istio-base
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
2
# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
3
_internal_defaults_do_not_set:
4
global:
5
6
# ImagePullSecrets for control plane ServiceAccount, list of secrets in the same namespace
7
# to use for pulling any images in pods that reference this ServiceAccount.
8
# Must be set for any cluster configured with private docker registry.
9
imagePullSecrets: []
10
11
# Used to locate istiod.
12
istioNamespace: istio-system
13
14
# resourceScope controls what resources will be processed by helm.
15
# This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
16
# It can be one of:
17
# - all: all resources are processed
18
# - cluster: only cluster-scoped resources are processed
19
# - namespace: only namespace-scoped resources are processed
20
resourceScope: all
21
22
# If true, install the istio-reader ServiceAccount and associated ClusterRole/ClusterRoleBinding.
23
# These are only needed for multicluster remote-secret workflows.
24
enableReaderRBAC: true
25
base:
26
# A list of CRDs to exclude. Requires `enableCRDTemplates` to be true.
27
# Example: `excludedCRDs: ["envoyfilters.networking.istio.io"]`.
28
# Note: when installing with `istioctl`, `enableIstioConfigCRDs=false` must also be set.
29
excludedCRDs: []
30
# Helm (as of V3) does not support upgrading CRDs, because it is not universally
31
# safe for them to support this.
32
# Istio as a project enforces certain backwards-compat guarantees that allow us
33
# to safely upgrade CRDs in spite of this, so we default to self-managing CRDs
34
# as standard K8S resources in Helm, and disable Helm's CRD management. See also:
35
# https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#method-2-separate-charts
36
enableCRDTemplates: true
37
38
# Validation webhook configuration url
39
# For example: https://$remotePilotAddress:15017/validate
40
validationURL: ""
41
# Validation webhook caBundle value. Useful when running pilot with a well known cert
42
validationCABundle: ""
43
44
# For istioctl usage to disable istio config crds in base
45
enableIstioConfigCRDs: true
46
47
defaultRevision: "default"
48
experimental:
49
stableValidationPolicy: false
50
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.