istio/istio · error

rootca-compare requires 2 pods as an argument

Error message

rootca-compare requires 2 pods as an argument

What it means

Thrown by the Args validator of `istioctl proxy-config rootca-compare`: the command needs exactly two pod references (`[pod/]<name>[.<namespace>]`) to compare their ROOTCA certificates. Any other argument count prints usage and returns this error before the command runs.

Source

Thrown at istioctl/pkg/proxyconfig/proxyconfig.go:1251

	secretConfigCmd.PersistentFlags().StringVarP(&configDumpFile, "file", "f", "",
		"Envoy config dump JSON file")
	return secretConfigCmd
}

func rootCACompareConfigCmd(ctx cli.Context) *cobra.Command {
	var podName1, podName2, podNamespace1, podNamespace2 string

	rootCACompareConfigCmd := &cobra.Command{
		Use:   "rootca-compare [pod/]<name-1>[.<namespace-1>] [pod/]<name-2>[.<namespace-2>]",
		Short: "Compare ROOTCA values for the two given pods",
		Long:  `Compare ROOTCA values for given 2 pods to check the connectivity between them.`,
		Example: `  # Compare ROOTCA values for given 2 pods to check the connectivity between them.
  istioctl proxy-config rootca-compare <pod-name-1[.namespace]> <pod-name-2[.namespace]>`,
		Aliases: []string{"rc"},
		Args: func(cmd *cobra.Command, args []string) error {
			if len(args) != 2 {
				cmd.Println(cmd.UsageString())
				return fmt.Errorf("rootca-compare requires 2 pods as an argument")
			}
			return nil
		},
		RunE: func(c *cobra.Command, args []string) error {
			kubeClient, err := ctx.CLIClient()
			if err != nil {
				return err
			}

			var rootCAPod1, rootCAPod2 []byte
			if len(args) == 2 {
				if podName1, podNamespace1, err = getPodName(ctx, args[0]); err != nil {
					return err
				}
				rootCAPod1, err = extractRootCA(kubeClient, podName1, podNamespace1, c.OutOrStdout())
				if err != nil {
					return err
				}

View on GitHub (pinned to 8dc789c5cf)

Solutions

1. Pass exactly two pod references: `istioctl proxy-config rootca-compare pod-1.ns pod-2.ns`.
2. Quote script-supplied arguments so empty strings fail visibly at quoting time rather than as a missing arg.

Example fix

# before
istioctl proxy-config rootca-compare mypod-1

# after
istioctl proxy-config rootca-compare mypod-1.default mypod-2.default

if [ "$#" -ne 2 ]; then echo 'rootca-compare needs exactly 2 pods' >&2; exit 2; fi
istioctl proxy-config rootca-compare "$1" "$2"

When it happens

Trigger: `istioctl proxy-config rootca-compare` with 0, 1, or 3+ positional arguments.

Common situations: Forgetting the second pod; passing a deployment/ selector form the command does not accept; a shell variable that expands empty.

Related errors

• bootstrap requires pod name or --file parameter
• secret requires pod name or --file parameter
• ecds requires pod name or --file parameter
• Both [%s.%s] and [%s.%s] have the non identical ROOTCA, theo
• error: you must specify resources by --filename. Example res

AI-assisted analysis of istio/istio@8dc789c5cf (2026-08-15). Data as JSON: /api/errors/0274827e33782f9a. Report an issue: GitHub.