CLI reference

outprobe [OPTIONS] <command>

Running outprobe with no command prints help.

Commands

Command	Purpose
outprobe init	Scaffold .outprobe.yaml and optionally editable manifests.
outprobe up	Apply the relay and routing, connect workers, and run until Ctrl-C.
outprobe down	Delete labeled routing objects first, then relay Deployment and Service.
outprobe status	List labeled outprobe objects in the resolved namespace.
outprobe routes	Discover routes to the target and suggest an ingress: block.

Use outprobe <command> --help for generated help.

Shared cluster options

up, down, status, and routes share:

Flag	Environment	Meaning
-n, --namespace	NS	Target namespace. Config fallback, then default.
-c, --context	KCONTEXT	Kube context. Config fallback, then current kubectl context.
--config	OUTPROBE_CONFIG	Config path. Default .outprobe.yaml.

outprobe init

outprobe init [--config PATH] [--manifests] [--force]

Option	Meaning
--config	File to scaffold; default .outprobe.yaml. Also reads OUTPROBE_CONFIG.
--manifests	Write editable Kubernetes templates to .outprobe/.
-f, --force	Overwrite existing files. Without this, existing files are skipped.

The default invocation creates only one file. It references the hosted JSON Schema and includes a starter JWT email rule.

outprobe up

outprobe up [OPTIONS]

Flag	Environment	Config key	Fallback
-n, --namespace	NS	namespace	default
-c, --context	KCONTEXT	context	current context
--config	OUTPROBE_CONFIG	—	.outprobe.yaml
--target	TARGET	target	required
--target-port	TARGET_PORT	targetPort	8080
--image	RELAY_IMAGE	image	ghcr.io/flaticols/outprobe-relay:latest
--local-target	LOCAL_TARGET	localTarget	http://localhost:8080

Flags and environment values have equal top-layer behavior as parsed by the CLI; either overrides config. Request identity is not exposed as a flag or environment variable.

The built-in fallback currently tracks latest. For a reproducible cluster deployment, set image: ghcr.io/flaticols/outprobe-relay:v0.0.16 in .outprobe.yaml.

Examples:

# Config-driven
outprobe up

# Temporary target override
outprobe up --target checkout-v2

# Scriptable environment overrides
NS=dev TARGET=checkout LOCAL_TARGET=http://localhost:3000 outprobe up

# Alternate config and cluster
outprobe up --config .outprobe.staging.yaml --context staging

Startup order

up validates settings and egress, preflights inbound mode when needed, deploys the relay, waits up to 90 seconds for rollout, opens the port-forward, starts 32 workers and egress listeners, and finally applies routing.

It then blocks on SIGINT or SIGTERM. Teardown is registered before apply, so a partial startup failure also attempts cleanup.

Managed label

All managed objects use:

outprobe.dev/tool=outprobe

Cleanup and status select this label in the resolved namespace.

outprobe down

outprobe down [-n NAMESPACE] [-c CONTEXT] [--config PATH]

Deletion order:

1. Gateway API HTTPRoutes;
2. Istio EnvoyFilters;
3. Istio VirtualServices;
4. relay Deployment and Service.

Deletes use --wait=false, restoring routing without waiting for every object to finish terminating.

outprobe status

outprobe status [-n NAMESPACE] [-c CONTEXT] [--config PATH]

Runs a labeled kubectl get for Deployment, Service, VirtualService, EnvoyFilter, and HTTPRoute in the resolved namespace.

outprobe routes

outprobe routes [--target SERVICE] [-n NAMESPACE] [-c CONTEXT] [--config PATH]

The command performs cluster-wide, read-only listing of:

• Gateway API HTTPRoutes;
• Istio VirtualServices;
• Kubernetes Ingresses.

It finds backends matching the target Service and namespace. Matching HTTPRoutes are emitted as cloneFrom suggestions; VirtualServices and Ingresses are informational because outprobe does not clone them.

Discovery permissions are broader than normal up

routes uses kubectl get ... -A. If your account cannot list a resource cluster-wide, that resource type is omitted from the report. Normal interception remains namespace-scoped.

Configuration precedence examples

Given:

namespace: team-a
target: checkout
targetPort: 8080

this command uses namespace team-b, target checkout-v2, and port 8080:

NS=team-b outprobe up --target checkout-v2

Built-in defaults apply only after both CLI/env and config are empty.

Exit and recovery

A graceful Ctrl-C or SIGTERM triggers teardown. If the laptop loses power or the process is force-killed, cleanup cannot run. Recover with the same config/context:

outprobe status
outprobe down