istio-cni
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
2
# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
3
image: istio-install-cni
4
global:
5
hub: cgr.dev/chainguard-private
6
tag: 1.28@sha256:6592fedd3bb24af06b72c4497572aa2139b42fb83cdfc13a7594454b63e5f855
7
variant: ""
8
_internal_defaults_do_not_set:
9
hub: ""
10
tag: ""
11
variant: ""
12
image: install-cni
13
pullPolicy: ""
14
# Same as `global.logging.level`, but will override it if set
15
logging:
16
level: ""
17
# Configuration file to insert istio-cni plugin configuration
18
# by default this will be the first file found in the cni-conf-dir
19
# Example
20
# cniConfFileName: 10-calico.conflist
21
22
# CNI-and-platform specific path defaults.
23
# These may need to be set to platform-specific values, consult
24
# overrides for your platform in `manifests/helm-profiles/platform-*.yaml`
25
cniBinDir: /opt/cni/bin
26
cniConfDir: /etc/cni/net.d
27
cniConfFileName: ""
28
cniNetnsDir: "/var/run/netns"
29
# If Istio owned CNI config is enabled, defaults to 02-istio-cni.conflist
30
istioOwnedCNIConfigFileName: ""
31
istioOwnedCNIConfig: false
32
excludeNamespaces:
33
- kube-system
34
# Allows user to set custom affinity for the DaemonSet
35
affinity: {}
36
# Additional labels to apply on the daemonset level
37
daemonSetLabels: {}
38
# Custom annotations on pod level, if you need them
39
podAnnotations: {}
40
# Additional labels to apply on the pod level
41
podLabels: {}
42
# Deploy the config files as plugin chain (value "true") or as standalone files in the conf dir (value "false")?
43
# Some k8s flavors (e.g. OpenShift) do not support the chain approach, set to false if this is the case
44
chained: true
45
# Custom configuration happens based on the CNI provider.
46
# Possible values: "default", "multus"
47
provider: "default"
48
# Configure ambient settings
49
ambient:
50
# If enabled, ambient redirection will be enabled
51
enabled: false
52
# If ambient is enabled, this selector will be used to identify the ambient-enabled pods
53
enablementSelectors:
54
- podSelector:
55
matchLabels: {istio.io/dataplane-mode: ambient}
56
- podSelector:
57
matchExpressions:
58
- {key: istio.io/dataplane-mode, operator: NotIn, values: [none]}
59
namespaceSelector:
60
matchLabels: {istio.io/dataplane-mode: ambient}
61
# Set ambient config dir path: defaults to /etc/ambient-config
62
configDir: ""
63
# If enabled, and ambient is enabled, DNS redirection will be enabled
64
dnsCapture: true
65
# If enabled, and ambient is enabled, enables ipv6 support
66
ipv6: true
67
# If enabled, and ambient is enabled, the CNI agent will reconcile incompatible iptables rules and chains at startup.
68
# This will eventually be enabled by default
69
reconcileIptablesOnStartup: false
70
# If enabled, and ambient is enabled, the CNI agent will always share the network namespace of the host node it is running on
71
shareHostNetworkNamespace: false
72
# If enabled, the CNI agent will retry checking if a pod is ambient enabled when there are errors
73
enableAmbientDetectionRetry: false
74
repair:
75
enabled: true
76
hub: ""
77
tag: ""
78
# Repair controller has 3 modes. Pick which one meets your use cases. Note only one may be used.
79
# This defines the action the controller will take when a pod is detected as broken.
80
81
# labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
82
# This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
83
# Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
84
labelPods: false
85
# deletePods will delete any broken pod. These will then be rescheduled, hopefully onto a node that is fully ready.
86
# Note this gives the DaemonSet a relatively high privilege, as it can delete any Pod.
87
deletePods: false
88
# repairPods will dynamically repair any broken pod by setting up the pod networking configuration even after it has started.
89
# Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
90
# This requires no RBAC privilege, but does require `securityContext.privileged/CAP_SYS_ADMIN`.
91
repairPods: true
92
initContainerName: "istio-validation"
93
brokenPodLabelKey: "cni.istio.io/uninitialized"
94
brokenPodLabelValue: "true"
95
# Set to `type: RuntimeDefault` to use the default profile if available.
96
seccompProfile: {}
97
# SELinux options to set in the istio-cni-node pods. You may need to set this to `type: spc_t` for some platforms.
98
seLinuxOptions: {}
99
resources:
100
requests:
101
cpu: 100m
102
memory: 100Mi
103
resourceQuotas:
104
enabled: false
105
pods: 5000
106
tolerations:
107
# Make sure istio-cni-node gets scheduled on all nodes.
108
- effect: NoSchedule
109
operator: Exists
110
# Mark the pod as a critical add-on for rescheduling.
111
- key: CriticalAddonsOnly
112
operator: Exists
113
- effect: NoExecute
114
operator: Exists
115
# K8s DaemonSet update strategy.
116
# https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/daemon-set-v1/#DaemonSetSpec).
117
updateStrategy:
118
type: RollingUpdate
119
rollingUpdate:
120
maxUnavailable: 1
121
# Revision is set as 'version' label and part of the resource names when installing multiple control planes.
122
revision: ""
123
# For Helm compatibility.
124
ownerName: ""
125
global:
126
# Default hub for Istio images.
127
# Releases are published to docker hub under 'istio' project.
128
# Dev builds from prow are on gcr.io
129
hub: gcr.io/istio-testing
130
# Default tag for Istio images.
131
tag: latest
132
# Variant of the image to use.
133
# Currently supported are: [debug, distroless]
134
variant: ""
135
# Specify image pull policy if default behavior isn't desired.
136
# Default behavior: latest images will be Always else IfNotPresent.
137
imagePullPolicy: ""
138
# change cni scope level to control logging out of istio-cni-node DaemonSet
139
logging:
140
level: info
141
logAsJson: false
142
# ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
143
# to use for pulling any images in pods that reference this ServiceAccount.
144
# For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
145
# ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
146
# Must be set for any cluster configured with private docker registry.
147
imagePullSecrets: []
148
# - private-registry-key
149
150
# Default resources allocated
151
defaultResources:
152
requests:
153
cpu: 100m
154
memory: 100Mi
155
# In order to use native nftable rules instead of iptable rules, set this flag to true.
156
nativeNftables: false
157
# resourceScope controls what resources will be processed by helm.
158
# This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
159
# It can be one of:
160
# - all: all resources are processed
161
# - cluster: only cluster-scoped resources are processed
162
# - namespace: only namespace-scoped resources are processed
163
resourceScope: all
164
# A `key: value` mapping of environment variables to add to the pod
165
env: {}
166
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.