galley

galley

Galley provides configuration management services for Istio.

Flags	Shorthand	Description
`—config <string>`	`-c`	Config file containing args (default `)</td></tr><tr><td><code>--log_as_json</code></td><td></td><td>Whether to format output as JSON or in plain console-friendly format</td></tr><tr><td><code>--log_caller <string></code></td><td></td><td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] (default`)
`—log_output_level <string>`		Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,… where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`)
`—log_rotate <string>`		The path for the optional rotating log file (default `)</td></tr><tr><td><code>--log_rotate_max_age <int></code></td><td></td><td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit) (default30`)</td></tr><tr><td><code>--log_rotate_max_backups <int></code></td><td></td><td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit) (default`1000`)</td></tr><tr><td><code>--log_rotate_max_size <int></code></td><td></td><td>The maximum size in megabytes of a log file beyond which the file is rotated (default`104857600)</td></tr><tr><td><code>--log_stacktrace_level <string></code></td><td></td><td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (defaultdefault:none`)</td></tr><tr><td><code>--log_target <stringArray></code></td><td></td><td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr (default`[stdout]`)

galley probe

Check the liveness or readiness of a locally-running server

galley probe [flags]

Flags	Shorthand	Description
`—config <string>`	`-c`	Config file containing args (default )</td></tr><tr><td><code>--interval <duration></code></td><td></td><td>Duration used for checking the target file's last modified time. (default `0s`)</td></tr><tr><td><code>--log_as_json</code></td><td></td><td>Whether to format output as JSON or in plain console-friendly format</td></tr><tr><td><code>--log_caller <string></code></td><td></td><td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] (default)
`—log_output_level <string>`		Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,… where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`)
`—log_rotate <string>`		The path for the optional rotating log file (default )</td></tr><tr><td><code>--log_rotate_max_age <int></code></td><td></td><td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit) (default `30`)</td></tr><tr><td><code>--log_rotate_max_backups <int></code></td><td></td><td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit) (default `1000`)</td></tr><tr><td><code>--log_rotate_max_size <int></code></td><td></td><td>The maximum size in megabytes of a log file beyond which the file is rotated (default `104857600`)</td></tr><tr><td><code>--log_stacktrace_level <string></code></td><td></td><td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td></tr><tr><td><code>--log_target <stringArray></code></td><td></td><td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr (default `[stdout]`)</td></tr><tr><td><code>--probe-path <string></code></td><td></td><td>Path of the file for checking the availability. (default)

galley server

Starts Galley as a server

galley server [flags]

