The admin interface is a small HTTP server inside the Arion process that answers questions about its live state — is it ready, what is it listening on, which upstreams are healthy, what configuration is active. Use it for health probes, Prometheus scraping and hands-on debugging.
Enable it
Add the admin block to the bootstrap. The address is the only supported field:
envoy_bootstrap:
admin:
address:
socket_address: { address: 127.0.0.1, port_value: 9901 }Without this block no admin server starts. It runs on the services runtime, separate from the proxy workers, so an admin query does not steal time from traffic.
The admin interface has no authentication and exposes configuration details;
/reset_counterseven mutates state. Bind it to127.0.0.1or a private management network and never expose the port publicly. Envoy'sallow_pathsrestriction is not supported, so there is no built-in way to limit which endpoints are reachable.
Endpoints
GET unless noted. Some endpoints exist only when the binary was built with the matching feature — /help always reflects what your build actually has.
| Path | Build feature | Description |
|---|---|---|
/ | — | HTML console linking every command. |
/help | — | Plain-text list of the endpoints compiled into this binary. |
/ready | — | 200 LIVE once the proxy runtimes are up; 503 before that. Use it as a readiness probe. |
/server_info | — | JSON: version (arion/x.y.z), state, uptime, concurrency, node id and cluster. |
/listeners | — | Active listeners, one name::address per line. |
/clusters | — | Envoy-style cluster status: per-endpoint health and, in a metrics build, connection/request counters. |
/certs | — | JSON summary of the certificates and CAs currently referenced by listeners and clusters. |
/memory | — | JSON allocator numbers: physical, heap_size, allocated. |
/config_dump | config-dump | JSON dump of the bootstrap plus the live listeners, routes and clusters. TLS private keys are redacted. |
/stats | metrics | All statistics in a plain-text canonical form. |
/stats/prometheus | prometheus | The same statistics in Prometheus exposition format — point your scraper here. |
/reset_counters (POST) | metrics | Zeroes all counters and returns OK. Handy while measuring by hand. |
Verify
curl -i http://127.0.0.1:9901/readyExpected: HTTP/1.1 200 OK with body LIVE. Then curl http://127.0.0.1:9901/help to see which optional endpoints your build includes.
Limits
- Only
admin.addresswith asocket_addressis supported;access_log,profile_path,socket_options,ignore_global_conn_limitandallow_pathsfrom Envoy's admin config are rejected at load. - There is no TLS and no authentication on the admin port — isolation is your responsibility.
/config_dump,/stats,/stats/prometheusand/reset_countersreturn 404 on binaries built without their feature.- Live config queries are answered by one proxy runtime with a five-second budget; on an extremely busy process a query can time out and return partial output.
The full request and response shapes are documented in the admin API reference.