istioctl verify-install: Confirm Istio Health
istioctl verify-install checks that the deployed Istio control plane matches the expected manifest and that its resources are healthy.
Right after istioctl install, verify-install gives you a pass/fail signal that the control plane rolled out cleanly, which is exactly what a deploy job wants to gate on.
What it does
istioctl verify-install compares the resources Istio should have created (from a profile or IstioOperator file) against what is actually in the cluster, and reports each as found or missing. Run without -f, it verifies the currently installed control plane is healthy.
Common usage
# verify the running control plane
istioctl verify-install
# verify against the manifest you installed from
istioctl verify-install -f istio-operator.yamlOptions
| Flag | What it does |
|---|---|
| -f <file> | Verify the cluster against this IstioOperator manifest |
| --revision <name> | Verify a specific control-plane revision |
In CI
Run verify-install as the last step of the install job; a non-zero exit means the rollout is incomplete and the pipeline should stop before it deploys workloads that depend on the mesh.
Common errors in CI
"Istio installation NOT verified" lists resources that are missing or not ready, for example "Deployment: istiod.istio-system not ready". That usually means an image pull failure or insufficient resources on the nodes. A mismatch against -f means the live install drifted from the manifest, often a manual kubectl edit.