Flags	Shorthand	Description
`—accessListFile <string>`		The access list yaml file that contains the allowd mTLS peer ids. (default `/etc/config/accesslist.yaml`)
`—caCertFile <string>`		File containing the caBundle that signed the cert/key specified by —tlsCertFile and —tlsKeyFile. (default `/etc/certs/root-cert.pem`)
`—config <string>`	`-c`	Config file containing args (default `)</td></tr><tr><td><code>--configPath <string></code></td><td></td><td>Istio config file path (default`)
`—ctrlz_address <string>`		The IP Address to listen on for the ControlZ introspection facility. Use '*' to indicate all addresses. (default `localhost`)
`—ctrlz_port <uint16>`		The IP port to use for the ControlZ introspection facility (default `9876`)
`—deployment-name <string>`		Name of the deployment for the validation pod (default `istio-galley`)
`—deployment-namespace <string>`		Namespace of the deployment for the validation pod (default `istio-system`)
`—disableResourceReadyCheck`		Disable resource readiness checks. This allows Galley to start if not all resource types are supported
`—domain <string>`		DNS domain suffix (default `cluster.local`)
`—enable-reconcileWebhookConfiguration`		Enable reconciliation for webhook configuration.
`—enable-server`		Run galley server mode
`—enable-validation`		Run galley validation mode
`—enableAnalysis`		Enable config analysis service
`—enableProfiling`		Enable profiling for Galley
`—enableServiceDiscovery`		Enable service discovery processing in Galley
`—excludedResourceKinds <stringSlice>`		Comma-separated list of resource kinds that should not generate source events (default `[Endpoints,Namespace,Node,Pod,Service]`)
`—insecure`		Use insecure gRPC communication
`—kubeconfig <string>`		Use a Kubernetes configuration file instead of in-cluster configuration (default )</td></tr><tr><td><code>--livenessProbeInterval <duration></code></td><td></td><td>Interval of updating file for the Galley liveness probe. (default `2s`)</td></tr><tr><td><code>--livenessProbePath <string></code></td><td></td><td>Path to the file for the Galley liveness probe. (default `/healthLiveness`)</td></tr><tr><td><code>--log_as_json</code></td><td></td><td>Whether to format output as JSON or in plain console-friendly format</td></tr><tr><td><code>--log_caller <string></code></td><td></td><td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] (default)
`—log_output_level <string>`		Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,… where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`)
`—log_rotate <string>`		The path for the optional rotating log file (default )</td></tr><tr><td><code>--log_rotate_max_age <int></code></td><td></td><td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit) (default `30`)</td></tr><tr><td><code>--log_rotate_max_backups <int></code></td><td></td><td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit) (default `1000`)</td></tr><tr><td><code>--log_rotate_max_size <int></code></td><td></td><td>The maximum size in megabytes of a log file beyond which the file is rotated (default `104857600`)</td></tr><tr><td><code>--log_stacktrace_level <string></code></td><td></td><td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td></tr><tr><td><code>--log_target <stringArray></code></td><td></td><td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr (default `[stdout]`)</td></tr><tr><td><code>--meshConfigFile <string></code></td><td></td><td>Path to the mesh config file (default `/etc/mesh-config/mesh`)</td></tr><tr><td><code>--monitoringPort <uint></code></td><td></td><td>Port to use for exposing self-monitoring information (default `15014`)</td></tr><tr><td><code>--pprofPort <uint></code></td><td></td><td>Port to use for exposing profiling (default `9094`)</td></tr><tr><td><code>--readinessProbeInterval <duration></code></td><td></td><td>Interval of updating file for the Galley readiness probe. (default `2s`)</td></tr><tr><td><code>--readinessProbePath <string></code></td><td></td><td>Path to the file for the Galley readiness probe. (default `/healthReadiness`)</td></tr><tr><td><code>--resyncPeriod <duration></code></td><td></td><td>Resync period for rescanning Kubernetes resources (default `0s`)</td></tr><tr><td><code>--server-address <string></code></td><td></td><td>Address to use for Galley's gRPC API, e.g. tcp://localhost:9092 or unix:///path/to/file (default `tcp://0.0.0.0:9901`)</td></tr><tr><td><code>--server-maxConcurrentStreams <uint></code></td><td></td><td>Maximum number of outstanding RPCs per connection (default `1024`)</td></tr><tr><td><code>--server-maxReceivedMessageSize <uint></code></td><td></td><td>Maximum size of individual gRPC messages (default `1048576`)</td></tr><tr><td><code>--service-name <string></code></td><td></td><td>Name of the validation service running in the same namespace as the deployment (default `istio-galley`)</td></tr><tr><td><code>--sinkAddress <string></code></td><td></td><td>Address of MCP Resource Sink server for Galley to connect to. Ex: 'foo.com:1234' (default)
`—sinkAuthMode <string>`		Name of authentication plugin to use for connection to sink server. (default )</td></tr><tr><td><code>--sinkMeta <stringSlice></code></td><td></td><td>Comma-separated list of key=values to attach as metadata to outgoing sink connections. Ex: 'key=value,key2=value2' (default `[]`)</td></tr><tr><td><code>--tlsCertFile <string></code></td><td></td><td>File containing the x509 Certificate for HTTPS. (default `/etc/certs/cert-chain.pem`)</td></tr><tr><td><code>--tlsKeyFile <string></code></td><td></td><td>File containing the x509 private key matching --tlsCertFile. (default `/etc/certs/key.pem`)</td></tr><tr><td><code>--useOldProcessor</code></td><td></td><td>Use the old processing pipeline for config processing</td></tr><tr><td><code>--validation-port <uint></code></td><td></td><td>HTTPS port of the validation service. Must be 443 if service has more than one port (default `443`)</td></tr><tr><td><code>--validation-webhook-config-file <string></code></td><td></td><td>File that contains k8s validatingwebhookconfiguration yaml. Required if enable-validation is true. (default)
`—validation.tls.caCertificates <string>`		File containing the caBundle that signed the cert/key specified by —validation.tls.clientCertificate and —validation.tls.privateKey. (default `)</td></tr><tr><td><code>--validation.tls.clientCertificate <string></code></td><td></td><td>File containing the x509 Certificate for HTTPS validation. (default`)
`—validation.tls.privateKey <string>`		File containing the x509 private key matching —validation.tls.clientCertificate. (default `)</td></tr><tr><td><code>--webhook-name <string></code></td><td></td><td>Name of the k8s validatingwebhookconfiguration (defaultistio-galley`)

Accepts deep config files, like:

general:
  introspection:
    address: --ctrlz_address
    port: --ctrlz_port
  kubeconfig: --kubeconfig
processing:
  domainsuffix: --domain
  server:
    address: --server-address
    auth:
      insecure: --insecure
    enable: --enable-server
validation:
  deploymentname: --deployment-name
  deploymentnamespace: --deployment-namespace
  enable: --enable-validation
  servicename: --service-name
  tls:
    caCertificates: --validation.tls.caCertificates
    clientCertificate: --validation.tls.clientCertificate
    privateKey: --validation.tls.privateKey
  webhookconfigfile: --validation-webhook-config-file
  webhookname: --webhook-name
  webhookport: --validation-port

galley version

Prints out build version information

galley version [flags]

