istio-istiod
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
2
# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
3
image: cgr.dev/chainguard-private/istio-pilot:1.30@sha256:085774899c90b3a718ef480dc4cb5746ceeca453b4e00052f5565dec9a160bdd
4
global:
5
proxy:
6
image: cgr.dev/chainguard-private/istio-proxy:1.30@sha256:da548145a4e31227a5e1c15bb7f5b915693e3d2b24e1dda983060f250f2bad36
7
proxy_init:
8
image: cgr.dev/chainguard-private/istio-proxy:1.30@sha256:da548145a4e31227a5e1c15bb7f5b915693e3d2b24e1dda983060f250f2bad36
9
_internal_defaults_do_not_set:
10
autoscaleEnabled: true
11
autoscaleMin: 1
12
autoscaleMax: 5
13
autoscaleBehavior: {}
14
replicaCount: 1
15
rollingMaxSurge: 100%
16
rollingMaxUnavailable: 25%
17
hub: ""
18
tag: ""
19
variant: ""
20
# Can be a full hub/image:tag
21
image: pilot
22
traceSampling: 1.0
23
# Resources for a small pilot install
24
resources:
25
requests:
26
cpu: 500m
27
memory: 2048Mi
28
# Set to `type: RuntimeDefault` to use the default profile if available.
29
seccompProfile: {}
30
# Whether to use an existing CNI installation
31
cni:
32
enabled: false
33
provider: default
34
# Additional container arguments
35
extraContainerArgs: []
36
env: {}
37
envVarFrom: []
38
# Settings related to the untaint controller
39
# This controller will remove the named taint (default `cni.istio.io/not-ready`) from nodes when the istio-cni pod becomes ready.
40
# It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
41
taint:
42
# Controls whether or not the untaint controller is active
43
# When enabled, this automatically sets PILOT_ENABLE_NODE_UNTAINT_CONTROLLERS environment variable to true in the istiod deployment.
44
enabled: false
45
# What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
46
namespace: ""
47
# The taint key used by the node-untaint controller to identify nodes that should be untainted.
48
name: cni.istio.io/not-ready
49
affinity: {}
50
tolerations: []
51
cpu:
52
targetAverageUtilization: 80
53
memory: {}
54
# targetAverageUtilization: 80
55
56
# Additional volumeMounts to the istiod container
57
volumeMounts: []
58
# Additional volumes to the istiod pod
59
volumes: []
60
# Inject initContainers into the istiod pod
61
initContainers: []
62
nodeSelector: {}
63
podAnnotations: {}
64
serviceAnnotations: {}
65
serviceAccountAnnotations: {}
66
sidecarInjectorWebhookAnnotations: {}
67
topologySpreadConstraints: []
68
# You can use jwksResolverExtraRootCA to provide a root certificate
69
# in PEM format. This will then be trusted by pilot when resolving
70
# JWKS URIs.
71
jwksResolverExtraRootCA: ""
72
# The following is used to limit how long a sidecar can be connected
73
# to a pilot. It balances out load across pilot instances at the cost of
74
# increasing system churn.
75
keepaliveMaxServerConnectionAge: 30m
76
# Additional labels to apply to the deployment.
77
deploymentLabels: {}
78
# Annotations to apply to the istiod deployment.
79
deploymentAnnotations: {}
80
## Mesh config settings
81
82
# Install the mesh config map, generated from values.yaml.
83
# If false, pilot wil use default values (by default) or user-supplied values.
84
configMap: true
85
# Additional labels to apply on the pod level for monitoring and logging configuration.
86
podLabels: {}
87
# Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
88
ipFamilyPolicy: ""
89
ipFamilies: []
90
# Ambient mode only.
91
# Set this if you install ztunnel to a different namespace from `istiod`.
92
# If set, `istiod` will allow connections from trusted node proxy ztunnels
93
# in the provided namespace.
94
# If unset, `istiod` will assume the trusted node proxy ztunnel resides
95
# in the same namespace as itself.
96
trustedZtunnelNamespace: ""
97
# Set this if you install ztunnel with a name different from the default.
98
trustedZtunnelName: ""
99
sidecarInjectorWebhook:
100
# You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
101
# always skip the injection on pods that match that label selector, regardless of the global policy.
102
# See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
103
neverInjectSelector: []
104
alwaysInjectSelector: []
