> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Guide to installing, configuring, customizing, deploying Ambient mode, upgrading, and uninstalling Istio on Kubernetes using istioctl, Helm, and the Istio Operator.

This lesson explains how to install, configure, and manage Istio on Kubernetes. It follows a practical sequence from prerequisites through installation options, customization with the Istio Operator, Ambient mode deployment, and safe upgrade/uninstall patterns.

The module sequence:

1. Prerequisites and requirements
   * A Kubernetes cluster and `kubectl` access are required before installing Istio.
2. Installing `istioctl` and using it to install and enable Istio
   * How to download `istioctl`, run the installer, and enable features after installation.
3. Istio installation profiles, including Ambient mode
   * Review built-in profiles and when to choose Ambient mode.
4. Installing Istio with Helm
   * An alternative installation method and when to prefer Helm.
5. Customizing Istio via the Istio Operator
   * Use the Operator to manage configuration and lifecycle (important for the exam).
6. Deploying Ambient mode and using the ztunnel
   * How to enable Ambient mode and start the ztunnel-based dataplane.
7. Upgrading and uninstalling Istio using canary upgrades
   * Use canary-style upgrades for safer version transitions (also exam-relevant).

<Callout icon="lightbulb" color="#1CB2FE">
  Before proceeding, ensure you have a working Kubernetes cluster and `kubectl` configured to talk to it. Many installation steps assume cluster-admin privileges.
</Callout>

<Callout icon="warning" color="#FF6B6B">
  The Istio Operator and Ambient mode topics are frequently covered on exams—pay close attention to customization and upgrade procedures.
</Callout>

***

## 1. Prerequisites and requirements

Minimum items needed before installing Istio:

* A Kubernetes cluster (managed or self-hosted). For labs, `kind`, `minikube`, or a cloud cluster are common choices.
* `kubectl` configured and able to reach the cluster: `kubectl get nodes`
* Sufficient cluster permissions (cluster-admin role may be required for some operations)
* Basic familiarity with Kubernetes objects (Namespaces, Deployments, Services)

Helpful commands:

```bash theme={null}
# Verify kubectl connectivity
kubectl version --short
kubectl get nodes

# Create a namespace
kubectl create namespace istio-system
```

***

## 2. Installing istioctl and installing Istio

Istio's recommended CLI is `istioctl`. It provides a convenient installer, validation, and management helpers.

Download and install `istioctl` (example using the official release page):

```bash theme={null}
# Example (replace with specific version)
curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.18.0 sh -
export PATH="$PATH:$(pwd)/istio-1.18.0/bin"
istioctl version --remote
```

Install Istio using `istioctl`:

```bash theme={null}
# Default profile installation into istio-system namespace
istioctl install --set profile=default -y
```

Enable or verify features after installation:

```bash theme={null}
# Check installed components
kubectl -n istio-system get pods

# Enable automatic sidecar injection in a namespace
kubectl label namespace default istio-injection=enabled --overwrite
```

Useful `istioctl` commands:

* `istioctl install` — install/upgrade Istio
* `istioctl dashboard` — access Grafana/Prometheus/Kiali/UIs
* `istioctl analyze` — validate configuration and detect common problems

References: [Istio Installation Docs](https://istio.io/latest/docs/setup/)

***

## 3. Istio installation profiles (including Ambient mode)

Istio provides several built-in installation profiles optimized for different use cases:

| Profile              | Use Case                             | Notes                                                 |
| -------------------- | ------------------------------------ | ----------------------------------------------------- |
| `default`            | General-purpose production           | Balanced set of features and telemetry                |
| `minimal`            | Lightweight installations            | Fewer components, lower resource usage                |
| `demo`               | Local testing / demos                | Includes sample apps and verbose telemetry            |
| `remote` / `primary` | Multi-cluster topologies             | For control-plane / remote-plane separation           |
| `ambient`            | Sidecar-free dataplane using ztunnel | Use when you prefer ambient proxy model over sidecars |

Choosing Ambient mode:

* Ambient mode replaces sidecar proxies with an overlay dataplane (ztunnel + Ambient Gateway).
* It simplifies application deployment (no sidecar injection) but requires careful network policy and security configuration.

When to use which profile:

* Use `default` for most production clusters.
* Use `minimal` for constrained environments.
* Consider `ambient` when sidecar complexity is a concern and your environment supports ztunnel.

***

## 4. Installing Istio with Helm

Helm offers an alternative installation path, useful when integrating with existing Helm-driven workflows or templating requirements.

Example Helm steps:

```bash theme={null}
# Add Istio helm repo
helm repo add istio https://istio-release.storage.googleapis.com/charts
helm repo update

# Install Istio base and control plane (example)
helm install istio-base istio/base -n istio-system --create-namespace
helm install istiod istio/istiod -n istio-system
```

When to prefer Helm:

* You need to embed Istio installation in CI/CD as Helm charts.
* You require finer templating control or integration with other Helm-based infrastructure.

