Install the meshctl CLI

Use the Gloo command line interface (CLI) tool, meshctl, to set up Gloo Platform, register clusters, describe your Gloo resources, and more. You can also review other CLI tools that you commonly interact with while using Gloo.

Quick installation

Install the latest version of meshctl. Make sure to add meshctl to your PATH (see macOS, or Linux for specific instructions).

macOS X Ventura 13.0 (meshctl 2.2.0 and 2.2.1 only)

When you use Gloo Mesh 2.2.0 or 2.2.1 on macOS X Ventura 13.0, UPX-compressed amd64 and x86_64 executables do not work and result in a segmentation fault error.

For example, when you attempt to run a command such as meshctl check server on MacOS X Ventura, the command returns the following error message:

[1] 2931 segmentation fault meshctl check server

To fix this issue, you have two options:

  1. Download version 2.2.0 or 2.2.1 of the meshctl CLI, and add it to your PATH system variable.

    export GLOO_MESH_VERSION=v2.2.1
    export PATH=$HOME/.gloo-mesh/bin:$PATH
  2. Unpack the binary for meshctl using UPX v4.0.0.

    git clone
    cd upx
    git submodule update --init
    git checkout -b v4.0.0 tags/v4.0.0
    ./build/release/upx -d ~/.gloo-mesh/bin/meshctl
  3. Verify that you can run meshctl commands and check the client version matches the version that you installed.

    meshctl version

    Example output:

          "client": {
            "version": "2.2.4"

Install a specific version of the CLI

You can pass a variable on the command line to download a specific version of meshctl. The installation script uses the version and automatically detects your operating system to download the binary files from a public Google storage bucket, For example, if you install the latest version on a macOS workstation, the binary file is downloaded from

  1. From the Changelog, find the release version that you want to install.

  2. Install the meshctl CLI, setting the Gloo version to install.

    curl -sL | GLOO_MESH_VERSION=v2.2.4 sh -
  3. Add meshctl on your PATH system variable for global access on the command line. The steps vary depending on your operating system. The following example is for macOS. For more information, see macOS, or Linux.

    export PATH=$HOME/.gloo-mesh/bin:$PATH
    echo $PATH

    Example output:

  4. Verify that you can run meshctl commands and check the client version matches the version that you installed.

    meshctl version

    Example output:

          "client": {
            "version": "2.2.4"

On macOS, you might see the following warning: “meshctl” cannot be opened because it is from an unidentified developer. In the Finder app, navigate to the ~/.gloo-mesh/binmeshctl executable file, right-click the file, click Open, and confirm that you want to open the file. For more information, try searching the warning and following a guide.

Good job! You now have the version of meshctl that you want installed. Next, install Gloo in your clusters.

Do you have multiple cluster environments that require different versions of Gloo, Istio, and Kubernetes? Consider downloading each meshctl, istioctl, and kubectl version binary file to a separate directory. Then, you can set up an alias in your local command line interface profile to point to the binary file directory that matches the version of the cluster environment that you want to work with.

Upgrade the CLI

To upgrade, re-install the CLI. You can install the latest or a specific version. Make sure that your meshctl and Gloo versions match.

Upgrading the meshctl CLI does not upgrade the Gloo version that you run in your clusters.

Uninstall the CLI

To uninstall meshctl, you can delete the executable file from your system, such as on macOS in the following example.

rm ~/.gloo-mesh/bin/meshctl

Skew policy

Use the same version of the meshctl CLI as the Gloo version that is installed in your clusters.

Configuration file

When you run certain meshctl commands (like meshctl check or meshctl debug report), the commands attempt to read a configuration file located inside the home directory (e.g. $HOME/.gloo-mesh/meshctl-config.yaml on Linux). This configuration file contains information about your management and workload clusters. For example, if cluster-1 serves as the management cluster and both cluster-1 and cluster-2 are registered as workload clusters, meshctl-config.yaml might look like the following:

apiVersion: v1
  cluster-1: # data plane cluster
    kubeConfig: <home_directory>/.kube/config
    kubeContext: kind-cluster-1
    namespace: gloo-mesh
  cluster-2: # data plane cluster
    kubeConfig: <home_directory>/.kube/config
    kubeContext: kind-cluster-2
    namespace: gloo-mesh
  managementPlane: # management cluster
    kubeConfig: <home_directory>/.kube/config
    kubeContext: kind-cluster-1
    namespace: gloo-mesh

Some meshctl commands (like meshctl install) will make changes to the configuration automatically. You can also configure the meshctl-config.yaml file by using the following command, which opens an interactive prompt.

meshctl cluster configure

You can configure this file non-interactively by using the --disable-prompt flag.

meshctl cluster configure --disable-prompt --cluster-name managementPlane --kubeconfig <home_directory>/.kube/config --kubecontext kind-cluster-1

Additionally, you can override the default config file location when you run meshctl commands (for either writing or reading the config file) with the --config flag. For example,

meshctl install --config /path/to/file/meshctl-config.yaml [remaining arguments...]

Reference documentation

For more information about each meshctl command, see the CLI documentation or run the help flag for a command.

meshctl cluster --help

Other command line tools

As you use Gloo, you might need the following common cluster management command line tools on your local system.

CLI tool Description
Cloud provider CLI The CLI to interact with your preferred cloud provider, such as aws or gcloud. You might also have local cluster testing tools such as kind or k3d. gcloud.
istioctl The Istio command line tool. The guides in this documentation use Istio version 1.16.2. To check your installed version, run istioctl version.
jq Parse JSON output, such as from logs, to get values that can be used in subsequent commands, environment variables, or other contexts.
kubectl The Kubernetes command line tool. Download the kubectl version that is within one minor version of the Kubernetes clusters you plan to use with Gloo.

Make sure that you have the OpenSSL version of openssl, not LibreSSL. The openssl version must be at least 1.1.

  1. Check the openssl version that is installed. If you see LibreSSL in the output, continue to the next step.
    openssl version
  2. Install the OpenSSL version (not LibreSSL). For example, you might use Homebrew.
    brew install openssl
  3. Review the output of the OpenSSL installation for the path of the binary file. You can choose to export the binary to your path, or call the entire path whenever the following steps use an openssl command.
    • For example, openssl might be installed along the following path: /usr/local/opt/openssl@3/bin/
    • To run commands, you can append the path so that your terminal uses this installed version of OpenSSL, and not the default LibreSSL. /usr/local/opt/openssl@3/bin/openssl req -new -newkey rsa:4096 -x509 -sha256 -days 3650...