Installing Istio

Now it’s time to install Istio on the cluster. There are three common approaches to install Istio:

Use the istioctl command-line utility.
Install via an Istio Operator.
Install using a Helm chart.

Three blue hexagons on a dark background labeled "Install with Istioctl", "Install Operator Install", and "Install with Helm", illustrating installation options. A small "© Copyright KodeKloud" appears in the lower-left.

For this lesson we’ll use istioctl because it provides a simple, supported path for most clusters and exposes profile-based presets that simplify configuration. Installation profiles

Profiles are preset configurations optimized for different needs: demo, minimal, default, and production/perf.
Use a profile to quickly pick a sensible set of components and telemetry settings for your environment.

Profile	When to use
`demo`	Local demos, workshops, or learning clusters (enables many telemetry and demo features).
`minimal`	Very small footprint for constrained clusters or when you only need the bare control plane.
`default`	General-purpose installation for typical production-like clusters.
`production` / `perf`	High-performance, production-focused installations with tuning for scale and performance.

Install with istioctl To install Istio with the demo profile run:

istioctl install --set profile=demo -y

What happens on install

istioctl deploys Istio into the istio-system namespace.
Modern Istio consolidates many control-plane functions into a single Deployment called istiod. Historically separate components (Pilot, Citadel, Galley) are now unified under istiod.
The installation also creates Ingress and Egress gateway Deployments and the corresponding Kubernetes Service objects.

Typical console output looks like:

Detected that your cluster does not support third party JWT authentication. Falling back to less secure first party JWT. See https://istio.io/v1.9/docs/ops/best-practices/security/#configure-third-party-service-account-tokens for details.
Istio core installed
✓ Istiod installed
✓ Ingress gateways installed
✓ Egress gateways installed
✓ Installation complete

Istiod is the consolidated Istio control plane in recent releases. It replaces older components (Pilot, Citadel, Galley), reducing operational complexity and simplifying upgrades and configuration.

Verify the installation After installation, verify Istio with the built-in verification command:

istioctl verify-install

Additional quick checks you can run:

# Check pods are running in the istio-system namespace
kubectl get pods -n istio-system

# List Istio services (including gateways)
kubectl get svc -n istio-system

# See CRDs installed by Istio
kubectl get crds | grep 'istio.io'

If you see warnings about JWT or token modes (third-party vs first-party), consult Istio’s documentation and check your cluster’s service account token configuration. Some clusters require extra configuration to support third-party tokens securely: https://istio.io/latest/docs/ops/best-practices/security/#configure-third-party-service-account-tokens

Next steps

Study Istio Gateways, VirtualServices, and DestinationRules to control ingress/egress and traffic behavior.
Learn how sidecar injection (automatic or manual) attaches the Envoy proxy to your workloads.
Review telemetry and security settings for production readiness.

Links and references

Istio installation docs: https://istio.io/latest/docs/setup/
Istio security best practices: https://istio.io/latest/docs/ops/best-practices/security/

Introduction

Kubernetes Fundamentals

Kubernetes Resources

Scheduling

Container Orchestration - Security

Container Orchestration - Networking

Container Orchestration - Service Mesh

Container Orchestration - Storage

Cloud Native Architecture

Cloud Native Observability

Cloud Native Application Delivery

Conclusion

Watch Video