### Istio installation examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Common usage patterns for installing Istio, including profile selection and configuration overrides.

```bash
  # Apply a default Istio installation
  istioctl install

  # Enable Tracing
  istioctl install --set meshConfig.enableTracing=true

  # Generate the demo profile and don't wait for confirmation
  istioctl install --set profile=demo --skip-confirmation

  # To override a setting that includes dots, escape them with a backslash (\).  Your shell may require enclosing quotes.
  istioctl install --set "values.sidecarInjectorWebhook.injectedAnnotations.container\.apparmor\.security\.beta\.kubernetes\.io/istio-proxy=runtime/default"
```

--------------------------------

### Install Prometheus via Quick Start

Source: https://istio.io/latest/docs/ops/integrations/prometheus

Deploys a basic Prometheus instance for demonstration purposes using the provided Istio sample manifest.

```bash
$ kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.30/samples/addons/prometheus.yaml
```

--------------------------------

### Install Kiali via Quick Start

Source: https://istio.io/latest/docs/ops/integrations/kiali

Deploys Kiali into the cluster using the Istio sample configuration. Intended for demonstration purposes only and not for production use.

```bash
$ kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.30/samples/addons/kiali.yaml
```

--------------------------------

### Execute KubeSphere Installation Script

Source: https://istio.io/latest/docs/setup/platform-setup/kubesphere

Command to start the installation process, requiring the selection of the All-in-one option.

```bash
$ ./install.sh
```

--------------------------------

### KubeSphere Installation Output

Source: https://istio.io/latest/docs/setup/platform-setup/kubesphere

Example of the console output providing access information after a successful installation.

```text
#####################################################
###              Welcome to KubeSphere!           ###
#####################################################
Console: http://192.168.0.8:30880
Account: admin
Password: It will be generated by KubeSphere Installer
```

--------------------------------

### Basic istioctl install command syntax

Source: https://istio.io/latest/docs/reference/commands/istioctl

Standard syntax for invoking the install command.

```bash
istioctl install [flags]
```

```bash
istioctl apply [flags]
```

--------------------------------

### istioctl proxy-config endpoint examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples for retrieving and filtering endpoint configurations.

```bash
  # Retrieve full endpoint configuration for a given pod from Envoy.
  istioctl proxy-config endpoint <pod-name[.namespace]>

  # Retrieve full endpoint configuration for a pod under a deployment from Envoy.
  istioctl proxy-config endpoint deployment/<deployment-name[.namespace]>

  # Retrieve endpoint summary for endpoint with port 9080.
  istioctl proxy-config endpoint <pod-name[.namespace]> --port 9080

  # Retrieve full endpoint with a address (172.17.0.2).
  istioctl proxy-config endpoint <pod-name[.namespace]> --address 172.17.0.2 -o json

  # Retrieve full endpoint with a cluster name (outbound|9411||zipkin.istio-system.svc.cluster.local).
  istioctl proxy-config endpoint <pod-name[.namespace]> --cluster "outbound|9411||zipkin.istio-system.svc.cluster.local" -o json
  # Retrieve full endpoint with the status (healthy).
  istioctl proxy-config endpoint <pod-name[.namespace]> --status healthy -ojson

  # Retrieve endpoint summary without using Kubernetes API
  ssh <user@hostname> 'curl localhost:15000/clusters?format=json' > envoy-clusters.json
  istioctl proxy-config endpoints --file envoy-clusters.json
```

--------------------------------

### Configure installation with --set

Source: https://istio.io/latest/docs/setup/install/istioctl

Modifies installation parameters directly via command-line flags.

```bash
$ istioctl install --set meshConfig.accessLogFile=/dev/stdout
```

--------------------------------

### Describe service command examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples showing how to query services with inferred or explicit namespaces.

```bash
  # Service query with inferred namespace (current context's namespace)
  istioctl experimental describe service productpage

  # Service query with explicit namespace
  istioctl experimental describe service istio-ingressgateway.istio-system
  or
  istioctl experimental describe service istio-ingressgateway -n istio-system
```

