>
<tr>
<td><code>--log_rotate &lt;string&gt;</code></td>
<td>The path for the optional rotating log file  (default ``)</td>
</tr>
<tr>
<td><code>--log_rotate_max_age &lt;int&gt;</code></td>
<td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit)  (default `30`)</td>
</tr>
<tr>
<td><code>--log_rotate_max_backups &lt;int&gt;</code></td>
<td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit)  (default `1000`)</td>
</tr>
<tr>
<td><code>--log_rotate_max_size &lt;int&gt;</code></td>
<td>The maximum size in megabytes of a log file beyond which the file is rotated  (default `104857600`)</td>
</tr>
<tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, default, install, klog, repair] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)</td>
</tr>
<tr>
<td><code>--log_target &lt;stringArray&gt;</code></td>
<td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr  (default `[stdout]`)</td>
</tr>
<tr>
<td><code>--no-descriptions</code></td>
<td>disable completion descriptions </td>
</tr>
</tbody>
</table>
<h2 id="install-cni-completion-powershell">install-cni completion powershell</h2>
<p>
Generate the autocompletion script for powershell.</p>
<p>To load completions in your current shell session:
PS C:\&gt; install-cni completion powershell | Out-String | Invoke-Expression</p>
<p>To load completions for every new session, add the output of the above command
to your powershell profile.
</p>
<pre class="language-bash"><code>install-cni completion powershell [flags]
</code></pre>
<table class="command-flags">
<thead>
<tr>
<th>Flags</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>--ctrlz_address &lt;string&gt;</code></td>
<td>The IP Address to listen on for the ControlZ introspection facility. Use &#39;*&#39; to indicate all addresses.  (default `localhost`)</td>
</tr>
<tr>
<td><code>--ctrlz_port &lt;uint16&gt;</code></td>
<td>The IP port to use for the ControlZ introspection facility  (default `9876`)</td>
</tr>
<tr>
<td><code>--log_as_json</code></td>
<td>Whether to format output as JSON or in plain console-friendly format </td>
</tr>
<tr>
<td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, default, install, klog, repair]  (default ``)</td>
</tr>
<tr>
<td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, default, install, klog, repair] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)</td>
</tr>
<tr>
<td><code>--log_rotate &lt;string&gt;</code></td>
<td>The path for the optional rotating log file  (default ``)</td>
</tr>
<tr>
<td><code>--log_rotate_max_age &lt;int&gt;</code></td>
<td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit)  (default `30`)</td>
</tr>
<tr>
<td><code>--log_rotate_max_backups &lt;int&gt;</code></td>
<td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit)  (default `1000`)</td>
</tr>
<tr>
<td><code>--log_rotate_max_size &lt;int&gt;</code></td>
<td>The maximum size in megabytes of a log file beyond which the file is rotated  (default `104857600`)</td>
</tr>
<tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, default, install, klog, repair] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)</td>
</tr>
<tr>
<td><code>--log_target &lt;stringArray&gt;</code></td>
<td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr  (default `[stdout]`)</td>
</tr>
<tr>
<td><code>--no-descriptions</code></td>
<td>disable completion descriptions </td>
</tr>
</tbody>
</table>
<h2 id="install-cni-completion-zsh">install-cni completion zsh</h2>
<p>
Generate the autocompletion script for the zsh shell.</p>
<p>If shell completion is not already enabled in your environment you will need
to enable it.  You can execute the following once:</p>
<p>$ echo &#34;autoload -U compinit; compinit&#34; &gt;&gt; ~/.zshrc</p>
<p>To load completions for every new session, execute once:
# Linux:
$ install-cni completion zsh &gt; &#34;${fpath[1]}/_install-cni&#34;
# macOS:
$ install-cni completion zsh &gt; /usr/local/share/zsh/site-functions/_install-cni</p>
<p>You will need to start a new shell for this setup to take effect.
