Demo Installation with Helm

In this lesson we demonstrate how to install Cilium onto a Kubernetes cluster using Helm. The guide covers adding the Cilium Helm repository, inspecting and customizing chart values, enabling optional IPv6 support, installing the chart into the cluster, and verifying the installation and runtime status.

A presentation slide reading "Install Celium Helm" on the left with a large turquoise curved shape on the right containing the word "Demo." Small "© Copyright KodeKloud" text appears in the bottom-left.

Prerequisites

A Kubernetes cluster with sufficient privileges to install cluster-wide addons (RBAC/ClusterRole/ClusterRoleBinding privileges).
Helm installed locally (Helm v3+ recommended).
kubectl configured to target your cluster context.

Requirement	Purpose	Example / Link
Kubernetes cluster	Target platform for Cilium	Kubernetes docs
Helm (v3+)	Package manager used to install the Cilium chart	https://helm.sh
kubectl	Inspect cluster resources and verify installation	https://kubernetes.io/docs/tasks/tools/

If you need to install Helm locally, follow the official instructions at https://helm.sh. A common manual installation sequence:

# Example: extract and move helm binary (adjust filename for the version you downloaded)
tar -zxvf helm-v3.0.0-linux-amd64.tar.gz
mv linux-amd64/helm /usr/local/bin/helm
helm help

Add the Cilium Helm repository Cilium publishes an official Helm chart. Add the repo and confirm it’s available to your Helm client:

helm repo add cilium https://helm.cilium.io/
helm repo update
helm repo list

Expected output (example):

NAME    URL
cilium  https://helm.cilium.io/

Inspect chart default values Before installing, download the chart’s default values so you can review and override settings as required. This helps you understand tunables such as datapath mode, encryption, IPv6, Hubble, etc.

helm show values cilium/cilium > values.yaml

The generated values.yaml contains many configuration options with inline comments. Example excerpts:

clustermeshApiserver:
  create: true
  name: clustermesh-apiserver
  automount: true
  annotations: {}
clustermeshcertgen:
  create: true
  name: clustermesh-apiserver-generate-certs

commonLabels: {}
upgradeCompatibility: null

debug:
  enabled: false

Enable IPv6 (optional) If you want IPv6 support, edit values.yaml and enable the top-level IPv6 block for the Cilium agent. There are several IPv6-related settings across the file — ensure you edit the top-level agent configuration (not only example snippets).

ipv4:
  enabled: true
ipv6:
  enabled: true

Tip: Search values.yaml for the primary Cilium agent section (look for comments or headings around “Agent configuration”) to make sure you modify the intended top-level options. Install Cilium with Helm Install the chart into the kube-system namespace, supplying your modified values.yaml. Optionally pin a chart version with —version.

helm install cilium cilium/cilium --namespace kube-system -f values.yaml --version 1.17.2

Example install output:

NAME: cilium
LAST DEPLOYED: Tue Mar 25 21:26:25 2025
NAMESPACE: kube-system
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
You have successfully installed Cilium with Hubble.

Your release version is 1.17.2.

For any further help, visit https://docs.cilium.io/en/v1.17/gettinghelp

Verify the release Confirm the Helm release exists in the kube-system namespace:

helm list -n kube-system

View the rendered Kubernetes manifests that Helm applied To inspect the fully rendered manifest for auditing or troubleshooting:

helm get manifest cilium -n kube-system

Example snippet from the rendered manifest:

app.kubernetes.io/part-of: cilium
app.kubernetes.io/name: cilium-operator
spec:
  replicas: 2
  selector:
    matchLabels:
      io.cilium/app: operator
      name: cilium-operator
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 50%
    type: RollingUpdate
  template:
    metadata:
      annotations:
        prometheus.io/port: "9963"

Check Cilium runtime status Verify pods, daemonsets, and deployments in kube-system to ensure agents and operator are running:

kubectl -n kube-system get pods -l k8s-app=cilium
kubectl -n kube-system get daemonsets,deployments -l k8s-app=cilium

If you have the Cilium CLI installed, it provides a concise view of component health:

cilium status

Typical status output shows agent and operator availability, Hubble status, Envoy proxy counts, and any health issues.

If you are deploying to a managed Kubernetes service (EKS, GKE, AKS), consult the Cilium documentation for platform-specific prerequisites and recommended settings (for example, node taints/labels, node groups, or specific annotations). These are documented in the Cilium installation guide: https://docs.cilium.io/en/v1.17/

Quick reference — common verification commands

Command	Purpose
kubectl -n kube-system get pods -l k8s-app=cilium	List Cilium pods and their status
kubectl -n kube-system get daemonsets,deployments	Check daemonsets & deployments in kube-system
helm list -n kube-system	Confirm Helm release presence and status
helm get manifest cilium -n kube-system	View rendered manifest applied by Helm
cilium status	High-level Cilium component health (if cilium CLI installed)

Wrapping up Summary of the Helm-based installation flow:

Ensure Helm is installed and kubectl is configured for your cluster.
Add and update the Cilium Helm repository.
Inspect the chart defaults and adjust values.yaml for your needs (IPv6, datapath, Hubble, etc.).
Install the chart into your target namespace with Helm.
Verify the Helm release and inspect manifests; confirm runtime status with kubectl and cilium CLI.

For production deployments or cloud-managed clusters, follow the platform-specific guidance in the Cilium docs: https://docs.cilium.io/en/v1.17/

Introduction

Cilium Overview

Installing & Configuring Cilium

Exploring Cilium

Network Policy

Service Mesh

Cluster Mesh

Observability

BGP & External Networking

Optimization

Demo Installation with Helm

Watch Video