Skip to content
You are viewing the documentation for Solo Enterprise for Istio, formerly known as Gloo Mesh (OSS APIs).

For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

istioctl experimental jwks

Page as Markdown
Reference for the istioctl experimental jwks command.
istioctl experimental jwks 
Retrieves the JWKS representation of istiod’s CA certificate
Synopsis 
Retrieves the JWKS (JSON Web Key Set) representation of the CA certificate from Istiod.
This is useful for external systems that need to validate JWT tokens signed by Istio’s CA.
The output is in RFC 7517 JWKS format and includes x5c (certificate chain),
x5t (certificate thumbprint), and kid (key ID) fields.
THIS COMMAND IS UNDER ACTIVE DEVELOPMENT AND NOT READY FOR PRODUCTION USE.
istioctl experimental jwks [flags]
Examples 
  # Retrieve JWKS from in-cluster Istiod
  istioctl experimental jwks

  # Retrieve JWKS from a specific Istiod instance via XDS
  istioctl experimental jwks --xds-address istio.example.com:15012

  # Retrieve JWKS using certificate-based authentication
  istioctl experimental jwks --xds-address istio.example.com:15012 --cert-dir ~/.istio-certs
Options 
      --authority string     XDS Subject Alternative Name (for example istiod.istio-system.svc)
      --cert-dir string      XDS Endpoint certificate directory
      -h, --help             help for jwks
      --insecure             Skip server certificate and domain verification. (NOT SECURE!)
      --plaintext            Use plain-text HTTP/2 when connecting to server (no TLS).
      -r, --revision string  Control plane revision
      --timeout duration     The duration to wait before failing (default 30s)
      --xds-address string   XDS Endpoint
      --xds-label string     Istiod pod label selector
      --xds-port int         Istiod pod port (default 15012)
Options inherited from parent commands 
      --as string                  Username to impersonate for the operation. User could be a regular user or a service account in a namespace
      --as-group stringArray       Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
      --as-uid string              UID to impersonate for the operation.
      --context string             Kubernetes configuration context
      -i, --istioNamespace string  Istio system namespace (default "istio-system")
      --kubeclient-timeout string  Kubernetes client timeout as a time.Duration string, defaults to 15 seconds. (default "15s")
      -c, --kubeconfig string      Kubernetes configuration file
      -n, --namespace string       Kubernetes namespace
istioctl ecs add-serviceistioctl license