</p>
<pre class="language-bash"><code>install-cni completion zsh [flags]
</code></pre>
<table class="command-flags">
<thead>
<tr>
<th>Flags</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>--ctrlz_address &lt;string&gt;</code></td>
<td>The IP Address to listen on for the ControlZ introspection facility. Use &#39;*&#39; to indicate all addresses.  (default `localhost`)</td>
</tr>
<tr>
<td><code>--ctrlz_port &lt;uint16&gt;</code></td>
<td>The IP port to use for the ControlZ introspection facility  (default `9876`)</td>
</tr>
<tr>
<td><code>--log_as_json</code></td>
<td>Whether to format output as JSON or in plain console-friendly format </td>
</tr>
<tr>
<td><code>--log_caller &lt;string&gt;</code></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, default, install, klog, repair]  (default ``)</td>
</tr>
<tr>
<td><code>--log_output_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, default, install, klog, repair] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)</td>
</tr>
<tr>
<td><code>--log_rotate &lt;string&gt;</code></td>
<td>The path for the optional rotating log file  (default ``)</td>
</tr>
<tr>
<td><code>--log_rotate_max_age &lt;int&gt;</code></td>
<td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit)  (default `30`)</td>
</tr>
<tr>
<td><code>--log_rotate_max_backups &lt;int&gt;</code></td>
<td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit)  (default `1000`)</td>
</tr>
<tr>
<td><code>--log_rotate_max_size &lt;int&gt;</code></td>
<td>The maximum size in megabytes of a log file beyond which the file is rotated  (default `104857600`)</td>
</tr>
<tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, default, install, klog, repair] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)</td>
</tr>
<tr>
<td><code>--log_target &lt;stringArray&gt;</code></td>
<td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr  (default `[stdout]`)</td>
</tr>
<tr>
<td><code>--no-descriptions</code></td>
<td>disable completion descriptions </td>
</tr>
</tbody>
</table>
<h2 id="install-cni-version">install-cni version</h2>
<p>Prints out build version information</p>
<pre class="language-bash"><code>install-cni version [flags]
</code></pre>
<table class="command-flags">
<thead>
<tr>
<th>Flags</th>
<th>Shorthand</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>--ctrlz_address &lt;string&gt;</code></td>
<td></td>
<td>The IP Address to listen on for the ControlZ introspection facility. Use &#39;*&#39; to indicate all addresses.  (default `localhost`)</td>
</tr>
<tr>
<td><code>--ctrlz_port &lt;uint16&gt;</code></td>
<td></td>
<td>The IP port to use for the ControlZ introspection facility  (default `9876`)</td>
</tr>
<tr>
<td><code>--log_as_json</code></td>
<td></td>
<td>Whether to format output as JSON or in plain console-friendly format </td>
</tr>
<tr>
<td><code>--log_caller &lt;string&gt;</code></td>
<td></td>
<td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, cni, default, install, klog, repair]  (default ``)</td>
</tr>
<tr>
<td><code>--log_output_level &lt;string&gt;</code></td>
<td></td>
<td>Comma-separated minimum per-scope logging level of messages to output, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope&gt;:&lt;level&gt;,... where scope can be one of [all, cni, default, install, klog, repair] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:info`)</td>
</tr>
<tr>
<td><code>--log_rotate &lt;string&gt;</code></td>
<td></td>
<td>The path for the optional rotating log file  (default ``)</td>
</tr>
<tr>
<td><code>--log_rotate_max_age &lt;int&gt;</code></td>
<td></td>
<td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit)  (default `30`)</td>
</tr>
<tr>
<td><code>--log_rotate_max_backups &lt;int&gt;</code></td>
<td></td>
<td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit)  (default `1000`)</td>
</tr>
<tr>
<td><code>--log_rotate_max_size &lt;int&gt;</code></td>
<td></td>
<td>The maximum size in megabytes of a log file beyond which the file is rotated  (default `104857600`)</td>
</tr>
<tr>
<td><code>--log_stacktrace_level &lt;string&gt;</code></td>
<td></td>
<td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, cni, default, install, klog, repair] and level can be one of [debug, info, warn, error, fatal, none]  (default `default:none`)</td>
</tr>
<tr>
<td><code>--log_target &lt;stringArray&gt;</code></td>
<td></td>
<td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr  (default `[stdout]`)</td>
</tr>
<tr>
<td><code>--output &lt;string&gt;</code></td>
<td><code>-o</code></td>
<td>One of &#39;yaml&#39; or &#39;json&#39;.  (default ``)</td>
</tr>
<tr>
<td><code>--short</code></td>
<td><code>-s</code></td>
<td>Use --short=false to generate full version information </td>
</tr>
</tbody>
</table>
<h2 id="envvars">Environment variables</h2>
These environment variables affect the behavior of the <code>install-cni</code> command. Please use with caution as these environment variables are experimental and can change anytime.
