Customize Istio Installation

You can customize Istio installations instead of relying on the default profile. Istio profiles (for example: demo, default, ambient, etc.) control which core components are enabled and which features are included by default.

The image depicts a table of Istio profiles and their core components, showing different profiles like default, demo, and others with checkmarks indicating their inclusion of specific components like "istio-egressgateway" and "ztunnel."

The istioctl profile dump command that produced a ready-to-edit IstioOperator manifest was removed. You now author an IstioOperator manifest yourself to customize an installation. If you need to find an option in the operator schema, consult the Istio Operator reference: https://istio.io/latest/docs/reference/config/installation-options/

Below are practical examples and a recommended workflow for customizing Istio with an IstioOperator manifest, patch overlays, resource overrides, and Helm alternatives.

Basic IstioOperator skeleton

Create an IstioOperator YAML to override defaults. This skeleton shows how to set image hub/tag and toggle core components and gateways:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  hub: docker.io/istio
  tag: 1.18.2
  components:
    base:
      enabled: true
    cni:
      enabled: false
    egressGateways:
      - enabled: false
        name: istio-egressgateway
    ingressGateways:
      - enabled: true
        name: istio-ingressgateway
    istiodRemote:
      enabled: false
    pilot:
      enabled: true

Quick one-off setting using istioctl:

istioctl install --set values.pilot.traceSampling=0.1

Disable istiod (Pilot) via IstioOperator

To disable the control plane component (historically called Pilot; functionality resides in istiod), set the component to disabled:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    pilot:
      enabled: false

Apply with:

istioctl install -f disable-pilot.yaml

Override Kubernetes resources (CPU, memory, HPA)

Override resource requests/limits and HPA settings for control-plane deployments (example shows pilot/istiod):

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    pilot:
      k8s:
        resources:
          requests:
            cpu: 1000m     # override from default 500m
            memory: 4096Mi # override from default 2048Mi
        hpaSpec:
          minReplicas: 2
          maxReplicas: 10

Apply the configuration:

istioctl install -f samples/operator/pilot-k8s.yaml

Patching generated manifests with overlays

Use k8s.overlays in the IstioOperator to patch generated Kubernetes resources. Overlays are useful for small targeted edits (changing args, ports, annotations, etc.):

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: empty
  hub: docker.io/istio
  tag: 1.1.6
  components:
    pilot:
      enabled: true
      namespace: istio-control
  k8s:
    overlays:
      - kind: Deployment
        name: istiod
        patches:
          # Example: change an arg from "30m" to "60m"
          - path: spec.template.spec.containers[name:discovery].args.[30m]
            value: "60m"
          # Example: change a containerPort value
          - path: spec.template.spec.containers[name:discovery].ports.[containerPort:8080].containerPort
            value: 9080

Generate the patched manifest to inspect changes:

istioctl manifest generate -f patch.yaml

A truncated example of the resulting Deployment shows patched values:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: istiod
spec:
  template:
    spec:
      containers:
      - name: discovery
        args:
        - --some-arg=60m        # patched from 30m
        ports:
        - containerPort: 9080   # patched from 8080

Revisions and meshConfig

You can set the revision field in the IstioOperator to manage control-plane revisions during upgrades and to enable side-by-side control plane installations:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: default
  hub: gcr.io/istio-testing
  tag: latest
  revision: 1-8-0
  meshConfig:
    accessLogFile: /dev/stdout
    enableTracing: true
  components:
    egressGateways:
      - name: istio-egressgateway
        enabled: true

The image is a screenshot from the Istio documentation, describing how to identify an Istio component using the IstioOperator API. It includes a table of component names and instructions for configuring settings.

Common exam-style changes (quick checklist)

Be familiar with the following modifications and how to express them in an IstioOperator or via istioctl:

Enable/disable a specific component (egress/ingress gateway)
Rename a gateway (change name:)
Install a gateway into a non-default namespace (namespace: under the gateway entry)
Change CPU/memory requests and limits for control-plane components
Set hub, tag, and revision for image sources and version control

Quick example — enable the egress gateway and change its name and namespace:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    base:
      enabled: true
    cni:
      enabled: false
    egressGateways:
      - enabled: true
        name: istio-egress
        namespace: istio-egress-ns
    ingressGateways:
      - enabled: true
        name: istio-ingressgateway
    istiodRemote:
      enabled: false
    pilot:
      enabled: true

Apply or upgrade with:

istioctl upgrade -f default.yaml

Quick reference table

Action	Example command or field
Install from IstioOperator file	`istioctl install -f <file>`
One-off set value with istioctl	`istioctl install --set values.pilot.traceSampling=0.1`
Generate patched manifest	`istioctl manifest generate -f patch.yaml`
Upgrade using IstioOperator	`istioctl upgrade -f <file>`
Uninstall (purge CRDs/data)	`istioctl uninstall --purge`
Helm show default values	`helm show values istio/istiod > istiod.yaml`

Helm-based customization

If you prefer Helm, inspect default values, edit a values file, and then install or upgrade the chart:

helm show values istio/base > istio_base.yaml
helm install istio-base istio/base -n istio-system -f istio_base.yaml

helm show values istio/istiod > istiod.yaml
helm install istiod istio/istiod -n istio-system -f istiod.yaml

helm show values istio/gateway > istio_gateway.yaml

After editing values files, apply changes with helm upgrade.

Be careful when running istioctl uninstall --purge. This removes Istio resources and CRDs and can destroy stored configuration and telemetry. Always back up important configuration before purging.

Upgrade and uninstall

To update an existing installation, edit your IstioOperator and run:

istioctl upgrade -f <file>

To uninstall:

# Istio operator uninstall (purge data and CRDs)
istioctl uninstall --purge

# Helm uninstall (example namespace)
helm uninstall istio-ingress -n istio-ingress

The Istio operator provides flexible control over which components and settings are installed. Practice by making small, incremental changes (resource overrides, enabling gateways, or applying overlays) in a local cluster to become comfortable with the workflow and exam-style scenarios.

Useful links and references

Istio Installation Options (Operator schema): https://istio.io/latest/docs/reference/config/installation-options/
Istioctl documentation: https://istio.io/latest/docs/ops/diagnostic-tools/istioctl/
Helm charts for Istio: https://github.com/istio/istio/tree/master/manifests/charts

Introduction

Installation & Configuration

Traffic Management

Securing Workloads

Troubleshooting

Conclusion

Customize Istio Installation

Basic IstioOperator skeleton

Disable istiod (Pilot) via IstioOperator

Override Kubernetes resources (CPU, memory, HPA)

Patching generated manifests with overlays

Revisions and meshConfig

Common exam-style changes (quick checklist)

Quick reference table

Helm-based customization

Upgrade and uninstall

Useful links and references

Watch Video

​Basic IstioOperator skeleton

​Disable istiod (Pilot) via IstioOperator

​Override Kubernetes resources (CPU, memory, HPA)

​Patching generated manifests with overlays

​Revisions and meshConfig

​Common exam-style changes (quick checklist)

​Quick reference table

​Helm-based customization

​Upgrade and uninstall

​Useful links and references

Watch Video

Basic IstioOperator skeleton

Disable istiod (Pilot) via IstioOperator

Override Kubernetes resources (CPU, memory, HPA)

Patching generated manifests with overlays

Revisions and meshConfig

Common exam-style changes (quick checklist)

Quick reference table

Helm-based customization

Upgrade and uninstall

Useful links and references