istio-istiod
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# "_internal_defaults_do_not_set" is a workaround for Helm limitations. Users should NOT set "._internal_defaults_do_not_set" explicitly, but rather directly set the fields internally.
2
# For instance, instead of `--set _internal_defaults_do_not_set.foo=bar``, just set `--set foo=bar`.
3
image: istio-pilot
4
tag: 1.31@sha256:aaa118c9616d32ede7cdbc2ceff709e34660e5e1f0c580fe3dbac9c3f7658647
5
global:
6
hub: cgr.dev/chainguard-private
7
tag: 1.31@sha256:431071685bddf6da7fa0550fb4f22a46f4e722bb036cf033e9335d2ac8fc4179
8
variant: ""
9
proxy:
10
image: istio-proxy
11
proxy_init:
12
image: istio-proxy
13
_internal_defaults_do_not_set:
14
autoscaleEnabled: true
15
autoscaleMin: 1
16
autoscaleMax: 5
17
autoscaleBehavior: {}
18
replicaCount: 1
19
rollingMaxSurge: 100%
20
rollingMaxUnavailable: 25%
21
hub: ""
22
tag: ""
23
variant: ""
24
# Can be a full hub/image:tag
25
image: pilot
26
traceSampling: 1.0
27
# Resources for a small pilot install
28
resources:
29
requests:
30
cpu: 500m
31
memory: 2048Mi
32
# Set to `type: RuntimeDefault` to use the default profile if available.
33
seccompProfile: {}
34
# Whether to use an existing CNI installation
35
cni:
36
enabled: false
37
provider: default
38
# Additional container arguments
39
extraContainerArgs: []
40
env: {}
41
envVarFrom: []
42
# Settings related to the untaint controller
43
# This controller will remove the named taint (default `cni.istio.io/not-ready`) from nodes when the istio-cni pod becomes ready.
44
# It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
45
taint:
46
# Controls whether or not the untaint controller is active
47
# When enabled, this automatically sets PILOT_ENABLE_NODE_UNTAINT_CONTROLLERS environment variable to true in the istiod deployment.
48
enabled: false
49
# What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod
50
namespace: ""
51
# The taint key used by the node-untaint controller to identify nodes that should be untainted.
52
name: cni.istio.io/not-ready
53
affinity: {}
54
tolerations: []
55
cpu:
56
targetAverageUtilization: 80
57
memory: {}
58
# targetAverageUtilization: 80
59
60
# Additional volumeMounts to the istiod container
61
volumeMounts: []
62
# Additional volumes to the istiod pod
63
volumes: []
64
# Inject initContainers into the istiod pod
65
initContainers: []
66
nodeSelector: {}
67
podAnnotations: {}
68
serviceAnnotations: {}
69
serviceAccountAnnotations: {}
70
sidecarInjectorWebhookAnnotations: {}
71
topologySpreadConstraints: []
72
# You can use jwksResolverExtraRootCA to provide a root certificate
73
# in PEM format. This will then be trusted by pilot when resolving
74
# JWKS URIs.
75
jwksResolverExtraRootCA: ""
76
# The following is used to limit how long a sidecar can be connected
77
# to a pilot. It balances out load across pilot instances at the cost of
78
# increasing system churn.
79
keepaliveMaxServerConnectionAge: 30m
80
# Additional labels to apply to the deployment.
81
deploymentLabels: {}
82
# Annotations to apply to the istiod deployment.
83
deploymentAnnotations: {}
84
## Mesh config settings
85
86
# Install the mesh config map, generated from values.yaml.
87
# If false, pilot wil use default values (by default) or user-supplied values.
88
configMap: true
89
# Additional labels to apply on the pod level for monitoring and logging configuration.
90
podLabels: {}
91
# Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
92
ipFamilyPolicy: ""
93
ipFamilies: []
