Customizable Install with Helm

 5 minute read

Follow this flow to install and configure an Istio mesh for in-depth evaluation or production use.

This installation flow uses Helm charts that provide rich customization of the Istio control plane and of the sidecars for the Istio data plane. You can simply use helm template to generate the configuration and then install it using kubectl apply, or you can choose to use helm install and let Tiller completely manage the installation.

Using these instructions, you can select any one of Istio’s built-in configuration profiles and then further customize the configuration for your specific needs.

Prerequisites

  1. Download the Istio release.

  2. Perform any necessary platform-specific setup.

  3. Check the Requirements for Pods and Services.

  4. Install a Helm client with a version higher than 2.10.

Installation steps

The following commands use the Helm charts that are included in the Istio release image. Change directory to the root of the release and then choose one of the following two mutually exclusive options:

  1. To deploy Istio without using Tiller, follow the instructions for option 1.
  2. To use Helm’s Tiller pod to manage your Istio release, follow the instructions for option 2.

Option 1: Install with Helm via helm template

Choose this option if your cluster doesn’t have Tiller deployed and you don’t want to install it.

  1. Create a namespace for the istio-system components:

    $ kubectl create namespace istio-system

  2. Install all the Istio Custom Resource Definitions (CRDs) using kubectl apply, and wait a few seconds for the CRDs to be committed in the Kubernetes API-server:

    $ helm template install/kubernetes/helm/istio-init --name istio-init --namespace istio-system | kubectl apply -f -

  3. Verify that all 53 Istio CRDs were committed to the Kubernetes api-server using the following command:

    $ kubectl get crds | grep 'istio.io\|certmanager.k8s.io' | wc -l
53

  4. Select a configuration profile and then render and apply Istio’s core components corresponding to your chosen profile. The default profile is recommended for production deployments:

$ helm template install/kubernetes/helm/istio --name istio --namespace istio-system | kubectl apply -f -

Option 2: Install with Helm and Tiller via helm install

This option allows Helm and Tiller to manage the lifecycle of Istio.

  1. Make sure you have a service account with the cluster-admin role defined for Tiller. If not already defined, create one using following command:

    Zip
    $ kubectl apply -f @install/kubernetes/helm/helm-service-account.yaml@

  2. Install Tiller on your cluster with the service account:

    $ helm init --service-account tiller

  3. Install the istio-init chart to bootstrap all the Istio’s CRDs:

    $ helm install install/kubernetes/helm/istio-init --name istio-init --namespace istio-system

  4. Verify that all 53 Istio CRDs were committed to the Kubernetes api-server using the following command:

    $ kubectl get crds | grep 'istio.io\|certmanager.k8s.io' | wc -l
53

  5. Select a configuration profile and then install the istio chart corresponding to your chosen profile. The default profile is recommended for production deployments:

$ helm install install/kubernetes/helm/istio --name istio --namespace istio-system

Verifying the installation

  1. Referring to components table in configuration profiles, verify that the Kubernetes services corresponding to your selected profile have been deployed.

    $ kubectl get svc -n istio-system

  2. Ensure the corresponding Kubernetes pods are deployed and have a STATUS of Running:

    $ kubectl get pods -n istio-system

Uninstall

  • If you installed Istio using the helm template command, uninstall with these commands:
$ helm template install/kubernetes/helm/istio --name istio --namespace istio-system | kubectl delete -f -
$ kubectl delete namespace istio-system

  • If you installed Istio using Helm and Tiller, uninstall with these commands:

    $ helm delete --purge istio
$ helm delete --purge istio-init

Deleting CRDs and Istio Configuration

Istio, by design, expects Istio’s Custom Resources contained within CRDs to leak into the Kubernetes environment. CRDs contain the runtime configuration set by the operator. Because of this, we consider it better for operators to explicitly delete the runtime configuration data rather than unexpectedly lose it.

The istio-init chart contains all raw CRDs in the istio-init/files directory. You can simply delete the CRDs using kubectl. To permanently delete Istio’s CRDs and the entire Istio configuration, run:

$ kubectl delete -f install/kubernetes/helm/istio-init/files