<table class="envvars">
<thead>
<tr>
<th>Variable Name</th>
<th>Type</th>
<th>Default Value</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>CHAINED_CNI_PLUGIN</code></td>
<td>Boolean</td>
<td><code>true</code></td>
<td>Whether to install CNI plugin as a chained or standalone</td>
</tr>
<tr>
<td><code>CNI_CONF_NAME</code></td>
<td>String</td>
<td><code></code></td>
<td>Name of the CNI configuration file</td>
</tr>
<tr>
<td><code>CNI_NETWORK_CONFIG</code></td>
<td>String</td>
<td><code></code></td>
<td>CNI configuration template as a string</td>
</tr>
<tr>
<td><code>CNI_NETWORK_CONFIG_FILE</code></td>
<td>String</td>
<td><code></code></td>
<td>CNI config template as a file</td>
</tr>
<tr>
<td><code>CNI_NET_DIR</code></td>
<td>String</td>
<td><code>/etc/cni/net.d</code></td>
<td>Directory on the host where CNI network plugins are installed</td>
</tr>
<tr>
<td><code>KUBECFG_FILE_NAME</code></td>
<td>String</td>
<td><code>ZZZ-istio-cni-kubeconfig</code></td>
<td>Name of the kubeconfig file which CNI plugin will use when interacting with API server</td>
</tr>
<tr>
<td><code>KUBECONFIG_MODE</code></td>
<td>Integer</td>
<td><code>384</code></td>
<td>File mode of the kubeconfig file</td>
</tr>
<tr>
<td><code>KUBE_CA_FILE</code></td>
<td>String</td>
<td><code></code></td>
<td>CA file for kubeconfig. Defaults to the same as install-cni pod</td>
</tr>
<tr>
<td><code>LOG_LEVEL</code></td>
<td>String</td>
<td><code>warn</code></td>
<td>Fallback value for log level in CNI config file, if not specified in helm template</td>
</tr>
<tr>
<td><code>LOG_UDS_ADDRESS</code></td>
<td>String</td>
<td><code>/var/run/istio-cni/log.sock</code></td>
<td>The UDS server address which CNI plugin will copy log ouptut to</td>
</tr>
<tr>
<td><code>MONITORING_PORT</code></td>
<td>Integer</td>
<td><code>15014</code></td>
<td>HTTP port to serve prometheus metrics</td>
</tr>
<tr>
<td><code>MOUNTED_CNI_NET_DIR</code></td>
<td>String</td>
<td><code>/host/etc/cni/net.d</code></td>
<td>Directory on the container where CNI networks are installed</td>
</tr>
<tr>
<td><code>REPAIR_BROKEN_POD_LABEL_KEY</code></td>
<td>String</td>
<td><code>cni.istio.io/uninitialized</code></td>
<td>The key portion of the label which will be set by the ace repair if label pods is true</td>
</tr>
<tr>
<td><code>REPAIR_BROKEN_POD_LABEL_VALUE</code></td>
<td>String</td>
<td><code>true</code></td>
<td>The value portion of the label which will be set by the race repair if label pods is true</td>
</tr>
<tr>
<td><code>REPAIR_DELETE_PODS</code></td>
<td>Boolean</td>
<td><code>false</code></td>
<td>Controller will delete pods when detecting pod broken by race condition</td>
</tr>
<tr>
<td><code>REPAIR_ENABLED</code></td>
<td>Boolean</td>
<td><code>true</code></td>
<td>Whether to enable race condition repair or not</td>
</tr>
<tr>
<td><code>REPAIR_FIELD_SELECTORS</code></td>
<td>String</td>
<td><code></code></td>
