Helm
Use Helm to deploy a sidecar service mesh to your Gloo Mesh cluster.
Overview
Review the following information about the Istio control plane setup in this guide:
- This installation guide installs a production-level Solo distribution of Istio, a hardened Istio enterprise image. For more information, see About the Solo distribution of Istio.
- For more information about using Istio Helm charts, see the Istio documentation.
Prepare the cluster environment
Set up the following tools and environment variables.
If you do not already have a license, decide the level of licensed features that you want, and contact an account representative to obtain the license.
Choose the version of Istio that you want to install or upgrade to by reviewing the supported versions table. Be sure to review the following known Istio version restrictions.
Patch versions 1.26.0 and 1.26.1 of the Solo distribution of Istio lack support for FIPS-tagged images and ztunnel outlier detection. When upgrading or installing 1.26, be sure to use patch version
1.26.1-patch0
and later only.
In Gloo Mesh version 2.6 and later, ambient mode requires the Solo distribution of Istio version 1.22.3 or later (1.22.3-solo
). In Gloo Mesh version 2.7 and later, multicluster setups require the Solo distribution of Istio version 1.24.3 or later (1.24.3-solo
), including the Solo distribution ofistioctl
.
In Istio 1.22.0-1.22.3, theISTIO_DELTA_XDS
environment variable must be set tofalse
. For more information, see this upstream Istio issue. Note that this issue is resolved in Istio 1.22.4.Decide on the specific tag of Solo distribution of Istio image, such as
-solo
,-solo-fips
,-solo-distroless
, or-solo-fips-distroless
, that you want for your environment.Save the details for the version of the Solo distribution of Istio that you want to install.
- Save the Solo distribution of Istio patch version and tag.
export ISTIO_VERSION=1.26.2 # Change the tags as needed export ISTIO_IMAGE=${ISTIO_VERSION}-solo
- Save the repo key for the minor version of the Solo distribution of Istio that you want to install. This is the 12-character hash at the end of the repo URL
us-docker.pkg.dev/gloo-mesh/istio-<repo-key>
, which you can find in the Istio images built by Solo.io support article.# 12-character hash at the end of the minor version repo URL export REPO_KEY=<repo_key> export REPO=us-docker.pkg.dev/gloo-mesh/istio-${REPO_KEY} export HELM_REPO=us-docker.pkg.dev/gloo-mesh/istio-helm-${REPO_KEY}
- Set your license key as an environment variable. If you prefer to specify license keys in a secret instead, see Licensing.
export LICENSE_KEY=<license_key>
- Save the Solo distribution of Istio patch version and tag.
Install or upgrade
istioctl
with the same version of Istio that you saved.curl -L https://istio.io/downloadIstio | ISTIO_VERSION=${ISTIO_VERSION} sh - cd istio-${ISTIO_VERSION} export PATH=$PWD/bin:$PATH
Install CRDs
Deploy the Istio CRDs and a sidecar control plane to your cluster.
Save the name of a workload cluster in the following environment variable.
export CLUSTER_NAME=<cluster-name>
Install the Istio CRDs.
helm upgrade --install istio-base oci://${HELM_REPO}/base \ -n istio-system \ --create-namespace \ --version ${ISTIO_IMAGE} \ --set defaultRevision=main
Create the
istio-config
namespace. This namespace serves as the administrative root namespace for Istio configuration.kubectl create namespace istio-config
OpenShift only: Install the CNI plug-in, which is required for using Istio in OpenShift.
helm install istio-cni oci://${HELM_REPO}/cni \ --namespace kube-system \ --version ${ISTIO_IMAGE} \ --set cni.cniBinDir=/var/lib/cni/bin \ --set cni.cniConfDir=/etc/cni/multus/net.d \ --set cni.cniConfFileName="istio-cni.conf" \ --set cni.chained=false \ --set cni.privileged=true \ --set global.platform=openshift
Install the Istio control plane
Prepare a Helm values file for the
istiod
control plane. You can further edit the file to provide your own details for production-level settings.- Download an example file,
istiod.yaml
, and update the environment variables with the values that you previously set. The provided Helm values files are configured with production-level settings; however, depending on your environment, you might need to edit settings to achieve specific Istio functionality.curl -0L https://raw.githubusercontent.com/solo-io/gloo-mesh-use-cases/main/gloo-mesh-enterprise/istio-install/manual-helm/istiod-1.24+.yaml > istiod.yaml envsubst < istiod.yaml > istiod-values.yaml open istiod-values.yaml
- Download an example file,
Create the
istiod
control plane in your cluster.After the installation is complete, verify that the Istio control plane pods are running.
kubectl get pods -n istio-system
Example output:
NAME READY STATUS RESTARTS AGE istiod-main-bb86b959f-msrg7 1/1 Running 0 2m45s istiod-main-bb86b959f-w29cm 1/1 Running 0 3m