> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Installing Istio

> Guide to installing Istio on Kubernetes using istioctl, choosing installation profiles, deploying istiod and gateways, and verifying installation with kubectl and istioctl commands.

Now it's time to install Istio on the cluster.

There are three common approaches to install Istio:

* Use the `istioctl` command-line utility.
* Install via an Istio Operator.
* Install using a Helm chart.

![Three blue hexagons on a dark background labeled "Install with Istioctl", "Install Operator Install", and "Install with Helm", illustrating installation options. A small "© Copyright KodeKloud" appears in the lower-left.](https://mintcdn.com/kodekloud-c4ac6d9a/UK3oaG81L_yXeDcP/images/Kubernetes-and-Cloud-Native-Associate-KCNA/Container-Orchestration-Service-Mesh/Installing-Istio/istio-install-options-hexagons.jpg?fit=max\&auto=format\&n=UK3oaG81L_yXeDcP\&q=85\&s=8335c9e6c2c37905023afd4304ffe0b0)

For this lesson we'll use `istioctl` because it provides a simple, supported path for most clusters and exposes profile-based presets that simplify configuration.

Installation profiles

* Profiles are preset configurations optimized for different needs: demo, minimal, default, and production/perf.
* Use a profile to quickly pick a sensible set of components and telemetry settings for your environment.

| Profile | When to use |
| -: | - |
| `demo` | Local demos, workshops, or learning clusters (enables many telemetry and demo features). |
| `minimal` | Very small footprint for constrained clusters or when you only need the bare control plane. |
| `default` | General-purpose installation for typical production-like clusters. |
| `production` / `perf` | High-performance, production-focused installations with tuning for scale and performance. |

Install with istioctl
To install Istio with the demo profile run:

```bash theme={null}
istioctl install --set profile=demo -y
```

What happens on install

* `istioctl` deploys Istio into the `istio-system` namespace.
* Modern Istio consolidates many control-plane functions into a single Deployment called `istiod`. Historically separate components (Pilot, Citadel, Galley) are now unified under `istiod`.
* The installation also creates Ingress and Egress gateway Deployments and the corresponding Kubernetes Service objects.

Typical console output looks like:

```shell theme={null}
Detected that your cluster does not support third party JWT authentication. Falling back to less secure first party JWT. See https://istio.io/v1.9/docs/ops/best-practices/security/#configure-third-party-service-account-tokens for details.
Istio core installed
✓ Istiod installed
✓ Ingress gateways installed
✓ Egress gateways installed
✓ Installation complete
```

Istiod is the consolidated Istio control plane in recent releases. It replaces older components (Pilot, Citadel, Galley), reducing operational complexity and simplifying upgrades and configuration.

Verify the installation
After installation, verify Istio with the built-in verification command:

```bash theme={null}
istioctl verify-install
```

Additional quick checks you can run:

```bash theme={null}
# Check pods are running in the istio-system namespace
kubectl get pods -n istio-system

# List Istio services (including gateways)
kubectl get svc -n istio-system

# See CRDs installed by Istio
kubectl get crds | grep 'istio.io'
```

If you see warnings about JWT or token modes (third-party vs first-party), consult Istio's documentation and check your cluster's service account token configuration. Some clusters require extra configuration to support third-party tokens securely: [https://istio.io/latest/docs/ops/best-practices/security/#configure-third-party-service-account-tokens](https://istio.io/latest/docs/ops/best-practices/security/#configure-third-party-service-account-tokens)

Next steps

* Study Istio Gateways, VirtualServices, and DestinationRules to control ingress/egress and traffic behavior.
* Learn how sidecar injection (automatic or manual) attaches the Envoy proxy to your workloads.
* Review telemetry and security settings for production readiness.

Links and references

* Istio installation docs: [https://istio.io/latest/docs/setup/](https://istio.io/latest/docs/setup/)
* Istio security best practices: [https://istio.io/latest/docs/ops/best-practices/security/](https://istio.io/latest/docs/ops/best-practices/security/)

> **[Watch Video](https://learn.kodekloud.com/user/courses/kubernetes-and-cloud-native-associate-kcna/module/aeecda11-7f2e-48c5-9c54-5409f2d9d8d8/lesson/ccb9c0e6-50a7-4f36-9864-fe88cbd6ccf6)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.