ISTIOCTL-EXPERIMENTAL-AUTHZ-CHECK(1)

💅 istioctl-experimental-authz-check(1)

okay bestie, welcome to istioctl-experimental-authz-check — yes that whole entire mouthful is the page name, we're not copying the header line twice, we're folding it in right here like a hair clip. let's go 🎀

---

✨ NAME ✨

istioctl-experimental-authz-check — the glow-up command that checks the AuthorizationPolicy applied in the pod. literally what it says on the tin 🫶

---

🌸 SYNOPSIS 🌸

istioctl experimental authz check [/][.] [flags]

---

🦋 DESCRIPTION 🦋

so Check prints out the AuthorizationPolicy applied to a pod by directly peeking at that pod's Envoy config. no middleman, no vibes-based guessing, just straight into the config 💅

it's highkey the move when you wanna inspect the policy propagation from Istiod to Envoy, like following a text through the group chat — and also the final AuthorizationPolicy list merged from multiple sources (mesh-level, namespace-level and workload-level). all those layers, merged, and you get to see the whole thing ✨

and bestie — it also supports reading from a standalone config dump file with the -f flag. icon behavior fr fr.

---

💖 OPTIONS 💖

• -f, --file="" — the json file with Envoy config dump to be checked 📄
• -h, --help[=false] — help for check (the classic, the icon)
• --proxy-admin-port=15000 — Envoy proxy admin port 🔌

---

👑 OPTIONS INHERITED FROM PARENT COMMANDS 👑

• --as="" — username to impersonate for the operation. user could be a regular user or a service account in a namespace
• --as-group=[] — group to impersonate for the operation. this flag can be repeated to specify multiple groups 🫶
• --as-uid="" — UID to impersonate for the operation.
• --context="" — Kubernetes configuration context
• -i, --istioNamespace="istio-system" — Istio system namespace
• --kubeclient-timeout="15s" — Kubernetes client timeout as a time.Duration string, defaults to 15 seconds ⏰
• -c, --kubeconfig="" — Kubernetes configuration file
• -n, --namespace="" — Kubernetes namespace
• --vklog=0 — number for the log level verbosity. like the -v flag. ex: --vklog=9 (go off, log queen 🔊)

---

🌈 EXAMPLE 🌈

# Check AuthorizationPolicy applied to pod httpbin-88ddbcfdd-nt5jb:
istioctl x authz check httpbin-88ddbcfdd-nt5jb

# Check AuthorizationPolicy applied to one pod under a deployment
istioctl x authz check deployment/productpage-v1

# Check AuthorizationPolicy from Envoy config dump file:
istioctl x authz check -f httpbin_config_dump.json

not me giving you three examples like a friendship bracelet 🍓

---

🔥 SEE ALSO 🔥

• istioctl-experimental-authz(1) — the parent, the main character 👑

---

💀 tiny note bestie: this whole command lives under experimental, so it's giving "not locked in for forever" energy. proceed with that in mind 🙈

---

and that's the page! 🌟 auto generated by spf13/cobra, dated Jan 198 (yes that's literally what the footer says, don't come for me 😭) — mwah, go check those policies, bestie 💜🧚‍♀️⭐