Compare installation methods:

| Method         | Pros                                      | Cons                                          |
| -------------- | ----------------------------------------- | --------------------------------------------- |
| `istioctl`     | Simple, opinionated, built-in validations | Less templating flexibility                   |
| Helm           | Integrates with Helm-based workflows      | More manual wiring; more moving parts         |
| Istio Operator | Declarative lifecycle management          | Best for large-scale or production operations |

***

## 5. Customizing Istio via the Istio Operator

The Istio Operator enables declarative, repeatable management of Istio control plane configuration and lifecycle.

Basic Operator workflow:

1. Install the Operator into the cluster (Operator Lifecycle Manager or Helm).
2. Create an `IstioOperator` custom resource to define desired configuration.
3. The Operator reconciles the control plane to the declared state.

Example `IstioOperator` snippet (use a file like `istio-operator.yaml`):

```yaml theme={null}
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: example-operator
spec:
  profile: default
  components:
    pilot:
      k8s:
        hpaSpec:
          minReplicas: 2
```

Benefits:

* Centralized configuration, upgrades, and custom component tuning.
* Suitable for production and is frequently covered in certification exams.

***

## 6. Deploying Ambient mode and using the ztunnel

Ambient mode provides a sidecar-free dataplane using the ztunnel and ambient gateway. Key steps:

1. Choose or create an Ambient profile.
2. Install Istio with Ambient components enabled (via `istioctl` or `IstioOperator`).
3. Deploy ztunnel agents and Ambient Gateway where required.

Example for enabling Ambient (conceptual):

```bash theme={null}
# Example using IstioOperator; configure spec.profile=ambient
istioctl install -f ambient-operator-config.yaml
```

Post-install checks:

```bash theme={null}
# Verify Ambient pods (ztunnel)
kubectl -n istio-system get pods -l app=ztunnel
```

<Callout icon="lightbulb" color="#1CB2FE">
  Ambient mode reduces the operational overhead of sidecars but requires testing—verify traffic flow, mTLS behavior, and observability in a staging environment before production rollout.
</Callout>

***

## 7. Upgrading and uninstalling Istio using canary upgrades

Safe upgrades are essential. Istio supports canary-style upgrades to move traffic gradually from an old control plane to a new one.

Canary upgrade pattern (high-level):

1. Install the new control plane alongside the existing one (different revision or namespace).
2. Apply `Pod`/`Deployment` annotations or `Sidecar`/`Service` tweaks to direct a subset of workloads to the new control plane.
3. Monitor telemetry and application health using `istioctl analyze`, Prometheus, and logs.
4. Gradually increase the percentage of workloads using the new control plane.
5. Remove the old control plane after verification.

Example of installing a revision for a canary:

```bash theme={null}
# Install new revision (e.g., 1-18-0) without overwriting existing control plane
istioctl install --set revision=1-18-0 -y

# Inject workloads to use the new revision (namespace label)
kubectl label namespace default istio.io/rev=1-18-0 --overwrite
```

Uninstalling Istio:

```bash theme={null}
# Remove Istio installation using istioctl
istioctl x uninstall --purge -y

# Remove CRDs (if required)
kubectl delete crd -l operator.istio.io/component=
```

<Callout icon="warning" color="#FF6B6B">
  Always back up configuration (CRs, IstioOperator manifests, and custom resource definitions) before upgrading or uninstalling. Canary upgrades reduce risk—avoid large-scale switches without staged verification.
</Callout>

***

## Quick Reference — Commands

| Action                        | Command                                                                  |
| ----------------------------- | ------------------------------------------------------------------------ |
| Download istioctl             | `curl -L https://istio.io/downloadIstio \| ISTIO_VERSION=<version> sh -` |
| Install Istio (default)       | `istioctl install --set profile=default -y`                              |
| Install with revision         | `istioctl install --set revision=<rev> -y`                               |
| Check control plane pods      | `kubectl -n istio-system get pods`                                       |
| Label namespace for injection | `kubectl label namespace default istio-injection=enabled --overwrite`    |
| Uninstall Istio               | `istioctl x uninstall --purge -y`                                        |

***

## Links and References

* Istio Documentation: [https://istio.io/](https://istio.io/)
* Istio Installation: [https://istio.io/latest/docs/setup/](https://istio.io/latest/docs/setup/)
* Kubernetes Documentation: [https://kubernetes.io/docs/](https://kubernetes.io/docs/)
* Helm: [https://helm.sh/](https://helm.sh/)

Use these pages for the latest release notes and detailed configuration options.

<CardGroup>
  <Card title="Watch Video" icon="video" cta="Learn more" href="https://learn.kodekloud.com/user/courses/istio-certified-associate/module/65ee174b-536e-4657-9b6f-85c90c7612da/lesson/65f60295-4ffb-477b-b3da-7f086e533016" />
</CardGroup>