{"record":{"id":"0274827e33782f9a","repo":"istio/istio","slug":"rootca-compare-requires-2-pods-as-an-argument","errorCode":null,"errorMessage":"rootca-compare requires 2 pods as an argument","messagePattern":"rootca-compare requires 2 pods as an argument","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"istioctl/pkg/proxyconfig/proxyconfig.go","lineNumber":1251,"sourceCode":"\tsecretConfigCmd.PersistentFlags().StringVarP(&configDumpFile, \"file\", \"f\", \"\",\n\t\t\"Envoy config dump JSON file\")\n\treturn secretConfigCmd\n}\n\nfunc rootCACompareConfigCmd(ctx cli.Context) *cobra.Command {\n\tvar podName1, podName2, podNamespace1, podNamespace2 string\n\n\trootCACompareConfigCmd := &cobra.Command{\n\t\tUse:   \"rootca-compare [pod/]<name-1>[.<namespace-1>] [pod/]<name-2>[.<namespace-2>]\",\n\t\tShort: \"Compare ROOTCA values for the two given pods\",\n\t\tLong:  `Compare ROOTCA values for given 2 pods to check the connectivity between them.`,\n\t\tExample: `  # Compare ROOTCA values for given 2 pods to check the connectivity between them.\n  istioctl proxy-config rootca-compare <pod-name-1[.namespace]> <pod-name-2[.namespace]>`,\n\t\tAliases: []string{\"rc\"},\n\t\tArgs: func(cmd *cobra.Command, args []string) error {\n\t\t\tif len(args) != 2 {\n\t\t\t\tcmd.Println(cmd.UsageString())\n\t\t\t\treturn fmt.Errorf(\"rootca-compare requires 2 pods as an argument\")\n\t\t\t}\n\t\t\treturn nil\n\t\t},\n\t\tRunE: func(c *cobra.Command, args []string) error {\n\t\t\tkubeClient, err := ctx.CLIClient()\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\tvar rootCAPod1, rootCAPod2 []byte\n\t\t\tif len(args) == 2 {\n\t\t\t\tif podName1, podNamespace1, err = getPodName(ctx, args[0]); err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\t\t\t\trootCAPod1, err = extractRootCA(kubeClient, podName1, podNamespace1, c.OutOrStdout())\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}","sourceCodeStart":1233,"sourceCodeEnd":1269,"githubUrl":"https://github.com/istio/istio/blob/8dc789c5cf17517c64e3c36cb3288230f149dfae/istioctl/pkg/proxyconfig/proxyconfig.go#L1233-L1269","documentation":"Thrown by the Args validator of `istioctl proxy-config rootca-compare`: the command needs exactly two pod references (`[pod/]<name>[.<namespace>]`) to compare their ROOTCA certificates. Any other argument count prints usage and returns this error before the command runs.","triggerScenarios":"`istioctl proxy-config rootca-compare` with 0, 1, or 3+ positional arguments.","commonSituations":"Forgetting the second pod; passing a deployment/ selector form the command does not accept; a shell variable that expands empty.","solutions":["Pass exactly two pod references: `istioctl proxy-config rootca-compare pod-1.ns pod-2.ns`.","Quote script-supplied arguments so empty strings fail visibly at quoting time rather than as a missing arg."],"exampleFix":"# before\nistioctl proxy-config rootca-compare mypod-1\n\n# after\nistioctl proxy-config rootca-compare mypod-1.default mypod-2.default","handlingStrategy":"validation","validationCode":"if [ \"$#\" -ne 2 ]; then echo 'rootca-compare needs exactly 2 pods' >&2; exit 2; fi\nistioctl proxy-config rootca-compare \"$1\" \"$2\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["The command takes two POD names only — no deployment/ or selector forms.","Quote script arguments to surface empty expansions early."],"tags":["istioctl","cli-usage","arguments","certificates"],"backgroundTag":null,"analyzedSha":"8dc789c5cf17517c64e3c36cb3288230f149dfae","analyzedAt":"2026-08-15T15:16:55.434Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}