galley

Galley provides configuration management services for Istio.

FlagsShorthandDescription
—config <string>-cConfig file containing args (default )</td></tr><tr><td><code>--log_as_json</code></td><td></td><td>Whether to format output as JSON or in plain console-friendly format</td></tr><tr><td><code>--log_caller &lt;string&gt;</code></td><td></td><td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] (default)
—log_output_level <string>Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,… where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default default:info)
—log_rotate <string>The path for the optional rotating log file (default `)</td></tr><tr><td><code>--log_rotate_max_age &lt;int&gt;</code></td><td></td><td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit) (default30)</td></tr><tr><td><code>--log_rotate_max_backups &lt;int&gt;</code></td><td></td><td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit) (default1000)</td></tr><tr><td><code>--log_rotate_max_size &lt;int&gt;</code></td><td></td><td>The maximum size in megabytes of a log file beyond which the file is rotated (default104857600)</td></tr><tr><td><code>--log_stacktrace_level &lt;string&gt;</code></td><td></td><td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (defaultdefault:none)</td></tr><tr><td><code>--log_target &lt;stringArray&gt;</code></td><td></td><td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr (default[stdout]`)

galley probe

Check the liveness or readiness of a locally-running server

  1. galley probe [flags]
FlagsShorthandDescription
—config <string>-cConfig file containing args (default )</td></tr><tr><td><code>--interval &lt;duration&gt;</code></td><td></td><td>Duration used for checking the target file&#39;s last modified time. (default `0s`)</td></tr><tr><td><code>--log_as_json</code></td><td></td><td>Whether to format output as JSON or in plain console-friendly format</td></tr><tr><td><code>--log_caller &lt;string&gt;</code></td><td></td><td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] (default)
—log_output_level <string>Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,… where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default default:info)
—log_rotate <string>The path for the optional rotating log file (default )</td></tr><tr><td><code>--log_rotate_max_age &lt;int&gt;</code></td><td></td><td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit) (default `30`)</td></tr><tr><td><code>--log_rotate_max_backups &lt;int&gt;</code></td><td></td><td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit) (default `1000`)</td></tr><tr><td><code>--log_rotate_max_size &lt;int&gt;</code></td><td></td><td>The maximum size in megabytes of a log file beyond which the file is rotated (default `104857600`)</td></tr><tr><td><code>--log_stacktrace_level &lt;string&gt;</code></td><td></td><td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td></tr><tr><td><code>--log_target &lt;stringArray&gt;</code></td><td></td><td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr (default `[stdout]`)</td></tr><tr><td><code>--probe-path &lt;string&gt;</code></td><td></td><td>Path of the file for checking the availability. (default)