<td>A set of field selectors in label=value format that will be added to the pod list filters</td>
</tr>
<tr>
<td><code>REPAIR_INIT_CONTAINER_EXIT_CODE</code></td>
<td>Integer</td>
<td><code>126</code></td>
<td>Expected exit code for the init container when crash-looping because of CNI misconfiguration</td>
</tr>
<tr>
<td><code>REPAIR_INIT_CONTAINER_NAME</code></td>
<td>String</td>
<td><code>istio-validation</code></td>
<td>The name of the istio init container (will crash-loop if CNI is not configured for the pod)</td>
</tr>
<tr>
<td><code>REPAIR_INIT_CONTAINER_TERMINATION_MESSAGE</code></td>
<td>String</td>
<td><code></code></td>
<td>The expected termination message for the init container when crash-looping because of CNI misconfiguration</td>
</tr>
<tr>
<td><code>REPAIR_LABEL_PODS</code></td>
<td>Boolean</td>
<td><code>false</code></td>
<td>Controller will label pods when detecting pod broken by race condition</td>
</tr>
<tr>
<td><code>REPAIR_LABEL_SELECTORS</code></td>
<td>String</td>
<td><code></code></td>
<td>A set of label selectors in label=value format that will be added to the pod list filters</td>
</tr>
<tr>
<td><code>REPAIR_NODE_NAME</code></td>
<td>String</td>
<td><code></code></td>
<td>The name of the managed node (will manage all nodes if unset)</td>
</tr>
<tr>
<td><code>REPAIR_RUN_AS_DAEMON</code></td>
<td>Boolean</td>
<td><code>false</code></td>
<td>Controller will run in a loop</td>
</tr>
<tr>
<td><code>REPAIR_SIDECAR_ANNOTATION</code></td>
<td>String</td>
<td><code>sidecar.istio.io/status</code></td>
<td>An annotation key that indicates this pod contains an istio sidecar. All pods without this annotation will be ignored.The value of the annotation is ignored.</td>
</tr>
<tr>
<td><code>SKIP_CNI_BINARIES</code></td>
<td>String</td>
<td><code></code></td>
<td>Binaries that should not be installed. Currently Istio only installs one binary `istio-cni`</td>
</tr>
<tr>
<td><code>SKIP_TLS_VERIFY</code></td>
<td>Boolean</td>
<td><code>false</code></td>
<td>Whether to use insecure TLS in kubeconfig file</td>
</tr>
<tr>
<td><code>UPDATE_CNI_BINARIES</code></td>
<td>Boolean</td>
<td><code>true</code></td>
<td>Whether to refresh existing binaries when installing CNI</td>
</tr>
</tbody>
</table>
<h2 id="metrics">Exported metrics</h2>
<table class="metrics">
<thead>
<tr><th>Metric Name</th><th>Type</th><th>Description</th></tr>
</thead>
<tbody>
<tr><td><code>istio_build</code></td><td><code>LastValue</code></td><td>Istio component build info</td></tr>
<tr><td><code>istio_cni_install_ready</code></td><td><code>LastValue</code></td><td>Whether the CNI plugin installation is ready or not</td></tr>
<tr><td><code>istio_cni_installs_total</code></td><td><code>Sum</code></td><td>Total number of CNI plugins installed by the Istio CNI installer</td></tr>
<tr><td><code>istio_cni_repair_pods_repaired_total</code></td><td><code>Sum</code></td><td>Total number of pods repaired by repair controller</td></tr>
</tbody>
</table>