Istio

https://istio.io/latest/docs
Admin
Istio is an open-source service mesh that provides a platform to manage, secure, and observe...
Tokens:843,277
Snippets:7,170
Trust Score:10
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Quick start: Install Prometheus addon

Source: https://istio.io/latest/docs/ops/integrations/prometheus

Deploys the basic Prometheus sample installation into your cluster. Intended for demonstration only, not tuned for performance or security.

```bash
$ kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.31/samples/addons/prometheus.yaml
```

--------------------------------

### istioctl install usage examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples of using istioctl install with various flags: default installation, enabling tracing with --set meshConfig.enableTracing=true, using the demo profile with --skip-confirmation, and overriding a setting with dots escaped using backslashes.

```bash
  # Apply a default Istio installation
  istioctl install

  # Enable Tracing
  istioctl install --set meshConfig.enableTracing=true

  # Generate the demo profile and don't wait for confirmation
  istioctl install --set profile=demo --skip-confirmation

  # To override a setting that includes dots, escape them with a backslash (\).  Your shell may require enclosing quotes.
  istioctl install --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default"

```

--------------------------------

### Install Istio addons

Source: https://istio.io/latest/docs/examples/microservices-istio/setup-kubernetes-cluster

Installs the Istio addons (Kiali and Prometheus) used in this example. All addons are installed using this command.

```bash
$ kubectl apply -f samples/addons

```

--------------------------------

### Install Zipkin with kubectl apply

Source: https://istio.io/latest/docs/ops/integrations/zipkin

Quick start installation command that deploys Zipkin into the cluster. Intended for demonstration only and not tuned for performance or security.

```bash
$ kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.31/samples/addons/extras/zipkin.yaml

```

--------------------------------

### Install Kiali with kubectl apply

Source: https://istio.io/latest/docs/ops/integrations/kiali

Quick start installation of Kiali using the provided sample YAML. This is intended for demonstration only and is not tuned for performance or security. If you use this sample YAML and plan to publicly expose the resulting Kiali installation, be sure to change the signing_key in Kiali's ConfigMap when using an authentication strategy other than anonymous.

```bash
$ kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.31/samples/addons/kiali.yaml
```

--------------------------------

### Quick start: Apply Grafana addon manifest

Source: https://istio.io/latest/docs/ops/integrations/grafana

Quick start installation that deploys Grafana with all Istio dashboards pre-installed. Intended for demonstration only, not tuned for performance or security.

```bash
$ kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.31/samples/addons/grafana.yaml
```

--------------------------------

### istioctl experimental precheck examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples of using the precheck command to verify installation or upgrade readiness, check a single namespace, and check for changes since a specific version.

```bash
  # Verify that Istio can be installed or upgraded
  istioctl x precheck

  # Check only a single namespace
  istioctl x precheck --namespace default

  # Check for behavioral changes since a specific version
  istioctl x precheck --from-version 1.10

```

--------------------------------

### Deploy Bookinfo sample

Source: https://istio.io/latest/docs/ambient/usage/agentgateway

Deploys the Bookinfo sample application used by the examples in this guide.

```bash
$ kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
```

--------------------------------

### Apply SkyWalking sample addon

Source: https://istio.io/latest/docs/ops/integrations/skywalking

Quick start installation command that deploys the SkyWalking sample addon into the cluster. Intended for demonstration only and not tuned for performance or security.

```shell
$ kubectl apply -f samples/addons/extras/skywalking.yaml
```

--------------------------------

### Install fish completions for new sessions

Source: https://istio.io/latest/docs/reference/commands/pilot-agent

Executes once to write the fish completion script to ~/.config/fish/completions/pilot-agent.fish for all new sessions. A new shell is needed for the setup to take effect.

```fish
pilot-agent completion bash > ~/.config/fish/completions/pilot-agent.fish
```

--------------------------------

### Start helloworld-v1 sample

Source: https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress

Starts the helloworld-v1 sample by applying the service and version labels.

```bash
$ kubectl apply -f samples/helloworld/helloworld.yaml14 -l service=helloworld
$ kubectl apply -f samples/helloworld/helloworld.yaml14 -l version=v1