105
# injectedAnnotations are additional annotations that will be added to the pod spec after injection
106
# This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
107
#
108
# annotations:
109
# apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
110
# apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
111
#
112
# The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
113
# the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
114
# injectedAnnotations:
115
# container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
116
# container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
117
injectedAnnotations: {}
118
# This enables injection of sidecar in all namespaces,
119
# with the exception of namespaces with "istio-injection:disabled" annotation
120
# Only one environment should have this enabled.
121
enableNamespacesByDefault: false
122
# Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
123
# once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
124
# Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
125
reinvocationPolicy: Never
126
rewriteAppHTTPProbe: true
127
# Templates defines a set of custom injection templates that can be used. For example, defining:
128
#
129
# templates:
130
# hello: |
131
# metadata:
132
# labels:
133
# hello: world
134
#
135
# Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
136
# being injected with the hello=world labels.
137
# This is intended for advanced configuration only; most users should use the built in template
138
templates: {}
139
# Default templates specifies a set of default templates that are used in sidecar injection.
140
# By default, a template `sidecar` is always provided, which contains the template of default sidecar.
141
# To inject other additional templates, define it using the `templates` option, and add it to
142
# the default templates list.
143
# For example:
144
#
145
# templates:
146
# hello: |
147
# metadata:
148
# labels:
149
# hello: world
150
#
151
# defaultTemplates: ["sidecar", "hello"]
152
defaultTemplates: []
153
istiodRemote:
154
# If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
155
# and istiod itself will NOT be installed in this cluster - only the support resources necessary
156
# to utilize a remote instance.
157
enabled: false
158
# If `true`, indicates that this cluster/install should consume a "local istiod" installation,
159
# local istiod inject sidecars
160
enabledLocalInjectorIstiod: false
161
# Sidecar injector mutating webhook configuration clientConfig.url value.
162
# For example: https://$remotePilotAddress:15017/inject
163
# The host should not refer to a service running in the cluster; use a service reference by specifying
164
# the clientConfig.service field instead.
165
injectionURL: ""
166
# Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
167
# Override to pass env variables, for example: /inject/cluster/remote/net/network2
168
injectionPath: "/inject"
169
injectionCABundle: ""
170
telemetry:
171
enabled: true
172
v2:
173
# For Null VM case now.
174
# This also enables metadata exchange.
175
enabled: true
176
# Indicate if prometheus stats filter is enabled or not
177
prometheus:
178
enabled: true
179
# stackdriver filter settings.
180
stackdriver:
181
enabled: false
182
# Revision is set as 'version' label and part of the resource names when installing multiple control planes.
183
revision: ""
184
# Revision tags are aliases to Istio control plane revisions
185
revisionTags: []
186
# For Helm compatibility.
187
ownerName: ""
188
# meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
189
# See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
190
meshConfig:
191
enablePrometheusMerge: true
192
experimental:
193
stableValidationPolicy: false
194
global:
195
# Used to locate istiod.
196
istioNamespace: istio-system
197
# List of cert-signers to allow "approve" action in the istio cluster role
198
#
199
# certSigners:
200
# - clusterissuers.cert-manager.io/istio-ca
201
certSigners: []
202
# enable pod disruption budget for the control plane, which is used to
203
# ensure Istio control plane components are gradually upgraded or recovered.
204
defaultPodDisruptionBudget:
205
enabled: true
206
# The values aren't mutable due to a current PodDisruptionBudget limitation
207
# minAvailable: 1
208
# A minimal set of requested resources to applied to all deployments so that
209
# Horizontal Pod Autoscaler will be able to function (if set).
210
# Each component can overwrite these default values by adding its own resources
211
# block in the relevant section below and setting the desired resources values.
212
defaultResources:
213
requests:
214
cpu: 10m
215
# memory: 128Mi
216
# limits:
217
# cpu: 100m
218
# memory: 128Mi
219
# Default hub for Istio images.
220
# Releases are published to docker hub under 'istio' project.
221
# Dev builds from prow are on registry.istio.io/testing.
222
hub: registry.istio.io/testing
223
# Default tag for Istio images.
224
tag: latest
225
# Variant of the image to use.
226
# Currently supported are: [debug, distroless]
227
variant: ""
228
# Specify image pull policy if default behavior isn't desired.
229
# Default behavior: latest images will be Always else IfNotPresent.
230
imagePullPolicy: ""
231
# ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
232
# to use for pulling any images in pods that reference this ServiceAccount.
233
# For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
234
# ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
235
# Must be set for any cluster configured with private docker registry.
236
imagePullSecrets: []
237
# - private-registry-key
238
239
# Enabled by default in master for maximising testing.
240
istiod:
241
enableAnalysis: false
242
# To output all istio components logs in json format by adding --log_as_json argument to each container argument
243
logAsJson: false
244
# In order to use native nftable rules instead of iptable rules, set this flag to true.
245
nativeNftables: false
246
# Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
247
# The control plane has different scopes depending on component, but can configure default log level across all components
248
# If empty, default scope and level will be used as configured in code
249
logging:
250
level: "default:info"
251
# When enabled, default NetworkPolicy resources will be created
252
networkPolicy:
