diagrid diagnose endpoints

Check DNS, TLS mode, ALPN and certificates of the control plane hostnames

Description

Check every control plane hostname from this machine: DNS, a TCP connection, a TLS handshake offering ALPN h2, and the certificate presented.

TLS passthrough hostnames (sentry., catalyst-cloud.) must negotiate h2, and sentry. must present Sentry's SPIFFE certificate. TLS-terminated hostnames must present a certificate covering them, and api. and tunnel-upstream. must accept a WebSocket upgrade.

With --domain, the hostnames and their TLS mode are read from the Contour HTTPProxies in the current kube context. Without cluster access, list them with --passthrough-host and --tls-host instead.

Prints one line per hostname and exits non-zero if any check fails.

diagrid diagnose endpoints [flags]

Examples

  # Check the hostnames of a self-hosted control plane, read from the cluster
  diagrid diagnose endpoints --domain example.com

  # Without cluster access
  diagrid diagnose endpoints --passthrough-host sentry.example.com --passthrough-host catalyst-cloud.example.com --tls-host api.example.com

Options

      --domain string                  Control plane domain; checks every HTTPProxy fqdn under it in the current kube context
  -h, --help                           help for endpoints
      --passthrough-host stringArray   A TLS passthrough (gRPC) hostname[:port] to check instead of reading the cluster; repeatable
      --port int                       Port the hostnames are served on (default 443)
      --tls-host stringArray           A TLS-terminated hostname[:port] to check instead of reading the cluster; repeatable

SEE ALSO

• diagrid diagnose - Collect Catalyst diagnostics from your Kubernetes cluster