Istio Collector
Parse Istio config from repository manifests: mTLS mode, authorization policies, JWT authentication, traffic routing (VirtualService, DestinationRule, Gateway), sidecars, telemetry, install profile, and sidecar-injection settings. Also records istioctl commands run in CI.
istio to your lunar-config.yml:uses: github://earthly/lunar-lib/collectors/istio@v1.0.5
What This Integration Collects
This integration includes 2 collectors that gather metadata from your systems.
istio
Parses all Istio custom resources in the repository and collects:
- mTLS posture from PeerAuthentication (STRICT / PERMISSIVE / DISABLE, and scope)
- AuthorizationPolicy actions and whether any rule grants blanket access
- RequestAuthentication (JWT) issuers
- Traffic management: VirtualService, DestinationRule, Gateway, ServiceEntry, Sidecar, EnvoyFilter
- Telemetry resources (tracing / metrics / access logging)
- Install profile from IstioOperator
- Sidecar injection: namespace labels (istio-injection / istio.io/rev) and
per-workload sidecar.istio.io/inject overrides
Each resource is validated with
istioctl analyze(offline, no cluster required).
cicd
Records every istioctl command executed in CI pipelines along with the istioctl client version. Writes command strings and version info to .mesh.cicd for audit trails and deployment traceability (istioctl install, istioctl analyze, istioctl upgrade, etc.).
How Collectors Fit into Lunar
Lunar watches your code and CI/CD systems to collect SDLC data from config files, test results, IaC, deployment configurations, security scans, and more.
Collectors are the automatic data-gathering layer. They extract structured metadata from your repositories and pipelines, feeding it into Lunar's centralized database where guardrails evaluate it to enforce your engineering standards.
Learn How Lunar Works →Example Collected Data
This collector writes structured metadata to the Component JSON. Here's an example of the data it produces:
{
"mesh": {
"source": {
"tool": "istio",
"version": "1.22.0",
"integration": "code"
},
"provider": "istio",
"resources": [
{"kind": "VirtualService", "name": "reviews", "namespace": "bookinfo", "path": "istio/reviews-vs.yaml", "valid": true},
{"kind": "PeerAuthentication", "name": "default", "namespace": "istio-system", "path": "istio/mtls.yaml", "valid": true}
],
"peer_authentications": [
{"name": "default", "namespace": "istio-system", "scope": "mesh", "mode": "STRICT", "path": "istio/mtls.yaml"}
],
"authorization_policies": [
{"name": "require-jwt", "namespace": "bookinfo", "action": "ALLOW", "rule_count": 1, "allows_all": false, "path": "istio/authz.yaml"}
],
"request_authentications": [
{"name": "jwt-example", "namespace": "bookinfo", "issuers": ["https://accounts.example.com"], "path": "istio/reqauth.yaml"}
],
"virtual_services": [
{"name": "reviews", "namespace": "bookinfo", "hosts": ["reviews"], "gateways": ["mesh"], "has_timeout": true, "has_retries": true, "has_fault_injection": false, "path": "istio/reviews-vs.yaml"}
],
"destination_rules": [
{"name": "reviews", "namespace": "bookinfo", "host": "reviews", "tls_mode": "ISTIO_MUTUAL", "has_outlier_detection": true, "has_connection_pool": true, "subsets": ["v1", "v2"], "path": "istio/reviews-dr.yaml"}
],
"gateways": [
{
"name": "bookinfo-gateway",
"namespace": "istio-system",
"servers": [
{"port": 443, "protocol": "HTTPS", "tls_mode": "SIMPLE", "https_redirect": false},
{"port": 80, "protocol": "HTTP", "https_redirect": true}
],
"path": "istio/gateway.yaml"
}
],
"service_entries": [
{"name": "external-api", "namespace": "bookinfo", "hosts": ["api.example.com"], "location": "MESH_EXTERNAL", "resolution": "DNS", "path": "istio/service-entry.yaml"}
],
"sidecars": [
{"name": "default", "namespace": "bookinfo", "restricts_egress": true, "egress_hosts": ["./*", "istio-system/*"], "path": "istio/sidecar.yaml"}
],
"envoy_filters": [
{"name": "custom-lua", "namespace": "bookinfo", "path": "istio/envoyfilter.yaml"}
],
"telemetry": [
{"name": "mesh-default", "namespace": "istio-system", "has_tracing": true, "has_metrics": true, "has_access_logging": true, "path": "istio/telemetry.yaml"}
],
"install": [
{"kind": "IstioOperator", "name": "control-plane", "namespace": "istio-system", "profile": "default", "path": "istio/istiooperator.yaml"}
],
"injection": {
"namespaces": [
{"name": "bookinfo", "enabled": true, "revision": null, "path": "istio/ns-bookinfo.yaml"}
],
"workload_overrides": [
{"kind": "Deployment", "name": "legacy-batch", "namespace": "bookinfo", "inject": false, "path": "deploy/legacy.yaml"}
]
},
"cicd": {
"cmds": [
{"cmd": "istioctl install -y", "version": "1.22.0"},
{"cmd": "istioctl analyze ./istio", "version": "1.22.0"}
],
"source": {"tool": "istioctl", "integration": "ci"}
},
"summary": {
"mtls_default_mode": "STRICT",
"mtls_strict": true,
"has_authorization_policies": true,
"all_gateways_tls": true,
"injection_enabled": true,
"uses_envoy_filters": true
}
}
}Configuration
Configure this collector in your lunar-config.yml.
