How to run Istiod in debug mode outside of k8s

 Debugging a kubernetes controller is a bit hard by keeping adding fmt.Println statement in your code. Using VS code to run the controller main.go in debug mode outside of the kubernetes cluster seems to be a doable solution.

This article will talk about how to do this using istiod as an example.

1. Load your Istio project into VS code.

2. Setup a debug profile (configuration) as follows:

{

"name": "Controller",

"type": "go",

"request": "launch",

"mode": "debug",

"env": {

"REVISION": "default",

"JWT_POLICY": "third-party-jwt",

"PILOT_CERT_PROVIDER": "istiod",

"POD_NAME": "tongli",

"POD_NAMESPACE": "istio-system",

"SERVICE_ACCOUNT": "",

"KUBECONFIG": "/home/ubuntu/.kube/config",

"ENABLE_LEGACY_FSGROUP_INJECTION": "false",

"ROOT_CA_DIR": "/tmp/work",

"PILOT_TRACE_SAMPLING": "1",

"PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_OUTBOUND": "true",

"PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_INBOUND": "true",

"ISTIOD_ADDR": "istiod.istio-system.svc:15012",

"PILOT_ENABLE_ANALYSIS": "false",

"CLUSTER_ID": "tongli"

},

"args": [

"discovery",

"--monitoringAddr=:15014",

"--log_output_level=default:info",

"--domain=cluster.local",

"--keepaliveMaxServerConnectionAge=30m"

],

"program": "${workspaceFolder}/pilot/cmd/pilot-discovery/main.go"

},

3. Now create a kubernetes cluster and make sure that kube config file is in the right place, corresponding to some of the environment variables.

4. For Istiod to work, you will also need to setup variable like ROOT_CA_DIR to a directory which VS Code has access to.

5. Now create a namespace in the kubernetes cluster called istio-system, which Istiod will need to start up.

6. Set up few break points in your code that your controller will run. Then start debug by choose the Controller profile in VScode. If now you send some requests against your controller, then it should break at one of the break point.

There should be ca certs created before hand in multi cluster deployment case so that istiod wont create its own secrets. The best way probably is to create the istio-ca-secret in istio-system namespace (or whatever the namespace it runs in) before start up the debugging process.