```

--------------------------------

### Install Istio with minimal profile

Source: https://istio.io/latest/docs/tasks/traffic-management/ingress/gateway-api

Installs Istio using the minimal profile, which is required for the Gateway API setup.

```bash
$ istioctl install --set profile=minimal -y

```

--------------------------------

### Install the demo profile with --set profile=demo

Source: https://istio.io/latest/docs/setup/install/istioctl

Use this command to install the demo profile by passing the profile name on the command line.

```bash
$ istioctl install --set profile=demo
```

--------------------------------

### Install fish completions

Source: https://istio.io/latest/docs/reference/commands/pilot-discovery

Installs fish completions for every new session. A new shell is required for the setup to take effect.

```fish
pilot-discovery completion bash > ~/.config/fish/completions/pilot-discovery.fish
```

--------------------------------

### Set up example namespaces and services

Source: https://istio.io/latest/docs/tasks/security/authentication/authn-policy

Creates the foo, bar, and legacy namespaces and deploys the httpbin and curl services. The foo and bar services run with Envoy sidecars via istioctl kube-inject, while the legacy services run without sidecars.

```bash
$ kubectl create ns foo
$ kubectl apply -f <(istioctl kube-inject -f samples/httpbin/httpbin.yaml) -n foo
$ kubectl apply -f <(istioctl kube-inject -f samples/curl/curl.yaml) -n foo
$ kubectl create ns bar
$ kubectl apply -f <(istioctl kube-inject -f samples/httpbin/httpbin.yaml) -n bar
$ kubectl apply -f <(istioctl kube-inject -f samples/curl/curl.yaml) -n bar
$ kubectl create ns legacy
$ kubectl apply -f samples/httpbin/httpbin.yaml -n legacy
$ kubectl apply -f samples/curl/curl.yaml -n legacy
```

--------------------------------

### Install zsh completions on macOS

Source: https://istio.io/latest/docs/reference/commands/pilot-discovery

Installs zsh completions for every new session on macOS. A new shell is required for the setup to take effect.

```zsh
pilot-discovery completion zsh > $(brew --prefix)/share/zsh/site-functions/_pilot-discovery
```

--------------------------------

### istioctl ztunnel-config all examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples for the istioctl ztunnel-config all command, showing how to retrieve a summary for a randomly chosen ztunnel and a full configuration dump for a specific instance.

```bash
  # Retrieve summary about all configuration for a randomly chosen ztunnel.
  istioctl ztunnel-config all

  # Retrieve full configuration dump of workloads for a given Ztunnel instance.
  istioctl ztunnel-config all <ztunnel-name[.namespace]> -o json

```

--------------------------------

### Deploy example namespace and workloads

Source: https://istio.io/latest/docs/tasks/security/authentication/claim-to-header

Creates the namespace 'foo', enables sidecar injection, and deploys the httpbin and curl workloads.

```shell
$ kubectl create ns foo
$ kubectl label namespace foo istio-injection=enabled
$ kubectl apply -f samples/httpbin/httpbin.yaml -n foo
$ kubectl apply -f samples/curl/curl.yaml -n foo
```

--------------------------------

### Install zsh completions on Linux

Source: https://istio.io/latest/docs/reference/commands/pilot-discovery

Installs zsh completions for every new session on Linux. A new shell is required for the setup to take effect.

```zsh
pilot-discovery completion zsh > "${fpath[1]}/_pilot-discovery"
```

--------------------------------

### Install bash completions on macOS

Source: https://istio.io/latest/docs/reference/commands/pilot-discovery

Installs bash completions for every new session on macOS. A new shell is required for the setup to take effect.

```bash
pilot-discovery completion bash > /usr/local/etc/bash_completion.d/pilot-discovery
```

