Demo Customize Istio Installation

In this lesson you will use the Istio Operator (IstioOperator CR) to customize an Istio installation. The workflow covers:

Inspecting the cluster and current workloads
Creating a custom IstioOperator manifest (demo.yaml)
Validating and applying the manifest with istioctl
Verifying pods and resource overrides
Enabling automatic sidecar injection and redeploying Bookinfo

This approach is preferable to using --set flags because it centralizes configuration in a declarative manifest that the operator will reconcile.

Prerequisites

kubectl configured to your target cluster
istioctl on your PATH
A running Kubernetes cluster with some sample workloads (e.g., Bookinfo)

1) Inspect cluster state

Example: the cluster already has Bookinfo pods running:

kubectl get pods
NAME                              READY   STATUS    RESTARTS   AGE
details-v1-65599dcf88-qjhsw       1/1     Running   0          12m
productpage-v1-9487c29c5b-2k9mf   1/1     Running   0          12m
ratings-v1-59b99c644-7w272        1/1     Running   0          12m
reviews-v1-5985999584-gms7g       1/1     Running   0          12m
reviews-v1-86d6cc668-l2pvr        1/1     Running   0          12m
reviews-v1-db5fb5bd-bzxt4         1/1     Running   0          12m

Verify istioctl can talk to the cluster:

istioctl version
Istio is not present in the cluster: no running Istio pods in namespace "istio-system"
client version: 1.26.3

2) Create a minimal IstioOperator manifest

Create and edit demo.yaml:

touch demo.yaml
vim demo.yaml

A minimal manifest that selects the demo profile:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: demo

Validate the manifest:

istioctl validate -f demo.yaml
"demo.yaml" is valid

Install using the operator manifest:

istioctl install -f demo.yaml -y

Verify Istio system pods:

kubectl get pods -n istio-system
NAME                                      READY   STATUS    RESTARTS   AGE
istio-egressgateway-fbdbf94c6-j64m7      1/1     Running   0          20s
istio-ingressgateway-7f9cb54c46-lzfcv    1/1     Running   0          19s
istiod-6699bd67b9-swz6j                  1/1     Running   0          24s

Inspect an ingress gateway pod to view resource requests/limits and environment. Example excerpt from kubectl describe pod:

Limits:
  cpu: 2
  memory: 1Gi
Requests:
  cpu: 10m
  memory: 40Mi
Readiness: http-get http://:15021/healthz/ready delay=1s timeout=1s period=2s #success=1 #failure=30
Environment:
  PILOT_CERT_PROVIDER: istiod
  CA_ADDR: istiod.istio-system.svc:15012
  NODE_NAME: (v1:spec.nodeName)
  POD_NAME: istio-ingressgateway-7f9cb54c46-lzfcv (v1:metadata.name)
  POD_NAMESPACE: istio-system (v1:metadata.namespace)
  INSTANCE_IP: (v1:status.podIP)
  HOST_IP: (v1:status.hostIP)
Mounts:
  /etc/istio/config from config-volume (rw)
  ...

Kubernetes Deployments cannot be renamed. To change the name of a gateway deployment managed by the operator you must disable the old gateway and enable a new one with the desired name. The operator will delete and recreate the deployment.

3) Example: Customize gateways and resource overrides

To change gateway names (e.g., add -gateway) and reduce resource sizes, update demo.yaml. The operator will handle removing disabled resources and creating the newly named ones. Example IstioOperator manifest (add to or replace your demo.yaml as needed):

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: demo
  components:
    egressGateways:
      - enabled: false
        name: istio-egressgateway
        k8s:
          resources:
            requests:
              cpu: 10m
              memory: 40Mi
      - enabled: true
        name: istio-egress-gateway
        k8s:
          resources:
            requests:
              cpu: 20m
              memory: 40Mi
            limits:
              cpu: 40m
              memory: 80Mi
    ingressGateways:
      - enabled: false
        name: istio-ingressgateway
        k8s:
          resources:
            requests:
              cpu: 10m
              memory: 40Mi
      - enabled: true
        name: istio-ingress-gateway
        k8s:
          resources:
            requests:
              cpu: 20m
              memory: 40Mi
            limits:
              cpu: 40m
              memory: 80Mi
          service:
            ports:
              - name: status-port
                port: 15021
                targetPort: 15021
              - name: http2
                port: 80
                targetPort: 80
              - name: https
                port: 443
                targetPort: 8443
              - name: tcp
                port: 31400
                targetPort: 31400
              - name: tls
                port: 15443
                targetPort: 15443

Validate the updated manifest:

istioctl validate -f demo.yaml
"demo.yaml" is valid

Upgrade/reconcile the installation (confirm y when prompted):

istioctl upgrade -f demo.yaml
This will install the Istio 1.26.3 profile "demo" into the cluster. Proceed? (y/N) y
✓ Istio core installed
✓ Istiod installed
Processing resources for Egress gateways, Ingress gateways. Waiting for Deployment/istio-system/istio-egress-gateway, Deployment/istio-system/istio-ingress-gateway...