Inputs
| Input | Required | Default | Description |
|---|---|---|---|
find_command
|
Optional |
find . -type f \( -name '*.yaml' -o -name '*.yml' \)
|
Command to find Istio manifest files (must output one file path per line) |
Documentation
View on GitHubIstio Collector
Parses Istio service-mesh configuration from repository manifests and tracks istioctl commands in CI.
Overview
This collector finds Istio custom resources committed to a repository and extracts the service-mesh posture: mTLS mode from PeerAuthentication, AuthorizationPolicy actions, JWT RequestAuthentication, and traffic resources (VirtualService, DestinationRule, Gateway, ServiceEntry, Sidecar). It also records sidecar-injection settings, Telemetry config, and the IstioOperator install profile, validating each resource offline with istioctl analyze. During CI it intercepts istioctl commands so mesh operations are recorded alongside the config. Data is written to the tool-agnostic .mesh category so guardrails work regardless of mesh implementation.
Collected Data
This collector writes to the following Component JSON paths:
| Path | Type | Description |
|---|---|---|
.mesh.source |
object | Tool metadata (tool name and version) |
.mesh.provider |
string | Mesh implementation (istio) |
.mesh.resources[] |
array | Every Istio resource found (kind, name, namespace, path, valid) |
.mesh.peer_authentications[] |
array | PeerAuthentication resources (scope, mode) |
.mesh.authorization_policies[] |
array | AuthorizationPolicy resources (action, rule_count, allows_all) |
.mesh.request_authentications[] |
array | RequestAuthentication (JWT) resources (issuers) |
.mesh.virtual_services[] |
array | VirtualService routing (hosts, has_timeout, has_retries) |
.mesh.destination_rules[] |
array | DestinationRule traffic policy (tls_mode, has_outlier_detection) |
.mesh.gateways[] |
array | Gateway servers (port, protocol, tls_mode, https_redirect) |
.mesh.service_entries[] |
array | ServiceEntry external hosts (location, resolution) |
.mesh.sidecars[] |
array | Sidecar egress scope (restricts_egress, egress_hosts) |
.mesh.envoy_filters[] |
array | EnvoyFilter resources (name, namespace) |
.mesh.telemetry[] |
array | Telemetry config (has_tracing, has_metrics, has_access_logging) |
.mesh.install[] |
array | IstioOperator install (profile) |
.mesh.injection |
object | Namespace injection labels + per-workload inject overrides |
.mesh.cicd |
object | istioctl CI command tracking (commands + client version) |
.mesh.summary |
object | Derived posture booleans (mtls_strict, all_gateways_tls, etc.) |
The collector reads config from the repository, not a live cluster (like the k8s collector); istioctl analyze runs with --use-kube=false so no cluster credentials are required. If no Istio resources are found it writes nothing, so downstream policies skip cleanly on non-mesh components.
Collectors
This integration provides the following collectors (use include to select a subset):
| Collector | Description |
|---|---|
istio |
Parses Istio custom resources (traffic, security, telemetry, install, injection) |
cicd |
Tracks all istioctl commands executed in CI pipelines (install, analyze, upgrade) |
Installation
Add to your lunar-config.yml:
collectors:
- uses: github://earthly/lunar-lib/collectors/istio@v1.0.0
on: ["domain:your-domain"] # Or use tags like [kubernetes, mesh]
# with:
# find_command: "find ./istio -name '*.yaml'" # Custom find command
Open Source
This collector is open source and available on GitHub. Contribute improvements, report issues, or fork it for your own use.
Common Use Cases
Explore guardrails that use data from Istio Collector.
Ready to Automate Your Standards?
See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 200+ built-in guardrails.
AI agent rules & prompt files
Post-mortem action items
Security & compliance policies
Testing & quality requirements