Installation with Helm

Quick start instructions for the setup and configuration of Istio using Helm. This is the recommended install method for installing Istio to your production environment as it offers rich customization to the Istio control plane and the sidecars for the Istio data plane.

Warning Installation of Istio prior to version 0.8.0 with Helm is unstable and not recommended.

Prerequisites

Download the latest Istio release.
Install the Helm client.

Option 1: Install with Helm via `helm template`

Render Istio's core components to a Kubernetes manifest called istio.yaml:

With automatic sidecar injection (requires Kubernetes >=1.9.0):

$ helm template @install/kubernetes/helm/istio@ --name istio --namespace istio-system > $HOME/istio.yaml

Without the sidecar injection webhook:

$ helm template @install/kubernetes/helm/istio@ --name istio --namespace istio-system --set sidecarInjectorWebhook.enabled=false > $HOME/istio.yaml

Install the components via the manifest:

$ kubectl create namespace istio-system
$ kubectl create -f $HOME/istio.yaml

Option 2: Install with Helm and Tiller via `helm install`

This option allows Helm and Tiller to manage the lifecycle of Istio.

Warning Upgrading Istio using Helm has not been fully tested.

If a service account has not already been installed for Tiller, install one:
```
$ kubectl create -f @install/kubernetes/helm/helm-service-account.yaml@
```
Install Tiller on your cluster with the service account:
```
$ helm init --service-account tiller
```

Install Istio:

With automatic sidecar injection (requires Kubernetes >=1.9.0):

$ helm install @install/kubernetes/helm/istio@ --name istio --namespace istio-system

Without the sidecar injection webhook:

$ helm install @install/kubernetes/helm/istio@ --name istio --namespace istio-system --set sidecarInjectorWebhook.enabled=false

Customization with Helm

The Helm chart ships with reasonable defaults. There may be circumstances in which defaults require overrides. To override Helm values, use --set key=value argument during the helm install command. Multiple --set operations may be used in the same Helm operation.

Helm charts expose configuration options which are currently in alpha. The currently exposed options are explained in the following table:

Parameter	Description	Values	Default
`global.hub`	Specifies the HUB for most images used by Istio	registry/namespace	`docker.io/istionightly`
`global.tag`	Specifies the TAG for most images used by Istio	valid image tag	`circleci-nightly`
`global.proxy.image`	Specifies the proxy image name	valid proxy name	`proxyv2`
`global.proxy.includeIPRanges`	Specifies the IP ranges for which outbound traffic is redirected to Envoy	List of IP ranges in CIDR notation separated by the escaped comma `\,` . Use `*` to redirect all outbound traffic to Envoy	`*`
`global.imagePullPolicy`	Specifies the image pull policy	valid image pull policy	`IfNotPresent`
`global.controlPlaneSecurityEnabled`	Specifies whether control plane mTLS is enabled	true/false	`false`
`global.mtls.enabled`	Specifies whether mTLS is enabled by default between services	true/false	`false`
`global.mtls.mtlsExcludedServices`	List of FQDNs to exclude from mTLS	a list of FQDNs	`- kubernetes.default.svc.cluster.local`
`global.rbacEnabled`	Specifies whether to create Istio RBAC rules or not	true/false	`true`
`global.refreshInterval`	Specifies the mesh discovery refresh interval	integer followed by s	`10s`
`global.arch.amd64`	Specifies the scheduling policy for `amd64` architectures	0 = never, 1 = least preferred, 2 = no preference, 3 = most preferred	`2`
`global.arch.s390x`	Specifies the scheduling policy for `s390x` architectures	0 = never, 1 = least preferred, 2 = no preference, 3 = most preferred	`2`
`global.arch.ppc64le`	Specifies the scheduling policy for `ppc64le` architectures	0 = never, 1 = least preferred, 2 = no preference, 3 = most preferred	`2`
`galley.enabled`	Specifies whether Galley should be installed for server-side config validation. Requires k8s >= 1.9	true/false	`false`

The Helm chart also offers significant customization options per individual service. Customize these per-service options at your own risk. The per-service options are exposed via the values.yaml file.

What's next

See the sample Bookinfo application.

Uninstall

For option 1, uninstall using kubectl:
```
$ kubectl delete -f $HOME/istio.yaml
```
For option 2, uninstall using Helm:
```
$ helm delete --purge istio
```

If your helm version is less than 2.9.0, then you need to manually cleanup extra job resource before redeploy new version of Istio chart:

```command
$ kubectl -n istio-system delete job --all
```