Install with Helm

Install ambient mesh for production using Helm, with separate control plane and data plane components for independent upgrade management.

Helm is the recommended method for production ambient mesh installations. Other methods such as istioctl install use the same Helm charts under the hood.

Solo Enterprise for Istio

Solo.io provides enhanced builds of Istio for free community use, including features not yet available in upstream releases. For more information, see Solo builds of Istio.

Before you begin

Review the system and app requirements for any platform-specific configuration required for your Kubernetes environment.

Install

The control plane and data plane are packaged and installed separately to support independent upgrades. The ambient data plane components, ztunnel and waypoint proxies, are also upgraded independently.

Install the Kubernetes Gateway API CRDs, if not already present.

kubectl get crd gateways.gateway.networking.k8s.io &> /dev/null || \
  { kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.0/standard-install.yaml }

Add the Istio Helm chart repository.

helm repo add istio https://istio-release.storage.googleapis.com/charts
helm repo update istio

Install the base chart, which contains the CRDs and cluster roles required by Istio. This must be installed before any other Istio component.
```
helm install istio-base istio/base -n istio-system --create-namespace --wait
```
Install istiod, the Istio control plane, which manages and configures proxies to route traffic within the mesh.
```
helm install istiod istio/istiod --namespace istio-system --set profile=ambient --wait
```
Install the cni chart, which detects pods enrolled in the ambient mesh and configures traffic redirection between pods and the ztunnel node proxy.
```
helm install istio-cni istio/cni -n istio-system --set profile=ambient --wait
```
Install ztunnel, the node proxy that handles secure overlay traffic for enrolled workloads.
```
helm install ztunnel istio/ztunnel -n istio-system --wait
```

Verify the installation

Check the status of the Helm releases.

helm ls -n istio-system

Example output:

NAME            NAMESPACE       REVISION    UPDATED                                 STATUS      CHART           APP VERSION
istio-base      istio-system    1           2024-10-27 22:14:45.964722028 +0000 UTC deployed    base-1.30.0     1.30.0
istio-cni       istio-system    1           2024-10-27 22:14:45.964722028 +0000 UTC deployed    cni-1.30.0      1.30.0
istiod          istio-system    1           2024-10-27 22:14:45.964722028 +0000 UTC deployed    istiod-1.30.0   1.30.0
ztunnel         istio-system    1           2024-10-27 22:14:45.964722028 +0000 UTC deployed    ztunnel-1.30.0  1.30.0

Check the status of the Istio pods.

kubectl get pods -n istio-system

Example output:

NAME                             READY   STATUS    RESTARTS   AGE
istio-cni-node-g97z5             1/1     Running   0          10m
istiod-5f4c75464f-gskxf          1/1     Running   0          10m
ztunnel-c2z4s                    1/1     Running   0          10m

System requirements Add workloads to the mesh