--------------------------------

### Describe pod command examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples showing how to query pods with inferred or explicit namespaces.

```bash
  # Pod query with inferred namespace (current context's namespace)
  istioctl experimental describe pod helloworld-v1-676yyy3y5r-d8hdl

  # Pod query with explicit namespace 
  istioctl experimental describe pod istio-eastwestgateway-7f4b4f44b-6zd95.istio-system
  or
  istioctl experimental describe pod istio-eastwestgateway-7f4b4f44b-6zd95 -n istio-system
```

--------------------------------

### Install Istio components via Helm

Source: https://istio.io/latest/docs/setup/install/multicluster/multi-primary_multi-network

Installs base and istiod charts using Helm for multi-cluster setup.

```bash
$ helm install istio-base istio/base -n istio-system --kube-context "${CTX_CLUSTER1}"
```

```bash
$ helm install istiod istio/istiod -n istio-system --kube-context "${CTX_CLUSTER1}" --set global.meshID=mesh1 --set global.multiCluster.clusterName=cluster1 --set global.network=network1
```

--------------------------------

### Example FAQ front matter

Source: https://istio.io/latest/docs/releases/contribute/front-matter

A practical example showing how to set up a page with a single alias for redirection.

```yaml
---
title: Frequently Asked Questions
description: Questions Asked Frequently.
weight: 13
aliases:
    - /help/faq
---
```

--------------------------------

### Install Istio with default profile

Source: https://istio.io/latest/docs/tasks/security/authentication/authn-policy

Installs Istio using the default configuration profile.

```bash
$ istioctl install --set profile=default
```

--------------------------------

### Install zsh-completions

Source: https://istio.io/latest/docs/ops/diagnostic-tools/istioctl

Install the zsh-completions package via Homebrew if it is missing.

```bash
$ brew install zsh-completions
```

--------------------------------

### Envoy Dashboard Examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples for accessing the Envoy dashboard for pods or deployments.

```bash
  # Open Envoy dashboard for the productpage-123-456.default pod
  istioctl dashboard envoy productpage-123-456.default

  # Open Envoy dashboard for one pod under a deployment
  istioctl dashboard envoy deployment/productpage-v1

  # with short syntax
  istioctl dash envoy productpage-123-456.default
  istioctl d envoy productpage-123-456.default
```

--------------------------------

### Install Istio ingress gateway

Source: https://istio.io/latest/docs/setup/install/helm

Creates a dedicated namespace and installs the gateway chart.

```bash
$ kubectl create namespace istio-ingress
$ helm install istio-ingress istio/gateway -n istio-ingress --wait
```

--------------------------------

### Install Istio Demo Profile

Source: https://istio.io/latest/docs/setup/getting-started

Installs Istio using the demo profile with gateways disabled.

```bash
$ istioctl install -f samples/bookinfo/demo-profile-no-gateways.yaml14 -y

✔ Istio core installed
✔ Istiod installed
✔ Installation complete
Made this installation the default for injection and validation.
```

--------------------------------

### Install Istio with demo profile

Source: https://istio.io/latest/docs/tasks/traffic-management/egress/wildcard-egress-hosts

Installs Istio with access logging and REGISTRY_ONLY outbound traffic policy.

```bash
$ istioctl install --set profile=demo --set meshConfig.outboundTrafficPolicy.mode=REGISTRY_ONLY
```

--------------------------------

### istioctl proxy-config ecds examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples for retrieving typed extension configuration from pods or local files.

```bash
  # Retrieve full typed extension configuration for a given pod from Envoy.
  istioctl proxy-config ecds <pod-name[.namespace]>

  # Retrieve full typed extension configuration for a pod under a deployment from Envoy.
  istioctl proxy-config ecds deployment/<deployment-name[.namespace]>

  # Retrieve endpoint summary without using Kubernetes API
  ssh <user@hostname> 'curl localhost:15000/config_dump' > envoy-config.json
  istioctl proxy-config ecds --file envoy-config.json
```

--------------------------------

### Install Istio components with istioctl

Source: https://istio.io/latest/docs/setup/additional-setup/config-profiles

Use the profile and platform flags as arguments with the istioctl install command.

```bash
$ istioctl install --set profile=default --set values.global.platform=gke
```