--------------------------------

### Install bash completions on Linux

Source: https://istio.io/latest/docs/reference/commands/pilot-discovery

Installs bash completions for every new session on Linux. A new shell is required for the setup to take effect.

```bash
pilot-discovery completion bash > /etc/bash_completion.d/pilot-discovery
```

--------------------------------

### Install Istio using a configuration file

Source: https://istio.io/latest/docs/setup/install/istioctl

Creates a configuration file with the IstioOperator API to enable access logs, then installs Istio using the -f flag. The -f method is recommended for production over --set.

```bash
$ cat <<EOF > ./my-config.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    accessLogFile: /dev/stdout
EOF
$ istioctl install -f my-config.yaml
```

--------------------------------

### istioctl x workload examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples of commands to assist in configuring and deploying workloads on VMs and other non-Kubernetes environments. Includes generating a workload group YAML and configuring a workload entry.

```bash
  # workload group yaml generation
  istioctl x workload group create

  # workload entry configuration generation
  istioctl x workload entry configure

```

--------------------------------

### Set environment variables for multi-network VM installation

Source: https://istio.io/latest/docs/setup/install/virtual-machine

Set environment variables for a multi-network Istio VM installation. Customize CLUSTER_NETWORK, VM_NETWORK, and CLUSTER for multi-cluster/multi-network setups.

```bash
$ VM_APP="<the name of the application this VM will run>"
$ VM_NAMESPACE="<the name of your service namespace>"
$ WORK_DIR="<a certificate working directory>"
$ SERVICE_ACCOUNT="<name of the Kubernetes service account you want to use for your VM>"
$ # Customize values for multi-cluster/multi-network as needed
$ CLUSTER_NETWORK="kube-network"
$ VM_NETWORK="vm-network"
$ CLUSTER="cluster1"
```

--------------------------------

### Create topology.yaml and install Istio with numTrustedProxies=2

Source: https://istio.io/latest/docs/ops/configuration/traffic-management/network-topologies

Creates a file named topology.yaml with numTrustedProxies set to 2 and installs Istio using istioctl install -f topology.yaml.

```bash
$ cat <<EOF > topology.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    defaultConfig:
      gatewayTopology:
        numTrustedProxies: 2
EOF
$ istioctl install -f topology.yaml
```

--------------------------------

### failoverPriority example

Source: https://istio.io/latest/docs/reference/config/networking/destination-rule

Configures failover priority for a DestinationRule. Endpoints in clusterA with version=v1 get the highest priority (P(0)), endpoints with version=v1 outside clusterA get P(1), and all others get P(2). Must be used with OutlierDetection to have effect.

```yaml
failoverPriority:
- "version=v1"
- "topology.istio.io/cluster=clusterA"

```

--------------------------------

### Deploy Gateway and HTTPRoute configuration

Source: https://istio.io/latest/docs/tasks/traffic-management/ingress/gateway-api

Creates a namespace and applies a Gateway and HTTPRoute configuration using a here-document. The Gateway listens on port 80 for hostnames matching *.example.com, and the HTTPRoute routes requests for httpbin.example.com with path prefix /get to the httpbin service on port 8000.

```shell
$ kubectl create namespace istio-ingress
$ kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: gateway
  namespace: istio-ingress
spec:
  gatewayClassName: istio
  listeners:
  - name: default
    hostname: "*.example.com"
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: http
  namespace: default
spec:
  parentRefs:
  - name: gateway
    namespace: istio-ingress
  hostnames: ["httpbin.example.com"]
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /get
    backendRefs:
    - name: httpbin
      port: 8000
EOF
```

--------------------------------

### Build and serve the site locally with make serve

Source: https://istio.io/latest/docs/releases/contribute/build

Builds the site and starts a local web server. If there are no build errors, the site is available at http://localhost:1313.

```bash
$ make serve

```

--------------------------------

### Verify cluster access with kubectl get nodes

Source: https://istio.io/latest/docs/setup/platform-setup/oci

Run `kubectl get nodes` to verify that kubectl can connect to the OKE cluster. After successful verification, you can install Istio using `istioctl`, Helm, or manually.

```bash
$ kubectl get nodes
```

