Install with Helm

This guide shows you how to install Istio in ambient mode with Helm. Aside from following the demo in Getting Started with Ambient Mode⁵, we encourage the use of Helm to install Istio for use in ambient mode. Helm helps you manage components separately, and you can easily upgrade the components to the latest version.

Prerequisites

1. Check the Platform-Specific Prerequisites⁶.

2. Install the Helm client⁷, version 3.6 or above.

3. Configure the Helm repository:

   $ helm repo add istio https://istio-release.storage.googleapis.com/charts
   $ helm repo update
   

See helm repo⁸ for command documentation.

Install the components

Install the base component

The base chart contains the basic CRDs and cluster roles required to set up Istio. This should be installed prior to any other Istio component.

$ helm install istio-base istio/base -n istio-system --create-namespace --wait

Install the CNI component

The cni chart installs the Istio CNI plugin. It is responsible for detecting the pods that belong to the ambient mesh, and configuring the traffic redirection between pods and the ztunnel node proxy (which will be installed later).

$ helm install istio-cni istio/cni -n istio-system --set profile=ambient --wait

Install the Istiod component

The istiod chart installs a revision of Istiod. Istiod is the control plane component that manages and configures the proxies to route traffic within the mesh.

$ helm install istiod istio/istiod --namespace istio-system --set profile=ambient --wait

Install the ztunnel component

The ztunnel chart installs the ztunnel DaemonSet, which is the node proxy component of Istio’s ambient mode.

$ helm install ztunnel istio/ztunnel -n istio-system --wait

Install an ingress gateway (optional)

To install an ingress gateway, run the command below:

$ helm install istio-ingress istio/gateway -n istio-ingress --create-namespace --wait

If your Kubernetes cluster doesn’t support the LoadBalancer service type (type: LoadBalancer) with a proper external IP assigned, run the above command without the --wait parameter to avoid the infinite wait. See Installing Gateways⁹ for in-depth documentation on gateway installation.

Configuration

To view supported configuration options and documentation, run:

$ helm show values istio/istiod

Verify the installation

Verify the workload status

After installing all the components, you can check the Helm deployment status with:

$ helm ls -n istio-system
NAME            NAMESPACE       REVISION    UPDATED                                 STATUS      CHART           APP VERSION
istio-base      istio-system    1           2024-04-17 22:14:45.964722028 +0000 UTC deployed    base-1.22.3     1.22.3
istio-cni       istio-system    1           2024-04-17 22:14:45.964722028 +0000 UTC deployed    cni-1.22.3      1.22.3
istiod          istio-system    1           2024-04-17 22:14:45.964722028 +0000 UTC deployed    istiod-1.22.3   1.22.3
ztunnel         istio-system    1           2024-04-17 22:14:45.964722028 +0000 UTC deployed    ztunnel-1.22.3  1.22.3

You can check the status of the deployed pods with:

$ kubectl get pods -n istio-system
NAME                             READY   STATUS    RESTARTS   AGE
istio-cni-node-g97z5             1/1     Running   0          10m
istiod-5f4c75464f-gskxf          1/1     Running   0          10m
ztunnel-c2z4s                    1/1     Running   0          10m

Verify with the sample application

After installing ambient mode with Helm, you can follow the Deploy the sample application¹⁰ guide to deploy the sample application and ingress gateways, and then you can add your application to the ambient mesh.

Uninstall

You can uninstall Istio and its components by uninstalling the charts installed above.

1. List all the Istio charts installed in istio-system namespace:

   $ helm ls -n istio-system
   NAME            NAMESPACE       REVISION    UPDATED                                 STATUS      CHART           APP VERSION
   istio-base      istio-system    1           2024-04-17 22:14:45.964722028 +0000 UTC deployed    base-1.22.3     1.22.3
   istio-cni       istio-system    1           2024-04-17 22:14:45.964722028 +0000 UTC deployed    cni-1.22.3      1.22.3
   istiod          istio-system    1           2024-04-17 22:14:45.964722028 +0000 UTC deployed    istiod-1.22.3   1.22.3
   ztunnel         istio-system    1           2024-04-17 22:14:45.964722028 +0000 UTC deployed    ztunnel-1.22.3  1.22.3
   

2. (Optional) Delete any Istio gateway chart installations:

   $ helm delete istio-ingress -n istio-ingress
   $ kubectl delete namespace istio-ingress
   

3. Delete the Istio CNI chart:

   $ helm delete istio-cni -n istio-system
   

4. Delete the Istio ztunnel chart:

   $ helm delete ztunnel -n istio-system
   

5. Delete the Istio discovery chart:

   $ helm delete istiod -n istio-system
   

6. Delete the Istio base chart:

   $ helm delete istio-base -n istio-system
   

7. Delete CRDs installed by Istio (optional)

   $ kubectl get crd -oname | grep --color=never 'istio.io' | xargs kubectl delete
   

8. Delete the istio-system namespace:

   $ kubectl delete namespace istio-system