--------------------------------

### General Helm installation syntax

Source: https://istio.io/latest/docs/setup/install/helm

Standard syntax for installing a Helm chart with optional parameters.

```bash
$ helm install <release> <chart> --namespace <namespace> --create-namespace [--set <other_parameters>]
```

--------------------------------

### Install Istio with minimal profile

Source: https://istio.io/latest/docs/tasks/traffic-management/egress/wildcard-egress-hosts

Installs Istio with Gateway API support, access logging, and REGISTRY_ONLY policy.

```bash
$ istioctl install --set profile=minimal -y \
    --set values.pilot.env.PILOT_ENABLE_ALPHA_GATEWAY_API=true \
    --set meshConfig.accessLogFile=/dev/stdout \
    --set meshConfig.outboundTrafficPolicy.mode=REGISTRY_ONLY
```

--------------------------------

### Install Istio on minikube

Source: https://istio.io/latest/docs/ambient/install/platform-prerequisites

Use these commands to install Istio components on minikube with the Docker driver.

```bash
$ helm install istio-cni istio/cni -n istio-system --set profile=ambient --set global.platform=minikube --wait"
```

```bash
$ istioctl install --set profile=ambient --set values.global.platform=minikube"
```

--------------------------------

### Ztunnel logging examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples for retrieving log levels or updating them for specific pods or all Ztunnel instances.

```bash
  # Retrieve information about logging levels from all Ztunnel pods
 istioctl ztunnel-config log

 # Update levels of the all loggers for a specific Ztunnel pod
 istioctl ztunnel-config log <pod-name[.namespace]> --level off

 # Update levels of the specified loggers for all Ztunnl pods
 istioctl ztunnel-config log --level access:debug,info

 # Reset levels of all the loggers to default value (warning)  for a specific Ztunnel pod.
 istioctl ztunnel-config log <pod-name[.namespace]> -r
```

--------------------------------

### Configure workload entry examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples demonstrating configuration generation using either a local file or the API server.

```bash
  # configure example using a local WorkloadGroup artifact
  istioctl x workload entry configure -f workloadgroup.yaml -o config

  # configure example using the API server
  istioctl x workload entry configure --name foo --namespace bar -o config
```

--------------------------------

### ControlZ Dashboard Examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples for accessing the ControlZ dashboard using various selectors and short syntax.

```bash
  # Open ControlZ web UI for the istiod-56dd66799-jfdvs.istio-system pod
  istioctl dashboard controlz istiod-56dd66799-jfdvs.istio-system

  # Open ControlZ web UI for the istiod-56dd66799-jfdvs pod in a custom namespace
  istioctl dashboard controlz istiod-56dd66799-jfdvs -n custom-ns

  # Open ControlZ web UI for any Istiod pod
  istioctl dashboard controlz deployment/istiod.istio-system

  # with short syntax
  istioctl dash controlz istiod-56dd66799-jfdvs.istio-system
  istioctl d controlz istiod-56dd66799-jfdvs.istio-system
```

--------------------------------

### Setup Namespace for Health Check Example

Source: https://istio.io/latest/docs/ops/configuration/mesh/app-health-check

Creates a dedicated namespace for testing Istio health check samples.

```bash
$ kubectl create ns istio-io-health
```

--------------------------------

### Deploy Sample Application

Source: https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress

Commands to deploy the helloworld-v1 sample service.

```bash
$ kubectl apply -f samples/helloworld/helloworld.yaml14 -l service=helloworld
$ kubectl apply -f samples/helloworld/helloworld.yaml14 -l version=v1
```

--------------------------------

### Install Istio with distroless images

Source: https://istio.io/latest/docs/ops/configuration/security/harden-docker-images

Use the istioctl tool to configure the Istio installation to use distroless images.

```bash
$ istioctl install --set values.global.variant=distroless
```

--------------------------------

### Deploy Example Services

Source: https://istio.io/latest/docs/tasks/security/cert-management/plugin-ca-cert