--------------------------------

### istioctl dashboard controlz examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples for opening the ControlZ web UI for a specific pod, a pod in a custom namespace, any Istiod pod via deployment, and using short syntax.

```bash
  # Open ControlZ web UI for the istiod-56dd66799-jfdvs.istio-system pod
  istioctl dashboard controlz istiod-56dd66799-jfdvs.istio-system

  # Open ControlZ web UI for the istiod-56dd66799-jfdvs pod in a custom namespace
  istioctl dashboard controlz istiod-56dd66799-jfdvs -n custom-ns

  # Open ControlZ web UI for any Istiod pod
  istioctl dashboard controlz deployment/istiod.istio-system

  # with short syntax
  istioctl dash controlz istiod-56dd66799-jfdvs.istio-system
  istioctl d controlz istiod-56dd66799-jfdvs.istio-system

```

--------------------------------

### Install Istio with default profile

Source: https://istio.io/latest/docs/setup/install/istioctl

Installs the default Istio configuration profile on the cluster defined by your Kubernetes configuration. The default profile is a good starting point for production, unlike the demo profile for evaluation.

```bash
$ istioctl install
```

--------------------------------

### Deploy example namespace and workloads

Source: https://istio.io/latest/docs/tasks/security/authorization/authz-tcp

Creates the 'foo' namespace and deploys the tcp-echo and curl workloads with Istio sidecar injection.

```bash
$ kubectl create ns foo
$ kubectl apply -f <(istioctl kube-inject -f samples/tcp-echo/tcp-echo.yaml7) -n foo
$ kubectl apply -f <(istioctl kube-inject -f samples/curl/curl.yaml8) -n foo
```

--------------------------------

### istioctl manifest translate examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples of the istioctl manifest translate command: translating an IstioOperator YAML file, a default installation, enabling tracing, selecting the demo profile, and overriding a setting with escaped dots.

```bash
  # Translate an IstioOperator yaml file into helm values
  istioctl manifest translate -f istio.yaml

  # Translate a default Istio installation
  istioctl manifest translate

  # Enable Tracing
  istioctl manifest translate --set meshConfig.enableTracing=true

  # Translate the demo profile
  istioctl manifest translate --set profile=demo

  # To override a setting that includes dots, escape them with a backslash (\).  Your shell may require enclosing quotes.
  istioctl manifest translate --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default"

```

--------------------------------

### IstioOperator YAML example

Source: https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1

Example IstioOperator resource showing a default profile with custom hub, tag, revision, meshConfig, and egress gateway settings. This is passed as a file input to istioctl install and istioctl manifest generate.

```yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: default
  hub: registry.istio.io/testing
  tag: latest
  revision: 1-8-0
  meshConfig:
    accessLogFile: /dev/stdout
    enableTracing: true
  components:
    egressGateways:
    - name: istio-egressgateway
      enabled: true

```

--------------------------------

### kubectl get virtualservice ratings output with validation message

Source: https://istio.io/latest/docs/ops/diagnostic-tools/istioctl-analyze

Example output from `kubectl get virtualservice ratings` showing a misconfigured gateway. The status subresource contains a validation message with code IST0101 when `istiod.enableAnalysis` is enabled.

```yaml
apiVersion: networking.istio.io/v1
kind: VirtualService
...
spec:
  gateways:
  - bogus-gateway
  hosts:
  - ratings
...
status:
  observedGeneration: "1"
  validationMessages:
  - documentationUrl: https://istio.io/v1.31/docs/reference/config/analysis/ist0101/
    level: ERROR
    type:
      code: IST0101
```

--------------------------------

### Set environment variables for single-network VM installation

Source: https://istio.io/latest/docs/setup/install/virtual-machine

Set environment variables for a single-network Istio VM installation. The variables VM_APP, VM_NAMESPACE, WORK_DIR, and SERVICE_ACCOUNT are required; CLUSTER_NETWORK and VM_NETWORK are left empty for single-network setups.

```bash
$ VM_APP="<the name of the application this VM will run>"
$ VM_NAMESPACE="<the name of your service namespace>"
$ WORK_DIR="<a certificate working directory>"
$ SERVICE_ACCOUNT="<name of the Kubernetes service account you want to use for your VM>"
$ CLUSTER_NETWORK=""
$ VM_NETWORK=""
$ CLUSTER="Kubernetes"
```

