Demo Install Istio via Helm

Installing Istio with Helm is a reliable way to get the control plane and gateway running in your cluster. This guide walks through a minimal, reproducible workflow: add the Istio Helm repo, install the three required charts (base, istiod, gateway), verify CRDs, enable automatic sidecar injection for a namespace, deploy a sample workload, and extract/modify Helm values for customization. Prerequisites

A Kubernetes cluster (start from a clean cluster to follow this demo).
kubectl configured to talk to the cluster.
Helm installed on the control plane or a machine with cluster access.

Verify your cluster has only default workloads:

kubectl get pods -A

Confirm Helm is available:

which helm
# Example output:
/usr/sbin/helm

Add and update the Istio Helm repository:

helm repo add istio https://istio-release.storage.googleapis.com/charts
helm repo update

Verify the repository was added:

helm repo list
# Example output includes "istio"

What we will install

istio/base — installs CustomResourceDefinitions (CRDs) and base resources.
istio/istiod — the control plane (istiod replaces older Pilot/Galley components).
istio/gateway — the ingress gateway (can be installed into istio-system or a separate namespace).

Chart	Purpose	Notes
`istio/base`	Installs CRDs and cluster-level base objects	Must be installed before other Istio charts.
`istio/istiod`	Istio control plane (Pilot, etc.)	You can customize resource requests and profile.
`istio/gateway`	Ingress gateway deployment	Can be in `istio-system` or a dedicated namespace.

Steps

Install the Istio base chart (creates istio-system and installs CRDs)

helm install istio-base istio/base \
  --namespace istio-system \
  --create-namespace \
  --version 1.26.3 \
  --set profile=demo

Confirm the CRDs are present:

kubectl get crd | grep 'istio.io'
# You should see many Istio CRDs listed with their creation timestamps.

The image shows a terminal window with commands related to installing Istio using Helm and checking custom resource definitions (CRDs) with kubectl. It confirms Istio's successful installation and lists several CRDs with their creation timestamps.

The base chart is required because it installs the Istio CustomResourceDefinitions (CRDs). Without these CRDs you cannot create many Istio resources.

Always install the istio/base chart before istiod or gateway. Installing the control plane without CRDs can cause resources to be invalid or fail to create.

Install the control plane (istiod)

For small clusters, reduce CPU request for the Pilot component to avoid scheduling pressure:

helm install istiod istio/istiod \
  --namespace istio-system \
  --version 1.26.3 \
  --set profile=demo \
  --set pilot.resources.requests.cpu=250m

Check the istiod pod is running:

kubectl get pods -n istio-system
# Example output:
# NAME                       READY   STATUS    RESTARTS   AGE
# istiod-7f65f9c48b-5wgpr    1/1     Running   0          11s

Sample helm install output (trimmed for clarity):

# helm install istiod istio/istiod ...
NAME: istiod
LAST DEPLOYED: Tue Aug 26 22:26:57 2025
NAMESPACE: istio-system
STATUS: deployed
NOTES: "istiod" successfully installed!

Install the ingress gateway

You can install the gateway into istio-system or a separate namespace (e.g., istio-ingress). Here we install into istio-system:

helm install istio-ingress istio/gateway \
  --namespace istio-system \
  --version 1.26.3

Verify both the gateway and istiod are running:

kubectl get pods -n istio-system
# Example output:
# NAME                                  READY   STATUS    RESTARTS   AGE
# istio-ingress-6cc846956d-b57jn        1/1     Running   0          5s
# istiod-7f65f9c48b-5wgpr               1/1     Running   0          64s

Optional diagnostics: run istioctl analyze to catch common issues (if istioctl is installed).

istioctl analyze
# If not installed you may see:
# -bash: istioctl: command not found

Enable automatic sidecar injection

Label the namespace where you want Istio to automatically inject the Envoy sidecar. This example enables injection in the default namespace. Check existing labels:

kubectl get ns default --show-labels
# Before labeling:
# NAME      STATUS   AGE    LABELS
# default   Active   5m     kubernetes.io/metadata.name=default

Label the namespace:

kubectl label ns default istio-injection=enabled --overwrite
# namespace/default labeled

Confirm the label:

kubectl get ns default --show-labels
# After labeling:
# NAME      STATUS   AGE    LABELS
# default   Active   5m     istio-injection=enabled,kubernetes.io/metadata.name=default

Deploy a sample workload (Redis) to validate sidecar injection

Create a simple Redis pod in the labeled namespace:

kubectl run redis --image=redis --restart=Never
kubectl get pods
# You should see the redis pod in a Running state.

Describe the redis pod and confirm both containers are present (application + Istio sidecar):

kubectl describe pod redis
# Look near the top for two containers: "redis" and "istio-proxy" (with its version).

The image shows a terminal window displaying Kubernetes container details, including information about two containers: one running Redis and another running an Istio proxy.

Inspect and customize Helm chart values

To review default chart values before customizing or upgrading, extract them to files:

helm show values istio/istiod > istiod.yaml
helm show values istio/gateway > gateway.yaml
ls -lh istiod.yaml gateway.yaml
# Example files created: istiod.yaml (large), gateway.yaml

Edit istiod.yaml or gateway.yaml to change settings such as image tags, resources, or gateway configuration. Example snippet from a values file:

# Tolerations for the waypoint proxy.
tolerations: []

base:
  enableIstioConfigCRDs: true

gateways:
  securityContext: {}
  seccompProfile: {}

pdb:
  minAvailable: 1
  maxUnavailable: 1
  unhealthyPodEvictionPolicy: ""

Apply your custom values when upgrading the release:

helm upgrade istiod istio/istiod -n istio-system -f istiod.yaml

This updates the existing release using your modified configuration. References

Istio Helm charts: https://istio.io/latest/docs/setup/install/helm/
Helm documentation: https://helm.sh/docs/
Kubernetes documentation: https://kubernetes.io/docs/
istioctl analyze: https://istio.io/latest/docs/ops/diagnostic-tools/istioctl-analyze/

Summary You have now installed Istio via Helm (base, istiod, and gateway), verified CRDs, enabled automatic sidecar injection for a namespace, deployed a sample workload to verify injection, and exported chart values for customization. Adjust values and resource requests as needed for production environments.

Introduction

Installation & Configuration

Traffic Management

Securing Workloads

Troubleshooting

Conclusion

Demo Install Istio via Helm

Watch Video

Practice Lab