253
enabled: false
254
omitSidecarInjectorConfigMap: false
255
# resourceScope controls what resources will be processed by helm.
256
# This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
257
# It can be one of:
258
# - all: all resources are processed
259
# - cluster: only cluster-scoped resources are processed
260
# - namespace: only namespace-scoped resources are processed
261
resourceScope: all
262
# Configure whether Operator manages webhook configurations. The current behavior
263
# of Istiod is to manage its own webhook configurations.
264
# When this option is set as true, Istio Operator, instead of webhooks, manages the
265
# webhook configurations. When this option is set as false, webhooks manage their
266
# own webhook configurations.
267
operatorManageWebhooks: false
268
# Custom DNS config for the pod to resolve names of services in other
269
# clusters. Use this to add additional search domains, and other settings.
270
# see
271
# https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
272
# This does not apply to gateway pods as they typically need a different
273
# set of DNS settings than the normal application pods (e.g., in
274
# multicluster scenarios).
275
# NOTE: If using templates, follow the pattern in the commented example below.
276
#podDNSSearchNamespaces:
277
#- global
278
#- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
279
280
# Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
281
# system-node-critical, it is better to configure this in order to make sure your Istio pods
282
# will not be killed because of low priority class.
283
# Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
284
# for more detail.
285
priorityClassName: ""
286
proxy:
287
image: proxyv2
288
# This controls the 'policy' in the sidecar injector.
289
autoInject: enabled
290
# CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
291
# cluster domain. Default value is "cluster.local".
292
clusterDomain: "cluster.local"
293
# Per Component log level for proxy, applies to gateways and sidecars. If a component level is
294
# not set, then the global "logLevel" will be used.
295
componentLogLevel: "misc:error"
296
# istio ingress capture allowlist
297
# examples:
298
# Redirect only selected ports: --includeInboundPorts="80,8080"
299
excludeInboundPorts: ""
300
includeInboundPorts: "*"
301
# istio egress capture allowlist
302
# https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
303
# example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
304
# would only capture egress traffic on those two IP Ranges, all other outbound traffic would
305
# be allowed by the sidecar
306
includeIPRanges: "*"
307
excludeIPRanges: ""
308
includeOutboundPorts: ""
309
excludeOutboundPorts: ""
310
# Log level for proxy, applies to gateways and sidecars.
311
# Expected values are: trace|debug|info|warning|error|critical|off
312
logLevel: warning
313
# Specify the path to the outlier event log.
314
# Example: /dev/stdout
315
outlierLogPath: ""
316
#If set to true, istio-proxy container will have privileged securityContext
317
privileged: false
318
seccompProfile: {}
319
# The number of successive failed probes before indicating readiness failure.
320
readinessFailureThreshold: 4
321
# The initial delay for readiness probes in seconds.
322
readinessInitialDelaySeconds: 0
323
# The period between readiness probes.
324
readinessPeriodSeconds: 15
325
# Enables or disables a startup probe.
326
# For optimal startup times, changing this should be tied to the readiness probe values.
327
#
328
# If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
329
# This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
330
# and doesn't spam the readiness endpoint too much
331
#
332
# If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
333
# This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
334
startupProbe:
335
enabled: true
336
failureThreshold: 600 # 10 minutes
337
# Resources for the sidecar.
338
resources:
339
requests:
340
cpu: 100m
341
memory: 128Mi
342
limits:
343
cpu: 2000m
344
memory: 1024Mi
345
# Default port for Pilot agent health checks. A value of 0 will disable health checking.
346
statusPort: 15020
347
# Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
348
# If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
349
tracer: "none"
350
proxy_init:
351
# Base name for the proxy_init container, used to configure iptables.
352
image: proxyv2
353
# Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
354
# Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
355
forceApplyIptables: false
356
# configure remote pilot and istiod service and endpoint
357
remotePilotAddress: ""
358
##############################################################################################
359
# The following values are found in other charts. To effectively modify these values, make #
360
# make sure they are consistent across your Istio helm charts #
361
##############################################################################################
362
363
# The customized CA address to retrieve certificates for the pods in the cluster.
364
# CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
365
# If not set explicitly, default to the Istio discovery address.
366
caAddress: ""