galley server

Starts Galley as a server

  1. galley server [flags]
FlagsShorthandDescription
—accessListFile <string>The access list yaml file that contains the allowed mTLS peer ids. (default /etc/config/accesslist.yaml)
—caCertFile <string>File containing the caBundle that signed the cert/key specified by —tlsCertFile and —tlsKeyFile. (default /etc/certs/root-cert.pem)
—config <string>-cConfig file containing args (default )</td></tr><tr><td><code>--configPath &lt;string&gt;</code></td><td></td><td>Istio config file path (default)
—ctrlz_address <string>The IP Address to listen on for the ControlZ introspection facility. Use '*' to indicate all addresses. (default localhost)
—ctrlz_port <uint16>The IP port to use for the ControlZ introspection facility (default 9876)
—deployment-name <string>Name of the deployment for the validation pod (default istio-galley)
—deployment-namespace <string>Namespace of the deployment for the validation pod (default istio-system)
—disableResourceReadyCheckDisable resource readiness checks. This allows Galley to start if not all resource types are supported
—domain <string>DNS domain suffix (default cluster.local)
—enable-reconcileWebhookConfigurationEnable reconciliation for webhook configuration.
—enable-serverRun galley server mode
—enable-validationRun galley validation mode
—enableAnalysisEnable config analysis service
—enableProfilingEnable profiling for Galley
—enableServiceDiscoveryEnable service discovery processing in Galley
—excludedResourceKinds <stringSlice>Comma-separated list of resource kinds that should not generate source events (default [Endpoints,Namespace,Node,Pod,Service])
—insecureUse insecure gRPC communication
—kubeconfig <string>Use a Kubernetes configuration file instead of in-cluster configuration (default )</td></tr><tr><td><code>--livenessProbeInterval &lt;duration&gt;</code></td><td></td><td>Interval of updating file for the Galley liveness probe. (default `2s`)</td></tr><tr><td><code>--livenessProbePath &lt;string&gt;</code></td><td></td><td>Path to the file for the Galley liveness probe. (default `/healthLiveness`)</td></tr><tr><td><code>--log_as_json</code></td><td></td><td>Whether to format output as JSON or in plain console-friendly format</td></tr><tr><td><code>--log_caller &lt;string&gt;</code></td><td></td><td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] (default)
—log_output_level <string>Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,… where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default default:info)
—log_rotate <string>The path for the optional rotating log file (default )</td></tr><tr><td><code>--log_rotate_max_age &lt;int&gt;</code></td><td></td><td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit) (default `30`)</td></tr><tr><td><code>--log_rotate_max_backups &lt;int&gt;</code></td><td></td><td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit) (default `1000`)</td></tr><tr><td><code>--log_rotate_max_size &lt;int&gt;</code></td><td></td><td>The maximum size in megabytes of a log file beyond which the file is rotated (default `104857600`)</td></tr><tr><td><code>--log_stacktrace_level &lt;string&gt;</code></td><td></td><td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td></tr><tr><td><code>--log_target &lt;stringArray&gt;</code></td><td></td><td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr (default `[stdout]`)</td></tr><tr><td><code>--meshConfigFile &lt;string&gt;</code></td><td></td><td>Path to the mesh config file (default `/etc/mesh-config/mesh`)</td></tr><tr><td><code>--monitoringPort &lt;uint&gt;</code></td><td></td><td>Port to use for exposing self-monitoring information (default `15014`)</td></tr><tr><td><code>--pprofPort &lt;uint&gt;</code></td><td></td><td>Port to use for exposing profiling (default `9094`)</td></tr><tr><td><code>--readinessProbeInterval &lt;duration&gt;</code></td><td></td><td>Interval of updating file for the Galley readiness probe. (default `2s`)</td></tr><tr><td><code>--readinessProbePath &lt;string&gt;</code></td><td></td><td>Path to the file for the Galley readiness probe. (default `/healthReadiness`)</td></tr><tr><td><code>--resyncPeriod &lt;duration&gt;</code></td><td></td><td>Resync period for rescanning Kubernetes resources (default `0s`)</td></tr><tr><td><code>--server-address &lt;string&gt;</code></td><td></td><td>Address to use for Galley&#39;s gRPC API, e.g. tcp://localhost:9092 or unix:///path/to/file (default `tcp://0.0.0.0:9901`)</td></tr><tr><td><code>--server-maxConcurrentStreams &lt;uint&gt;</code></td><td></td><td>Maximum number of outstanding RPCs per connection (default `1024`)</td></tr><tr><td><code>--server-maxReceivedMessageSize &lt;uint&gt;</code></td><td></td><td>Maximum size of individual gRPC messages (default `1048576`)</td></tr><tr><td><code>--service-name &lt;string&gt;</code></td><td></td><td>Name of the validation service running in the same namespace as the deployment (default `istio-galley`)</td></tr><tr><td><code>--sinkAddress &lt;string&gt;</code></td><td></td><td>Address of MCP Resource Sink server for Galley to connect to. Ex: &#39;foo.com:1234&#39; (default)
—sinkAuthMode <string>Name of authentication plugin to use for connection to sink server. (default )</td></tr><tr><td><code>--sinkMeta &lt;stringSlice&gt;</code></td><td></td><td>Comma-separated list of key=values to attach as metadata to outgoing sink connections. Ex: &#39;key=value,key2=value2&#39; (default `[]`)</td></tr><tr><td><code>--tlsCertFile &lt;string&gt;</code></td><td></td><td>File containing the x509 Certificate for HTTPS. (default `/etc/certs/cert-chain.pem`)</td></tr><tr><td><code>--tlsKeyFile &lt;string&gt;</code></td><td></td><td>File containing the x509 private key matching --tlsCertFile. (default `/etc/certs/key.pem`)</td></tr><tr><td><code>--useOldProcessor</code></td><td></td><td>Use the old processing pipeline for config processing</td></tr><tr><td><code>--validation-port &lt;uint&gt;</code></td><td></td><td>HTTPS port of the validation service. (default `9443`)</td></tr><tr><td><code>--validation-webhook-config-file &lt;string&gt;</code></td><td></td><td>File that contains k8s validatingwebhookconfiguration yaml. Required if enable-validation is true. (default)
—validation.tls.caCertificates <string>File containing the caBundle that signed the cert/key specified by —validation.tls.clientCertificate and —validation.tls.privateKey. (default )</td></tr><tr><td><code>--validation.tls.clientCertificate &lt;string&gt;</code></td><td></td><td>File containing the x509 Certificate for HTTPS validation. (default)
—validation.tls.privateKey <string>File containing the x509 private key matching —validation.tls.clientCertificate. (default `)</td></tr><tr><td><code>--watchConfigFiles</code></td><td></td><td>Enable the Fsnotify for watching config source files on the disk and implicit signaling on a config change. Explicit signaling will still be enabled</td></tr><tr><td><code>--webhook-name &lt;string&gt;</code></td><td></td><td>Name of the k8s validatingwebhookconfiguration (defaultistio-galley`)

Accepts deep config files, like:

  1. general:
  2. introspection:
  3. address: --ctrlz_address
  4. port: --ctrlz_port
  5. kubeconfig: --kubeconfig
  6. processing:
  7. domainsuffix: --domain
  8. server:
  9. address: --server-address
  10. auth:
  11. insecure: --insecure
  12. enable: --enable-server
  13. validation:
  14. deploymentname: --deployment-name
  15. deploymentnamespace: --deployment-namespace
  16. enable: --enable-validation
  17. servicename: --service-name
  18. tls:
  19. caCertificates: --validation.tls.caCertificates
  20. clientCertificate: --validation.tls.clientCertificate
  21. privateKey: --validation.tls.privateKey
  22. webhookconfigfile: --validation-webhook-config-file
  23. webhookname: --webhook-name
  24. webhookport: --validation-port

galley version

Prints out build version information

  1. galley version [flags]
FlagsShorthandDescription
—config <string>-cConfig file containing args (default )</td></tr><tr><td><code>--log_as_json</code></td><td></td><td>Whether to format output as JSON or in plain console-friendly format</td></tr><tr><td><code>--log_caller &lt;string&gt;</code></td><td></td><td>Comma-separated list of scopes for which to include caller information, scopes can be any of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] (default)
—log_output_level <string>Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>,… where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default default:info)
—log_rotate <string>The path for the optional rotating log file (default )</td></tr><tr><td><code>--log_rotate_max_age &lt;int&gt;</code></td><td></td><td>The maximum age in days of a log file beyond which the file is rotated (0 indicates no limit) (default `30`)</td></tr><tr><td><code>--log_rotate_max_backups &lt;int&gt;</code></td><td></td><td>The maximum number of log file backups to keep before older files are deleted (0 indicates no limit) (default `1000`)</td></tr><tr><td><code>--log_rotate_max_size &lt;int&gt;</code></td><td></td><td>The maximum size in megabytes of a log file beyond which the file is rotated (default `104857600`)</td></tr><tr><td><code>--log_stacktrace_level &lt;string&gt;</code></td><td></td><td>Comma-separated minimum per-scope logging level at which stack traces are captured, in the form of &lt;scope&gt;:&lt;level&gt;,&lt;scope:level&gt;,... where scope can be one of [all, analysis, attributes, conversions, default, grpcAdapter, kube, kube-converter, mcp, meshconfig, model, processing, rbac, resource, runtime, server, source, validation] and level can be one of [debug, info, warn, error, fatal, none] (default `default:none`)</td></tr><tr><td><code>--log_target &lt;stringArray&gt;</code></td><td></td><td>The set of paths where to output the log. This can be any path as well as the special values stdout and stderr (default `[stdout]`)</td></tr><tr><td><code>--output &lt;string&gt;</code></td><td><code>-o</code></td><td>One of &#39;yaml&#39; or &#39;json&#39;. (default)
—short-sUse —short=false to generate full version information

Environment variables

These environment variables affect the behavior of the galley command.

Variable NameTypeDefault ValueDescription
AUTHZ_FAILURE_LOG_BURST_SIZEInteger1
AUTHZ_FAILURE_LOG_FREQTime Duration1m0s

Exported metrics

Metric NameTypeDescription
galley_runtime_processor_event_span_duration_millisecondsDistributionThe duration between each incoming event
galley_runtime_processor_events_processed_totalCountThe number of events that have been processed
galley_runtime_processor_snapshot_events_totalDistributionThe number of events per snapshot
galley_runtime_processor_snapshot_lifetime_duration_millisecondsDistributionThe duration of each snapshot
galley_runtime_processor_snapshots_published_totalCountThe number of snapshots that have been published
galley_runtime_state_type_instances_totalLastValueThe number of type instances per type URL
galley_runtime_strategy_on_change_totalCountThe number of times the strategy's onChange has been called
galley_runtime_strategy_timer_max_time_reached_totalCountThe number of times the max time has been reached
galley_runtime_strategy_timer_quiesce_reached_totalCountThe number of times a quiesce has been reached
galley_runtime_strategy_timer_resets_totalCountThe number of times the timer has been reset
galley_source_kube_dynamic_converter_failure_totalCountThe number of times a dynamnic kubernetes source failed converting a resources
galley_source_kube_dynamic_converter_success_totalCountThe number of times a dynamic kubernetes source successfully converted a resource
galley_source_kube_event_error_totalCountThe number of times a kubernetes source encountered errored while handling an event
galley_source_kube_event_success_totalCountThe number of times a kubernetes source successfully handled an event
galley_validation_cert_key_update_errorsCountGalley validation webhook certificate updates errors
galley_validation_cert_key_updatesCountGalley validation webhook certificate updates
galley_validation_config_loadCountk8s webhook configuration (re)loads
galley_validation_config_load_errorCountk8s webhook configuration (re)load error
galley_validation_config_update_errorCountk8s webhook configuration update error
galley_validation_config_updatesCountk8s webhook configuration updates
galley_validation_failedCountResource validation failed
galley_validation_http_errorCountResource validation http serve errors
galley_validation_passedCountResource is valid
istio_buildLastValueIstio component build info
istio_mcp_clients_totalLastValueThe number of streams currently connected.
istio_mcp_message_sizes_bytesDistributionSize of messages received from clients.
istio_mcp_reconnectionsSumThe number of times the sink has reconnected.
istio_mcp_recv_failures_totalSumThe number of recv failures in the source.
istio_mcp_request_acks_totalSumThe number of request acks received by the source.
istio_mcp_request_nacks_totalSumThe number of request nacks received by the source.
istio_mcp_send_failures_totalSumThe number of send failures in the source.