--------------------------------

### istioctl proxy-config all examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples for the istioctl proxy-config all command. Shows retrieving summaries for a pod or a deployment, outputting JSON with -o json, using the short syntax 'istioctl pc a', and retrieving a cluster summary from a local Envoy config dump file without using the Kubernetes API.

```shell
  # Retrieve summary about all configuration for a given pod from Envoy.
  istioctl proxy-config all <pod-name[.namespace]>

  # Retrieve summary about all configuration for a pod under a deployment from Envoy.
  istioctl proxy-config all deployment/<deployment-name[.namespace]>

  # Retrieve full cluster dump as JSON
  istioctl proxy-config all <pod-name[.namespace]> -o json

  # Retrieve full cluster dump with short syntax
  istioctl pc a <pod-name[.namespace]>

  # Retrieve cluster summary without using Kubernetes API
  ssh <user@hostname> 'curl localhost:15000/config_dump' > envoy-config.json
  istioctl proxy-config all --file envoy-config.json

```

--------------------------------

### Deploy helloworld and curl samples

Source: https://istio.io/latest/docs/setup/install/external-controlplane

Deploys the helloworld (v1) and curl sample applications to the sample namespace on the remote cluster. Uses kubectl apply with the remote cluster context.

```bash
$ kubectl apply -f samples/helloworld/helloworld.yaml -l service=helloworld -n sample --context="${CTX_REMOTE_CLUSTER}"
$ kubectl apply -f samples/helloworld/helloworld.yaml -l version=v1 -n sample --context="${CTX_REMOTE_CLUSTER}"
$ kubectl apply -f samples/curl/curl.yaml -n sample --context="${CTX_REMOTE_CLUSTER}"
```

--------------------------------

### Install token at /var/run/secrets/tokens

Source: https://istio.io/latest/docs/setup/install/virtual-machine

Creates the token directory and copies the istio-token file into it. Run on the virtual machine being added to the Istio mesh.

```bash
$ sudo  mkdir -p /var/run/secrets/tokens
$ sudo cp "${HOME}"/istio-token /var/run/secrets/tokens/istio-token

```

--------------------------------

### istioctl manifest generate usage examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples of using istioctl manifest generate to create a default installation, enable tracing, select the demo profile, write output to a file, and override a setting containing dots with escaped backslashes.

```bash
  # Generate a default Istio installation
  istioctl manifest generate

  # Enable Tracing
  istioctl manifest generate --set meshConfig.enableTracing=true

  # Generate the demo profile
  istioctl manifest generate --set profile=demo

  # Write the manifest to a file instead of stdout (avoids shell redirection; works where no shell is available)
  istioctl manifest generate -o /shared/istio.yaml

  # To override a setting that includes dots, escape them with a backslash (\).  Your shell may require enclosing quotes.
  istioctl manifest generate --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default"
```

--------------------------------

### Set minikube hypervisor driver to kvm2

Source: https://istio.io/latest/docs/setup/platform-setup/minikube

Sets the minikube hypervisor driver to kvm2 when not using the default driver, for example after installing the KVM hypervisor.

```bash
$ minikube config set driver kvm2
```

--------------------------------

### Get secure port from my-gateway

Source: https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control

Finds ports on any gateway. This example accesses a secure HTTP port named 'https' on a gateway named 'my-gateway'.

```bash
$ export INGRESS_HOST=$(kubectl get gtw my-gateway -o jsonpath='{.status.addresses[0].value}')
$ export SECURE_INGRESS_PORT=$(kubectl get gtw my-gateway -o jsonpath='{.spec.listeners[?(@.name=="https")].port}')

```
Tokens:
Raw