Skip to main content
In this lesson we demonstrate how to install Cilium onto a Kubernetes cluster using Helm. The guide covers adding the Cilium Helm repository, inspecting and customizing chart values, enabling optional IPv6 support, installing the chart into the cluster, and verifying the installation and runtime status.
A presentation slide reading "Install Celium Helm" on the left with a large turquoise curved shape on the right containing the word "Demo." Small "© Copyright KodeKloud" text appears in the bottom-left.
Prerequisites
  • A Kubernetes cluster with sufficient privileges to install cluster-wide addons (RBAC/ClusterRole/ClusterRoleBinding privileges).
  • Helm installed locally (Helm v3+ recommended).
  • kubectl configured to target your cluster context.
RequirementPurposeExample / Link
Kubernetes clusterTarget platform for CiliumKubernetes docs
Helm (v3+)Package manager used to install the Cilium charthttps://helm.sh
kubectlInspect cluster resources and verify installationhttps://kubernetes.io/docs/tasks/tools/
If you need to install Helm locally, follow the official instructions at https://helm.sh. A common manual installation sequence: 
# Example: extract and move helm binary (adjust filename for the version you downloaded)
tar -zxvf helm-v3.0.0-linux-amd64.tar.gz
mv linux-amd64/helm /usr/local/bin/helm
helm help
Add the Cilium Helm repository Cilium publishes an official Helm chart. Add the repo and confirm it’s available to your Helm client: 
helm repo add cilium https://helm.cilium.io/
helm repo update
helm repo list
Expected output (example): 
NAME    URL
cilium  https://helm.cilium.io/
Inspect chart default values Before installing, download the chart’s default values so you can review and override settings as required. This helps you understand tunables such as datapath mode, encryption, IPv6, Hubble, etc. 
helm show values cilium/cilium > values.yaml
The generated values.yaml contains many configuration options with inline comments. Example excerpts: 
clustermeshApiserver:
  create: true
  name: clustermesh-apiserver
  automount: true
  annotations: {}
clustermeshcertgen:
  create: true
  name: clustermesh-apiserver-generate-certs

commonLabels: {}
upgradeCompatibility: null

debug:
  enabled: false
Enable IPv6 (optional) If you want IPv6 support, edit values.yaml and enable the top-level IPv6 block for the Cilium agent. There are several IPv6-related settings across the file — ensure you edit the top-level agent configuration (not only example snippets). 
ipv4:
  enabled: true
ipv6:
  enabled: true
Tip: Search values.yaml for the primary Cilium agent section (look for comments or headings around “Agent configuration”) to make sure you modify the intended top-level options. Install Cilium with Helm Install the chart into the kube-system namespace, supplying your modified values.yaml. Optionally pin a chart version with —version. 
helm install cilium cilium/cilium --namespace kube-system -f values.yaml --version 1.17.2
Example install output: 
NAME: cilium
LAST DEPLOYED: Tue Mar 25 21:26:25 2025
NAMESPACE: kube-system
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
You have successfully installed Cilium with Hubble.

Your release version is 1.17.2.

For any further help, visit https://docs.cilium.io/en/v1.17/gettinghelp
Verify the release Confirm the Helm release exists in the kube-system namespace: 
helm list -n kube-system
View the rendered Kubernetes manifests that Helm applied To inspect the fully rendered manifest for auditing or troubleshooting: 
helm get manifest cilium -n kube-system
Example snippet from the rendered manifest: 
app.kubernetes.io/part-of: cilium
app.kubernetes.io/name: cilium-operator
spec:
  replicas: 2
  selector:
    matchLabels:
      io.cilium/app: operator
      name: cilium-operator
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 50%
    type: RollingUpdate
  template:
    metadata:
      annotations:
        prometheus.io/port: "9963"
Check Cilium runtime status Verify pods, daemonsets, and deployments in kube-system to ensure agents and operator are running: 
kubectl -n kube-system get pods -l k8s-app=cilium
kubectl -n kube-system get daemonsets,deployments -l k8s-app=cilium
If you have the Cilium CLI installed, it provides a concise view of component health: 
cilium status
Typical status output shows agent and operator availability, Hubble status, Envoy proxy counts, and any health issues.
If you are deploying to a managed Kubernetes service (EKS, GKE, AKS), consult the Cilium documentation for platform-specific prerequisites and recommended settings (for example, node taints/labels, node groups, or specific annotations). These are documented in the Cilium installation guide: https://docs.cilium.io/en/v1.17/
Quick reference — common verification commands
CommandPurpose
kubectl -n kube-system get pods -l k8s-app=ciliumList Cilium pods and their status
kubectl -n kube-system get daemonsets,deploymentsCheck daemonsets & deployments in kube-system
helm list -n kube-systemConfirm Helm release presence and status
helm get manifest cilium -n kube-systemView rendered manifest applied by Helm
cilium statusHigh-level Cilium component health (if cilium CLI installed)
Wrapping up Summary of the Helm-based installation flow:
  1. Ensure Helm is installed and kubectl is configured for your cluster.
  2. Add and update the Cilium Helm repository.
  3. Inspect the chart defaults and adjust values.yaml for your needs (IPv6, datapath, Hubble, etc.).
  4. Install the chart into your target namespace with Helm.
  5. Verify the Helm release and inspect manifests; confirm runtime status with kubectl and cilium CLI.
For production deployments or cloud-managed clusters, follow the platform-specific guidance in the Cilium docs: https://docs.cilium.io/en/v1.17/

Watch Video