Creates the 'foo' namespace and deploys the httpbin and curl sample services with Istio sidecar injection.

```bash
$ kubectl create ns foo
$ kubectl apply -f <(istioctl kube-inject -f samples/httpbin/httpbin.yaml) -n foo
$ kubectl apply -f <(istioctl kube-inject -f samples/curl/curl.yaml) -n foo
```

--------------------------------

### Deploy the HelloWorld service

Source: https://istio.io/latest/docs/setup/install/virtual-machine

Apply the service configuration file to the sample namespace.

```bash
$ kubectl apply -n sample -f samples/helloworld/helloworld.yaml14
```

--------------------------------

### Describe pod for startup failure diagnosis

Source: https://istio.io/latest/docs/ops/diagnostic-tools/cni

Command to inspect pod events when a pod fails to start due to network setup issues.

```bash
$ kubectl describe pod POD_NAME -n POD_NAMESPACE
```

--------------------------------

### Deploy sample applications

Source: https://istio.io/latest/docs/setup/install/multiple-controlplanes

Deploy curl and httpbin applications into each of the created namespaces.

```bash
$ kubectl -n app-ns-1 apply -f samples/curl/curl.yaml
$ kubectl -n app-ns-1 apply -f samples/httpbin/httpbin.yaml
$ kubectl -n app-ns-2 apply -f samples/curl/curl.yaml
$ kubectl -n app-ns-2 apply -f samples/httpbin/httpbin.yaml
$ kubectl -n app-ns-3 apply -f samples/curl/curl.yaml
$ kubectl -n app-ns-3 apply -f samples/httpbin/httpbin.yaml
```

--------------------------------

### istioctl install

Source: https://istio.io/latest/docs/reference/commands/istioctl

The install command generates an Istio install manifest and applies it to a cluster.

```APIDOC
## istioctl install

### Description
The install command generates an Istio install manifest and applies it to a cluster.

### Usage
`istioctl install [flags]`

### Flags
- **--as** (string) - Username to impersonate for the operation.
- **--as-group** (stringArray) - Group to impersonate for the operation.
- **--as-uid** (string) - UID to impersonate for the operation.
- **--context** (string) - Kubernetes configuration context.
- **--dry-run** (boolean) - Console/log output only, make no changes.
- **--filename, -f** (stringSlice) - Path to file containing IstioOperator custom resource.
- **--force** (boolean) - Proceed even with validation errors.
- **--istioNamespace, -i** (string) - Istio system namespace (default: istio-system).
- **--kubeconfig, -c** (string) - Kubernetes configuration file.
- **--manifests, -d** (string) - Path to a directory of charts and profiles.
- **--namespace, -n** (string) - Kubernetes namespace.
- **--revision, -r** (string) - Target control plane revision.
- **--set, -s** (stringArray) - Override an IstioOperator value.
- **--skip-confirmation, -y** (boolean) - Skip user confirmation prompt.

### Examples
```
# Apply a default Istio installation
istioctl install

# Enable Tracing
istioctl install --set meshConfig.enableTracing=true

# Generate the demo profile and don't wait for confirmation
istioctl install --set profile=demo --skip-confirmation
```
```

--------------------------------

### Installation Output

Source: https://istio.io/latest/docs/ambient/getting-started

Expected output after a successful Istio installation.

```text
✔ Istio core installed
✔ Istiod installed
✔ CNI installed
✔ Ztunnel installed
✔ Installation complete
```

--------------------------------

### Deploy Sample Applications

Source: https://istio.io/latest/docs/setup/install/external-controlplane

Deploys the helloworld and curl sample applications to the remote cluster.

```bash
$ kubectl apply -f samples/helloworld/helloworld.yaml8 -l service=helloworld -n sample --context="${CTX_REMOTE_CLUSTER}"
$ kubectl apply -f samples/helloworld/helloworld.yaml8 -l version=v1 -n sample --context="${CTX_REMOTE_CLUSTER}"
$ kubectl apply -f samples/curl/curl.yaml9 -n sample --context="${CTX_REMOTE_CLUSTER}"
```

--------------------------------

### Install Istio on MicroK8s

Source: https://istio.io/latest/docs/ambient/install/platform-prerequisites

Use these commands to install Istio components on MicroK8s.

```bash
$ helm install istio-cni istio/cni -n istio-system --set profile=ambient --set global.platform=microk8s --wait
```

```bash
$ istioctl install --set profile=ambient --set values.global.platform=microk8s
```