367
# Enable control of remote clusters.
368
externalIstiod: false
369
# Configure a remote cluster as the config cluster for an external istiod.
370
configCluster: false
371
# configValidation enables the validation webhook for Istio configuration.
372
configValidation: true
373
# Mesh ID means Mesh Identifier. It should be unique within the scope where
374
# meshes will interact with each other, but it is not required to be
375
# globally/universally unique. For example, if any of the following are true,
376
# then two meshes must have different Mesh IDs:
377
# - Meshes will have their telemetry aggregated in one place
378
# - Meshes will be federated together
379
# - Policy will be written referencing one mesh from the other
380
#
381
# If an administrator expects that any of these conditions may become true in
382
# the future, they should ensure their meshes have different Mesh IDs
383
# assigned.
384
#
385
# Within a multicluster mesh, each cluster must be (manually or auto)
386
# configured to have the same Mesh ID value. If an existing cluster 'joins' a
387
# multicluster mesh, it will need to be migrated to the new mesh ID. Details
388
# of migration TBD, and it may be a disruptive operation to change the Mesh
389
# ID post-install.
390
#
391
# If the mesh admin does not specify a value, Istio will use the value of the
392
# mesh's Trust Domain. The best practice is to select a proper Trust Domain
393
# value.
394
meshID: ""
395
# Configure the mesh networks to be used by the Split Horizon EDS.
396
#
397
# The following example defines two networks with different endpoints association methods.
398
# For `network1` all endpoints that their IP belongs to the provided CIDR range will be
399
# mapped to network1. The gateway for this network example is specified by its public IP
400
# address and port.
401
# The second network, `network2`, in this example is defined differently with all endpoints
402
# retrieved through the specified Multi-Cluster registry being mapped to network2. The
403
# gateway is also defined differently with the name of the gateway service on the remote
404
# cluster. The public IP for the gateway will be determined from that remote service (only
405
# LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
406
# it still need to be configured manually).
407
#
408
# meshNetworks:
409
# network1:
410
# endpoints:
411
# - fromCidr: "192.168.0.1/24"
412
# gateways:
413
# - address: 1.1.1.1
414
# port: 80
415
# network2:
416
# endpoints:
417
# - fromRegistry: reg1
418
# gateways:
419
# - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
420
# port: 443
421
#
422
meshNetworks: {}
423
# Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
424
mountMtlsCerts: false
425
multiCluster:
426
# Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
427
# to properly label proxies
428
clusterName: ""
429
# Network defines the network this cluster belong to. This name
430
# corresponds to the networks in the map of mesh networks.
431
network: ""
432
# Configure the certificate provider for control plane communication.
433
# Currently, two providers are supported: "kubernetes" and "istiod".
434
# As some platforms may not have kubernetes signing APIs,
435
# Istiod is the default
436
pilotCertProvider: istiod
437
sds:
438
# The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
439
# When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
440
# JWT is intended for the CA.
441
token:
442
aud: istio-ca
443
sts:
444
# The service port used by Security Token Service (STS) server to handle token exchange requests.
445
# Setting this port to a non-zero value enables STS server.
446
servicePort: 0
447
# The name of the CA for workload certificates.
448
# For example, when caName=GkeWorkloadCertificate, GKE workload certificates
449
# will be used as the certificates for workloads.
450
# The default value is "" and when caName="", the CA will be configured by other
451
# mechanisms (e.g., environmental variable CA_PROVIDER).
452
caName: ""
453
waypoint:
454
# Resources for the waypoint proxy.
455
resources:
456
requests:
457
cpu: 100m
458
memory: 128Mi
459
limits:
460
cpu: "2"
461
memory: 1Gi
462
# If specified, affinity defines the scheduling constraints of waypoint pods.
463
affinity: {}
464
# Topology Spread Constraints for the waypoint proxy.
465
topologySpreadConstraints: []
466
# Node labels for the waypoint proxy.
467
nodeSelector: {}
468
# Tolerations for the waypoint proxy.
469
tolerations: []
470
base:
471
# For istioctl usage to disable istio config crds in base
472
enableIstioConfigCRDs: true
473
# Override the failurePolicy for the validation webhook.
474
# By default, the webhook starts with "Ignore" and istiod flips it to "Fail" once ready.
475
# Set to "Fail" to avoid the flip-flop, which is useful for server-side apply tools
476
# that do not support .Release.IsUpgrade (e.g. helm template | kubectl apply --server-side).
477
# validationFailurePolicy: Fail
478
# Gateway Settings
479
gateways:
480
# Define the security context for the pod.
481
# If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
482
# On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
483
securityContext: {}
484
# Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
485
seccompProfile: {}
486
# gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
487
# For example:
488
# gatewayClasses:
489
# istio:
490
# service:
491
# spec:
492
# type: ClusterIP
493
# Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
494
gatewayClasses: {}
495
pdb:
496
# -- Minimum available pods set in PodDisruptionBudget.
497
# Define either 'minAvailable' or 'maxUnavailable', never both.
498
minAvailable: 1
499
# -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
500
# maxUnavailable: 1
501
# -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.
502
# Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/
503
unhealthyPodEvictionPolicy: ""
504
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.