During rollout you will often see both old and new pods (old terminating, new running):

kubectl get pods -n istio-system
NAME                                       READY   STATUS        RESTARTS   AGE
istio-egress-gateway-7949ccd449-r6wcn     1/1     Running       0          24s
istio-egressgateway-fdbbf964c-j6dm7       0/1     Terminating   0          4m51s
istio-ingress-gateway-64bf9dfb-rn5jk      1/1     Running       0          24s
istio-ingressgateway-7f9cb54c46-lzfcv     0/1     Terminating   0          4m50s
istiod-6699bd67b-swz6j                    1/1     Running       0          4m55s

Verify resource overrides applied to the new ingress gateway:

Limits:
  cpu: 40m
  memory: 80Mi
Requests:
  cpu: 20m
  memory: 40Mi

The image shows a webpage from the Istio documentation, featuring sections on "ConfigMapKeySelector" and "ContainerResourceMetricSource" with corresponding tables detailing fields, types, and requirements. The page also includes a navigation menu on the right.

4) Enable automatic sidecar injection for your namespace

Check current namespaces and labels:

kubectl get ns --show-labels
NAME              STATUS    AGE    LABELS
default           Active    26m    kubernetes.io/metadata.name=default
istio-system      Active    11m    kubernetes.io/metadata.name=istio-system
kube-node-lease   Active    26m    kubernetes.io/metadata.name=kube-node-lease
kube-public       Active    26m    kubernetes.io/metadata.name=kube-public
kube-system       Active    26m    kubernetes.io/metadata.name=kube-system

Analyze the namespace (suggests enabling injection if not enabled):

istioctl analyze -n default
Info [IST102] (Namespace default) This namespace is not enabled for Istio injection. Run 'kubectl label namespace default istio-injection=enabled' to enable it, or 'kubectl label namespace default istio-injection=disabled' to explicitly mark it as not needing injection.

Enable injection:

kubectl label namespace default istio-injection=enabled

5) Redeploy Bookinfo so pods get sidecar-injected

Delete any existing Bookinfo resources, then re-apply the sample manifest so the pods are recreated with the Istio sidecar:

kubectl delete -f https://raw.githubusercontent.com/istio/istio/release-1.11/samples/bookinfo/platform/kube/bookinfo.yaml
# then re-apply
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.11/samples/bookinfo/platform/kube/bookinfo.yaml

During startup you will observe pods initializing and the init container running for proxy injection (READY changes from 0/2 to 2/2 once injection completes):

kubectl get pods
NAME                                   READY   STATUS        RESTARTS   AGE
details-v1-65599dcf88-gt4m2           0/2     Init:0/1     0          2s
productpage-v1-9487c9c5b-214vf        0/2     Init:0/1     0          2s
ratings-v1-59b99c644-h82fc            0/2     Init:0/1     0          2s
reviews-v1-5985995844-t87r1           1/2     Running      0          2s
reviews-v2-86d6cc668-pnr4b            1/2     Running      0          2s

Eventually pods should reach 2/2 READY:

kubectl get pods
NAME                                   READY   STATUS    RESTARTS   AGE
details-v1-65599dcf88-gt4m2           2/2     Running   0          30s
productpage-v1-9487c9c5b-214vf        2/2     Running   0          30s
ratings-v1-59b99c644-h82fc            2/2     Running   0          30s
reviews-v1-5985995844-t87r1           2/2     Running   0          30s
reviews-v2-86d6cc668-pnr4b            2/2     Running   0          30s

Notes on `istioctl profile` and operator fields

Recent istioctl releases removed the profile subcommand. If you run istioctl profile you may see:

istioctl profile
Error: unknown command "profile" for "istioctl"
Run "istioctl --help" for usage.

Use the Operator API and the Istio documentation to find profile defaults, available fields, and examples. The operator supports configuration for: profiles, image hub/tag, revisions, components, meshConfig, and more.

Quick reference: common commands

Task	Command
Validate operator manifest	`istioctl validate -f demo.yaml`
Install/upgrade Istio via Operator	`istioctl install -f demo.yaml -y` or `istioctl upgrade -f demo.yaml`
Analyze namespace for Istio issues	`istioctl analyze -n <namespace>`
Label namespace for sidecar injection	`kubectl label namespace <ns> istio-injection=enabled`
(Re)deploy Bookinfo sample	`kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.11/samples/bookinfo/platform/kube/bookinfo.yaml`

Links and references

Istio operator API and examples: https://istio.io/latest/docs/setup/install/operator/
Bookinfo sample (used above): https://github.com/istio/istio/tree/release-1.11/samples/bookinfo
Istio documentation (profiles, configuration, operator): https://istio.io/docs/

That completes this demo on customizing Istio installations using the Istio Operator (IstioOperator CR).

Introduction

Installation & Configuration

Traffic Management

Securing Workloads

Troubleshooting

Conclusion

Demo Customize Istio Installation

Prerequisites

1) Inspect cluster state

2) Create a minimal IstioOperator manifest

3) Example: Customize gateways and resource overrides

4) Enable automatic sidecar injection for your namespace

5) Redeploy Bookinfo so pods get sidecar-injected

Notes on `istioctl profile` and operator fields

Quick reference: common commands

Links and references

Watch Video

Practice Lab

​Prerequisites

​1) Inspect cluster state

​2) Create a minimal IstioOperator manifest

​3) Example: Customize gateways and resource overrides

​4) Enable automatic sidecar injection for your namespace

​5) Redeploy Bookinfo so pods get sidecar-injected

​Notes on istioctl profile and operator fields

​Quick reference: common commands

​Links and references

Watch Video

Practice Lab

Prerequisites

1) Inspect cluster state

2) Create a minimal IstioOperator manifest

3) Example: Customize gateways and resource overrides

4) Enable automatic sidecar injection for your namespace

5) Redeploy Bookinfo so pods get sidecar-injected

Notes on `istioctl profile` and operator fields

Quick reference: common commands

Links and references