--------------------------------

### Start kubectl proxy

Source: https://istio.io/latest/docs/setup/platform-setup/k3d

Starts a local proxy to access the Kubernetes Dashboard.

```bash
$ kubectl proxy

Starting to serve on 127.0.0.1:8001
```

--------------------------------

### Ztunnel connection examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Examples for retrieving connection summaries based on nodes, Ztunnel instances, or specific workload pods.

```bash
  # Retrieve summary about connections for the ztunnel on a specific node.
  istioctl ztunnel-config connections --node ambient-worker

  # Retrieve summary of connections for a given Ztunnel instance.
  istioctl ztunnel-config connections <ztunnel-name[.namespace]>

  # Retrieve connections for a specific workload pod (auto-resolves to its ztunnel).
  istioctl ztunnel-config connections <workload-pod-name[.namespace]>
```

--------------------------------

### Create the working directory

Source: https://istio.io/latest/docs/setup/install/virtual-machine

Initialize the directory used for storing certificates and configuration files.

```bash
$ mkdir -p "${WORK_DIR}"
```

--------------------------------

### Install Istio Addons

Source: https://istio.io/latest/docs/examples/microservices-istio/setup-kubernetes-cluster

Deploys Kiali, Prometheus, and other addons using the provided samples directory.

```bash
$ kubectl apply -f samples/addons13
```

--------------------------------

### Deploy sample application

Source: https://istio.io/latest/docs/setup/additional-setup/pod-security-admission

Deploy the Bookinfo application using the PSA-compatible configuration.

```bash
$ kubectl apply -f samples/bookinfo/platform/kube/bookinfo-psa.yaml
```

--------------------------------

### Install MicroK8s

Source: https://istio.io/latest/docs/setup/platform-setup/microk8s

Installs the latest version of MicroK8s using the snap package manager.

```bash
$ sudo snap install microk8s --classic
```

--------------------------------

### Validate Helm installation

Source: https://istio.io/latest/docs/setup/install/helm

Lists installed Helm releases to verify the status of the deployment.

```bash
$ helm ls -n istio-system

NAME       NAMESPACE    REVISION UPDATED                                 STATUS   CHART        APP VERSION
istio-base istio-system 1        2024-04-17 22:14:45.964722028 +0000 UTC deployed base-1.30.2  1.30.2
```

```bash
$ helm ls -n istio-system

NAME       NAMESPACE    REVISION UPDATED                                 STATUS   CHART         APP VERSION
istio-base istio-system 1        2024-04-17 22:14:45.964722028 +0000 UTC deployed base-1.30.2   1.30.2
istiod     istio-system 1        2024-04-17 22:14:45.964722028 +0000 UTC deployed istiod-1.30.2 1.30.2
```

--------------------------------

### Start the Istio agent

Source: https://istio.io/latest/docs/setup/install/virtual-machine

Use systemctl to initiate the Istio agent service on the virtual machine.

```bash
$ sudo systemctl start istio
```

--------------------------------

### Check zsh-completions installation

Source: https://istio.io/latest/docs/ops/diagnostic-tools/istioctl

Verify if the zsh-completions package is installed on macOS using Homebrew.

```bash
$ brew list zsh-completions
```

--------------------------------

### Install Istio with Topology Configuration

Source: https://istio.io/latest/docs/ops/configuration/traffic-management/network-topologies

Create a configuration file with numTrustedProxies set to 2 and apply it using istioctl.

```bash
$ cat <<EOF > topology.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    defaultConfig:
      gatewayTopology:
        numTrustedProxies: 2
EOF
$ istioctl install -f topology.yaml
```

--------------------------------

### Install ztunnel data plane

Source: https://istio.io/latest/docs/ambient/install/multicluster/multi-primary_multi-network

Installs the ztunnel data plane component on cluster2.

```bash
$ helm install ztunnel istio/ztunnel -n istio-system --kube-context "${CTX_CLUSTER2}"  --set multiCluster.clusterName=cluster2 --set global.network=network2
```