Flags	Shorthand	Description
`—config <string>`	`-c`	Config file containing args (default `)</td></tr><tr><td><code>--log_as_json</code></td><td></td><td>Whether to format output as JSON or in plain console-friendly format</td></tr><tr><td><code>--log_caller <string></code></td><td></td><td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] (default`)
`—log_output_level <string>`		Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,… where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:info`)
`—log_rotate <string>`		The path for the optional rotating log file (default )</td></tr><tr><td><code>--log_rotate_max_age <int></code></td><td></td><td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit) (default `30`)</td></tr><tr><td><code>--log_rotate_max_backups <int></code></td><td></td><td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit) (default `1000`)</td></tr><tr><td><code>--log_rotate_max_size <int></code></td><td></td><td>The maximum size in megabytes of a log file beyond which the file is rotated (default `104857600`)</td></tr><tr><td><code>--log_stacktrace_level <string></code></td><td></td><td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of <scope>:<level>,<scope:level>,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td></tr><tr><td><code>--log_target <stringArray></code></td><td></td><td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr (default `[stdout]`)</td></tr><tr><td><code>--output <string></code></td><td><code>-o</code></td><td>One of 'yaml' or 'json'. (default)
`—short`	`-s`	Use —short=false to generate full version information

Environment variables

These environment variables affect the behavior of the galley command.

Variable Name	Type	Default Value	Description
`AUTHZ_FAILURE_LOG_BURST_SIZE`	Integer	`1`
`AUTHZ_FAILURE_LOG_FREQ`	Time Duration	`1m0s`

Exported metrics

Metric Name	Type	Description
`galley_runtime_processor_event_span_duration_milliseconds`	`Distribution`	The duration between each incoming event
`galley_runtime_processor_events_processed_total`	`Count`	The number of events that have been processed
`galley_runtime_processor_snapshot_events_total`	`Distribution`	The number of events per snapshot
`galley_runtime_processor_snapshot_lifetime_duration_milliseconds`	`Distribution`	The duration of each snapshot
`galley_runtime_processor_snapshots_published_total`	`Count`	The number of snapshots that have been published
`galley_runtime_state_type_instances_total`	`LastValue`	The number of type instances per type URL
`galley_runtime_strategy_on_change_total`	`Count`	The number of times the strategy's onChange has been called
`galley_runtime_strategy_timer_max_time_reached_total`	`Count`	The number of times the max time has been reached
`galley_runtime_strategy_timer_quiesce_reached_total`	`Count`	The number of times a quiesce has been reached
`galley_runtime_strategy_timer_resets_total`	`Count`	The number of times the timer has been reset
`galley_source_kube_dynamic_converter_failure_total`	`Count`	The number of times a dynamnic kubernetes source failed converting a resources
`galley_source_kube_dynamic_converter_success_total`	`Count`	The number of times a dynamic kubernetes source successfully converted a resource
`galley_source_kube_event_error_total`	`Count`	The number of times a kubernetes source encountered errored while handling an event
`galley_source_kube_event_success_total`	`Count`	The number of times a kubernetes source successfully handled an event
`galley_validation_cert_key_update_errors`	`Count`	Galley validation webhook certificate updates errors
`galley_validation_cert_key_updates`	`Count`	Galley validation webhook certificate updates
`galley_validation_config_load`	`Count`	k8s webhook configuration (re)loads
`galley_validation_config_load_error`	`Count`	k8s webhook configuration (re)load error
`galley_validation_config_update_error`	`Count`	k8s webhook configuration update error
`galley_validation_config_updates`	`Count`	k8s webhook configuration updates
`galley_validation_failed`	`Count`	Resource validation failed
`galley_validation_http_error`	`Count`	Resource validation http serve errors
`galley_validation_passed`	`Count`	Resource is valid
`istio_build`	`LastValue`	Istio component build info
`istio_mcp_clients_total`	`LastValue`	The number of streams currently connected.
`istio_mcp_message_sizes_bytes`	`Distribution`	Size of messages received from clients.
`istio_mcp_reconnections`	`Sum`	The number of times the sink has reconnected.
`istio_mcp_recv_failures_total`	`Sum`	The number of recv failures in the source.
`istio_mcp_request_acks_total`	`Sum`	The number of request acks received by the source.
`istio_mcp_request_nacks_total`	`Sum`	The number of request nacks received by the source.
`istio_mcp_send_failures_total`	`Sum`	The number of send failures in the source.