istio-cni

Istio

Chainguard's redistribution of the Istio Helm charts, pre-configured with hardened Chainguard Images.

Prerequisites

Authentication is required to access these charts and their images. First, authenticate with Chainguard and configure your environment:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret for the cluster:

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace istio-system

Available Charts

Installation

Sidecar Mode

Install the components in order:

# 1. Base (CRDs and cluster resources)
helm install istio-base oci://cgr.dev/ORGANIZATION/charts/istio-base \
  --namespace istio-system \
  --create-namespace \
  --set defaultRevision=default \
  --set global.imagePullSecrets[0].name=cgr-pull-secret \
  --wait

# 2. Istiod (control plane)
helm install istiod oci://cgr.dev/ORGANIZATION/charts/istio-istiod \
  --namespace istio-system \
  --set global.imagePullSecrets[0].name=cgr-pull-secret \
  --wait

# 3. Gateway (optional)
kubectl create namespace istio-ingress
kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace istio-ingress

helm install istio-gateway oci://cgr.dev/ORGANIZATION/charts/istio-gateway \
  --namespace istio-ingress \
  --set imagePullSecrets[0].name=cgr-pull-secret \
  --wait

Ambient Mode

For ambient mesh, install CNI and ztunnel:

# 1. Base
helm install istio-base oci://cgr.dev/ORGANIZATION/charts/istio-base \
  --namespace istio-system \
  --create-namespace \
  --set defaultRevision=default \
  --set global.imagePullSecrets[0].name=cgr-pull-secret \
  --wait

# 2. Istiod with ambient profile
helm install istiod oci://cgr.dev/ORGANIZATION/charts/istio-istiod \
  --namespace istio-system \
  --set profile=ambient \
  --set global.imagePullSecrets[0].name=cgr-pull-secret \
  --wait

# 3. CNI
helm install istio-cni oci://cgr.dev/ORGANIZATION/charts/istio-cni \
  --namespace istio-system \
  --set profile=ambient \
  --set global.imagePullSecrets[0].name=cgr-pull-secret \
  --wait

# 4. Ztunnel
helm install ztunnel oci://cgr.dev/ORGANIZATION/charts/istio-ztunnel \
  --namespace istio-system \
  --set imagePullSecrets[0].name=cgr-pull-secret \
  --wait

# 5. Gateway (optional)
kubectl create namespace istio-ingress
kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace istio-ingress

helm install istio-gateway oci://cgr.dev/ORGANIZATION/charts/istio-gateway \
  --namespace istio-ingress \
  --set imagePullSecrets[0].name=cgr-pull-secret \
  --wait

About These Charts

These are redistributions of the upstream Istio Helm charts. All upstream configuration options and documentation apply.

For full documentation, see: https://istio.io/latest/docs/setup/install/helm/