--------------------------------

### Install Ztunnel via Helm

Source: https://istio.io/latest/docs/ambient/install/multicluster/multi-primary_multi-network

Installs the Ztunnel data plane component for cluster1.

```bash
$ helm install ztunnel istio/ztunnel -n istio-system --kube-context "${CTX_CLUSTER1}" --set multiCluster.clusterName=cluster1 --set global.network=network1
```

--------------------------------

### Deploy and verify initial application

Source: https://istio.io/latest/docs/setup/additional-setup/sidecar-injection

Deploy a sample application and verify that it runs with a single container before sidecar injection is enabled.

```bash
$ kubectl apply -f samples/curl/curl.yaml7
$ kubectl get deployment -o wide

NAME    READY   UP-TO-DATE   AVAILABLE   AGE   CONTAINERS   IMAGES                    SELECTOR
curl    1/1     1            1           12s   curl         curlimages/curl           app=curl
```

```bash
$ kubectl get pod

NAME                    READY   STATUS    RESTARTS   AGE
curl-8f795f47d-hdcgs    1/1     Running   0          42s
```

--------------------------------

### Install ztunnel DaemonSet

Source: https://istio.io/latest/docs/ambient/install/helm

Installs the ztunnel node proxy component into the istio-system namespace.

```bash
$ helm install ztunnel istio/ztunnel -n istio-system --wait
```

--------------------------------

### Install Base Components

Source: https://istio.io/latest/docs/ambient/install/helm

Install the base CRDs and cluster roles required for Istio.

```bash
$ helm install istio-base istio/base -n istio-system --create-namespace --wait
```

--------------------------------

### Set up kind clusters with load balancer support

Source: https://istio.io/latest/docs/setup/install/multicluster/before-you-begin

Use the provided script to initialize two clusters for testing purposes.

```bash
$ samples/kind-lb/setupkind.sh6 --cluster-name cluster-1 --ip-space 254
$ samples/kind-lb/setupkind.sh6 --cluster-name cluster-2 --ip-space 255
```

--------------------------------

### Install the root certificate

Source: https://istio.io/latest/docs/setup/install/virtual-machine

Create the directory and copy the root certificate to the required location.

```bash
$ sudo mkdir -p /etc/certs
$ sudo cp "${HOME}"/root-cert.pem /etc/certs/root-cert.pem
```

--------------------------------

### Install Istio Ambient Profile

Source: https://istio.io/latest/docs/ambient/getting-started

Installs Istio using the ambient configuration profile.

```bash
$ istioctl install --set profile=ambient --skip-confirmation
```

--------------------------------

### Install Istio with Sidecar TLS Termination

Source: https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-sidecar-tls-termination

Enable the experimental ENABLE_TLS_ON_SIDECAR_INGRESS feature during Istio installation.

```bash
$ istioctl install --set profile=default --set values.pilot.env.ENABLE_TLS_ON_SIDECAR_INGRESS=true
```

--------------------------------

### Install Istio with demo profile

Source: https://istio.io/latest/docs/setup/additional-setup/getting-started-istio-apis

Installs Istio using the demo configuration profile, which provides a set of defaults suitable for testing.

```bash
$ istioctl install --set profile=demo -y

✔ Istio core installed
✔ Istiod installed
✔ Egress gateways installed
✔ Ingress gateways installed
✔ Installation complete
```

--------------------------------

### Install Istio with operator configuration

Source: https://istio.io/latest/docs/tasks/observability/logs/otel-provider

Apply the IstioOperator configuration using the istioctl install command.

```bash
$ istioctl install -f <your-istio-operator-config-file>
```

--------------------------------

### Install Gateway using IstioOperator

Source: https://istio.io/latest/docs/setup/additional-setup/gateway

Apply the configuration file using istioctl after creating the target namespace.

```bash
$ kubectl create namespace istio-ingress
$ istioctl install -f ingress.yaml
```

--------------------------------

### Install Grafana Loki

Source: https://istio.io/latest/docs/tasks/observability/logs/telemetry-api

Installs Grafana Loki and the necessary OpenTelemetry configuration for log collection.

```bash
$ istioctl install -f samples/open-telemetry/loki/iop.yaml13 --skip-confirmation
$ kubectl apply -f samples/addons/loki.yaml14 -n istio-system
$ kubectl apply -f samples/open-telemetry/loki/otel.yaml15 -n istio-system
```

