k8s-istio-troubleshooting
Use when traffic fails in an Istio service mesh on Kubernetes: HTTP 403 "RBAC: access denied" from an AuthorizationPolicy, 503 "no healthy upstream" or "upstream connect error or disconnect/reset before headers", 404 from a route that does not match, "Connection reset by peer" after PeerAuthentication STRICT, sidecars that are not injected, VirtualService, DestinationRule, Gateway or ServiceEntry rules that do not apply, or istiod and proxy problems. Reads Envoy's access log and response flags (UH, NR, UF, URX, filter_chain_not_found), covers sidecar mode and ambient mode, and proposes fixes. Investigates with kubectl get, describe, events and logs, asks before reading Envoy's admin API inside a proxy. Reads first and asks before changing anything.
- License
- Apache-2.0
Pinned to revision ce7de97330d7, so it is the text this page describes rather than whatever the author pushed since.
Files
- skills/k8s-istio-troubleshooting/SKILL.md
- skills/k8s-istio-troubleshooting/.claude-plugin/plugin.json
- skills/k8s-istio-troubleshooting/references/routing.md
- skills/k8s-istio-troubleshooting/references/security-and-injection.md
Every link opens the file at its source, pinned to the revision this page describes.