Install with Helm
This guide shows you how to install Istio in ambient mode with Helm. Aside from following the demo in Getting Started with Ambient Mode, we encourage the use of Helm to install Istio for use in ambient mode. Helm helps you manage components separately, and you can easily upgrade the components to the latest version.
Prerequisites
Check the Platform-Specific Prerequisites.
Install the Helm client, version 3.6 or above.
Configure the Helm repository:
$ helm repo add istio https://istio-release.storage.googleapis.com/charts $ helm repo update
See helm repo for command documentation.
Install the components
Install the base component
The base
chart contains the basic CRDs and cluster roles required to set up Istio.
This should be installed prior to any other Istio component.
$ helm install istio-base istio/base -n istio-system --create-namespace --wait
Install the CNI component
The cni
chart installs the Istio CNI plugin. It is responsible for detecting the pods that belong to the ambient mesh, and configuring the traffic redirection between pods and the ztunnel node proxy (which will be installed later).
$ helm install istio-cni istio/cni -n istio-system --set profile=ambient --wait
Install the Istiod component
The istiod
chart installs a revision of Istiod. Istiod is the control plane component that manages and
configures the proxies to route traffic within the mesh.
$ helm install istiod istio/istiod --namespace istio-system --set profile=ambient --wait
Install the ztunnel component
The ztunnel
chart installs the ztunnel DaemonSet, which is the node proxy component of Istio’s ambient mode.
$ helm install ztunnel istio/ztunnel -n istio-system --wait
Install an ingress gateway (optional)
To install an ingress gateway, run the command below:
$ helm install istio-ingress istio/gateway -n istio-ingress --create-namespace --wait
If your Kubernetes cluster doesn’t support the LoadBalancer
service type (type: LoadBalancer
) with a proper external IP assigned, run the above command without the --wait
parameter to avoid the infinite wait. See Installing Gateways for in-depth documentation on gateway installation.
Configuration
To view supported configuration options and documentation, run:
$ helm show values istio/istiod
Verify the installation
Verify the workload status
After installing all the components, you can check the Helm deployment status with:
$ helm ls -n istio-system
NAME NAMESPACE REVISION UPDATED STATUS CHART APP VERSION
istio-base istio-system 1 2024-04-17 22:14:45.964722028 +0000 UTC deployed base-1.22.3 1.22.3
istio-cni istio-system 1 2024-04-17 22:14:45.964722028 +0000 UTC deployed cni-1.22.3 1.22.3
istiod istio-system 1 2024-04-17 22:14:45.964722028 +0000 UTC deployed istiod-1.22.3 1.22.3
ztunnel istio-system 1 2024-04-17 22:14:45.964722028 +0000 UTC deployed ztunnel-1.22.3 1.22.3
You can check the status of the deployed pods with:
$ kubectl get pods -n istio-system
NAME READY STATUS RESTARTS AGE
istio-cni-node-g97z5 1/1 Running 0 10m
istiod-5f4c75464f-gskxf 1/1 Running 0 10m
ztunnel-c2z4s 1/1 Running 0 10m
Verify with the sample application
After installing ambient mode with Helm, you can follow the Deploy the sample application guide to deploy the sample application and ingress gateways, and then you can add your application to the ambient mesh.
Uninstall
You can uninstall Istio and its components by uninstalling the charts installed above.
List all the Istio charts installed in
istio-system
namespace:$ helm ls -n istio-system NAME NAMESPACE REVISION UPDATED STATUS CHART APP VERSION istio-base istio-system 1 2024-04-17 22:14:45.964722028 +0000 UTC deployed base-1.22.3 1.22.3 istio-cni istio-system 1 2024-04-17 22:14:45.964722028 +0000 UTC deployed cni-1.22.3 1.22.3 istiod istio-system 1 2024-04-17 22:14:45.964722028 +0000 UTC deployed istiod-1.22.3 1.22.3 ztunnel istio-system 1 2024-04-17 22:14:45.964722028 +0000 UTC deployed ztunnel-1.22.3 1.22.3
(Optional) Delete any Istio gateway chart installations:
$ helm delete istio-ingress -n istio-ingress $ kubectl delete namespace istio-ingress
Delete the Istio CNI chart:
$ helm delete istio-cni -n istio-system
Delete the Istio ztunnel chart:
$ helm delete ztunnel -n istio-system
Delete the Istio discovery chart:
$ helm delete istiod -n istio-system
Delete the Istio base chart:
$ helm delete istio-base -n istio-system
Delete CRDs installed by Istio (optional)
$ kubectl get crd -oname | grep --color=never 'istio.io' | xargs kubectl delete
Delete the
istio-system
namespace:$ kubectl delete namespace istio-system