--------------------------------

### Setup test namespaces and services

Source: https://istio.io/latest/docs/tasks/security/authentication/authn-policy

Creates namespaces and deploys httpbin and curl services with and without sidecar injection.

```bash
$ kubectl create ns foo
$ kubectl apply -f <(istioctl kube-inject -f samples/httpbin/httpbin.yaml7) -n foo
$ kubectl apply -f <(istioctl kube-inject -f samples/curl/curl.yaml8) -n foo
$ kubectl create ns bar
$ kubectl apply -f <(istioctl kube-inject -f samples/httpbin/httpbin.yaml7) -n bar
$ kubectl apply -f <(istioctl kube-inject -f samples/curl/curl.yaml8) -n bar
$ kubectl create ns legacy
$ kubectl apply -f samples/httpbin/httpbin.yaml7 -n legacy
$ kubectl apply -f samples/curl/curl.yaml8 -n legacy
```

--------------------------------

### Install Istio control plane revisions

Source: https://istio.io/latest/docs/setup/upgrade/canary

Install multiple control plane revisions to the cluster.

```bash
$ istioctl install --revision=1-29-1 --set profile=minimal --skip-confirmation
$ istioctl install --revision=1-30-2 --set profile=minimal --skip-confirmation
```

--------------------------------

### Expose Application via Gateway

Source: https://istio.io/latest/docs/setup/install/external-controlplane

Applies gateway configuration for the helloworld sample application.

```bash
$ kubectl apply -f samples/helloworld/helloworld-gateway.yaml12 -n sample --context="${CTX_REMOTE_CLUSTER}"
```

```bash
$ kubectl apply -f samples/helloworld/gateway-api/helloworld-gateway.yaml13 -n sample --context="${CTX_REMOTE_CLUSTER}"
```

--------------------------------

### Verify Webhook Installation

Source: https://istio.io/latest/docs/setup/install/external-controlplane

Check that the mutating webhook configuration is correctly installed on the remote cluster.

```bash
$ kubectl get mutatingwebhookconfiguration --context="${CTX_SECOND_CLUSTER}"

NAME                                     WEBHOOKS   AGE
istio-sidecar-injector-external-istiod   4          4m13s
```

--------------------------------

### Install Istiod with Helm

Source: https://istio.io/latest/docs/setup/install/multicluster/primary-remote

Install the istiod chart with multi-cluster settings enabled for the primary cluster.

```bash
helm install istiod istio/istiod -n istio-system --kube-context "${CTX_CLUSTER1}" --set global.meshID=mesh1 --set global.externalIstiod=true --set global.multiCluster.clusterName=cluster1 --set global.network=network1
```

--------------------------------

### Deploy sample external authorizer

Source: https://istio.io/latest/docs/tasks/security/authorization/authz-custom

Apply the sample external authorizer configuration to the foo namespace.

```bash
$ kubectl apply -n foo -f https://raw.githubusercontent.com/istio/istio/release-1.30/samples/extauthz/ext-authz.yaml

service/ext-authz created
deployment.apps/ext-authz created
```

--------------------------------

### Install Istio with configuration

Source: https://istio.io/latest/docs/ops/integrations/spire

Applies the generated Istio configuration using istioctl.

```bash
$ istioctl install --skip-confirmation -f ./istio.yaml
```

--------------------------------

### Install a specific Istio profile

Source: https://istio.io/latest/docs/setup/install/istioctl

Apply a specific configuration profile, such as the demo profile, during installation.

```bash
$ istioctl install --set profile=demo
```

--------------------------------

### Create sample namespace

Source: https://istio.io/latest/docs/ambient/install/multicluster/verify

Creates the sample namespace in both clusters to host the application.

```bash
$ kubectl create --context="${CTX_CLUSTER1}" namespace sample
$ kubectl create --context="${CTX_CLUSTER2}" namespace sample
```

