# diagrid diagnose endpoints

Check DNS, TLS mode, ALPN and certificates of the control plane hostnames

### Description

Check every control plane hostname from this machine: DNS, a TCP connection, a TLS
handshake offering ALPN h2, and the certificate presented.

TLS passthrough hostnames (sentry., catalyst-cloud.) must negotiate h2, and sentry. must
present Sentry's SPIFFE certificate. TLS-terminated hostnames must present a certificate
covering them, and api. and tunnel-upstream. must accept a WebSocket upgrade.

With --domain, the hostnames and their TLS mode are read from the Contour HTTPProxies in
the current kube context. Without cluster access, list them with --passthrough-host and
\--tls-host instead.

Prints one line per hostname and exits non-zero if any check fails.

```
diagrid diagnose endpoints [flags]
```

### Examples

```
  # Check the hostnames of a self-hosted control plane, read from the cluster
  diagrid diagnose endpoints --domain example.com

  # Without cluster access
  diagrid diagnose endpoints --passthrough-host sentry.example.com --passthrough-host catalyst-cloud.example.com --tls-host api.example.com
```

### Options

```
      --domain string                  Control plane domain; checks every HTTPProxy fqdn under it in the current kube context
  -h, --help                           help for endpoints
      --passthrough-host stringArray   A TLS passthrough (gRPC) hostname[:port] to check instead of reading the cluster; repeatable
      --port int                       Port the hostnames are served on (default 443)
      --tls-host stringArray           A TLS-terminated hostname[:port] to check instead of reading the cluster; repeatable
```

### SEE ALSO

- [diagrid diagnose](./diagnose.md)	 - Collect Catalyst diagnostics from your Kubernetes cluster