--------------------------------

### Start the service

Source: https://istio.io/latest/docs/examples/microservices-istio/single

Launch the service on port 9080 using npm.

```bash
$ npm start 9080

> @ start /tmp/ratings
> node ratings.js "9080"
Server listening on: http://0.0.0.0:9080
```

--------------------------------

### Inspect installed NetworkPolicies

Source: https://istio.io/latest/docs/setup/additional-setup/network-policy

List all NetworkPolicy resources within the istio-system namespace to verify installation.

```bash
$ kubectl get networkpolicy -n istio-system
```

--------------------------------

### Configure installation with IstioOperator file

Source: https://istio.io/latest/docs/setup/install/istioctl

Uses a YAML configuration file to define installation parameters, which is recommended for production environments.

```bash
$ cat <<EOF > ./my-config.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    accessLogFile: /dev/stdout
EOF
$ istioctl install -f my-config.yaml
```

--------------------------------

### Install SPIRE CRDs

Source: https://istio.io/latest/docs/ops/integrations/spire

Installs the necessary SPIRE Custom Resource Definitions into the spire-server namespace.

```bash
$ helm upgrade --install -n spire-server spire-crds spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace
```

--------------------------------

### Install service dependencies

Source: https://istio.io/latest/docs/examples/microservices-istio/single

Install required Node.js packages using npm in the service directory.

```bash
$ npm install

npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN ratings No description
npm WARN ratings No repository field.
npm WARN ratings No license field.

added 24 packages in 2.094s
```

--------------------------------

### Deploy httpbin Workload

Source: https://istio.io/latest/docs/ops/configuration/traffic-management/network-topologies

Deploy the httpbin sample application into the prepared namespace.

```bash
$ kubectl apply -n httpbin -f samples/httpbin/httpbin.yaml11
```

--------------------------------

### Bootstrap configuration examples

Source: https://istio.io/latest/docs/reference/commands/istioctl

Common usage patterns for retrieving bootstrap configuration, including file-based analysis and output formatting.

```bash
  # Retrieve full bootstrap configuration for a given pod from Envoy.
  istioctl proxy-config bootstrap <pod-name[.namespace]>

  # Retrieve full bootstrap configuration for a pod under a deployment from Envoy.
  istioctl proxy-config bootstrap deployment/<deployment-name[.namespace]>

  # Retrieve full bootstrap without using Kubernetes API
  ssh <user@hostname> 'curl localhost:15000/config_dump' > envoy-config.json
  istioctl proxy-config bootstrap --file envoy-config.json

  # Show a human-readable Istio and Envoy version summary
  istioctl proxy-config bootstrap <pod-name[.namespace]> -o short
```

--------------------------------

### Verify istioctl installation

Source: https://istio.io/latest/docs/examples/microservices-istio/setup-local-computer

Confirms that the istioctl command line tool is correctly installed and accessible.

```bash
$ istioctl version

client version: 1.22.0
control plane version: 1.22.0
data plane version: 1.22.0 (4 proxies)
```

--------------------------------

### Install Istiod chart

Source: https://istio.io/latest/docs/ambient/install/multicluster/multi-primary_multi-network

Installs the Istiod control plane on cluster2 with multi-cluster and ambient settings.

```bash
$ helm install istiod istio/istiod -n istio-system --kube-context "${CTX_CLUSTER2}" --set global.meshID=mesh1 --set global.multiCluster.clusterName=cluster2 --set global.network=network2 --set profile=ambient --set env.AMBIENT_ENABLE_MULTI_NETWORK="true" --set env.AMBIENT_ENABLE_BAGGAGE="true"
```

--------------------------------

### Deploy Sample Services and Namespaces

Source: https://istio.io/latest/docs/tasks/security/authorization/authz-td-migration

Labels namespaces for sidecar injection and deploys the httpbin and curl sample applications.

```bash
$ kubectl label namespace default istio-injection=enabled
$ kubectl apply -f samples/httpbin/httpbin.yaml8
$ kubectl apply -f samples/curl/curl.yaml9
$ kubectl create namespace curl-allow
$ kubectl label namespace curl-allow istio-injection=enabled
$ kubectl apply -f samples/curl/curl.yaml9 -n curl-allow
```