94
# Ambient mode only.
95
# Set this if you install ztunnel to a different namespace from `istiod`.
96
# If set, `istiod` will allow connections from trusted node proxy ztunnels
97
# in the provided namespace.
98
# If unset, `istiod` will assume the trusted node proxy ztunnel resides
99
# in the same namespace as itself.
100
trustedZtunnelNamespace: ""
101
# Set this if you install ztunnel with a name different from the default.
102
trustedZtunnelName: ""
103
sidecarInjectorWebhook:
104
# You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or
105
# always skip the injection on pods that match that label selector, regardless of the global policy.
106
# See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
107
neverInjectSelector: []
108
alwaysInjectSelector: []
109
# injectedAnnotations are additional annotations that will be added to the pod spec after injection
110
# This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations:
111
#
112
# annotations:
113
# apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
114
# apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
115
#
116
# The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before
117
# the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify:
118
# injectedAnnotations:
119
# container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default
120
# container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default
121
injectedAnnotations: {}
122
# This enables injection of sidecar in all namespaces,
123
# with the exception of namespaces with "istio-injection:disabled" annotation
124
# Only one environment should have this enabled.
125
enableNamespacesByDefault: false
126
# Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run
127
# once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten.
128
# Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur.
129
reinvocationPolicy: Never
130
rewriteAppHTTPProbe: true
131
# Templates defines a set of custom injection templates that can be used. For example, defining:
132
#
133
# templates:
134
# hello: |
135
# metadata:
136
# labels:
137
# hello: world
138
#
139
# Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod
140
# being injected with the hello=world labels.
141
# This is intended for advanced configuration only; most users should use the built in template
142
templates: {}
143
# Default templates specifies a set of default templates that are used in sidecar injection.
144
# By default, a template `sidecar` is always provided, which contains the template of default sidecar.
145
# To inject other additional templates, define it using the `templates` option, and add it to
146
# the default templates list.
147
# For example:
148
#
149
# templates:
150
# hello: |
151
# metadata:
152
# labels:
153
# hello: world
154
#
155
# defaultTemplates: ["sidecar", "hello"]
156
defaultTemplates: []
157
istiodRemote:
158
# If `true`, indicates that this cluster/install should consume a "remote istiod" installation,
159
# and istiod itself will NOT be installed in this cluster - only the support resources necessary
160
# to utilize a remote instance.
161
enabled: false
162
# If `true`, indicates that this cluster/install should consume a "local istiod" installation,
163
# local istiod inject sidecars
164
enabledLocalInjectorIstiod: false
165
# Sidecar injector mutating webhook configuration clientConfig.url value.
166
# For example: https://$remotePilotAddress:15017/inject
167
# The host should not refer to a service running in the cluster; use a service reference by specifying
168
# the clientConfig.service field instead.
169
injectionURL: ""
170
# Sidecar injector mutating webhook configuration path value for the clientConfig.service field.
171
# Override to pass env variables, for example: /inject/cluster/remote/net/network2
172
injectionPath: "/inject"
173
injectionCABundle: ""
174
telemetry:
175
enabled: true
176
v2:
177
# For Null VM case now.
178
# This also enables metadata exchange.
179
enabled: true
180
# Indicate if prometheus stats filter is enabled or not
181
prometheus:
182
enabled: true
183
# stackdriver filter settings.
184
stackdriver:
185
enabled: false
186
# Revision is set as 'version' label and part of the resource names when installing multiple control planes.
187
revision: ""
188
# Revision tags are aliases to Istio control plane revisions
189
revisionTags: []
190
# For Helm compatibility.
191
ownerName: ""
192
# meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
193
# See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
194
meshConfig:
195
enablePrometheusMerge: true
196
experimental:
197
stableValidationPolicy: false
198
global:
199
# Used to locate istiod.
200
istioNamespace: istio-system
201
# List of cert-signers to allow "approve" action in the istio cluster role
202
#
203
# certSigners:
204
# - clusterissuers.cert-manager.io/istio-ca
205
certSigners: []
206
# enable pod disruption budget for the control plane, which is used to
207
# ensure Istio control plane components are gradually upgraded or recovered.
208
defaultPodDisruptionBudget:
209
enabled: true
210
# The values aren't mutable due to a current PodDisruptionBudget limitation
211
# minAvailable: 1
212
# A minimal set of requested resources to applied to all deployments so that
213
# Horizontal Pod Autoscaler will be able to function (if set).
214
# Each component can overwrite these default values by adding its own resources
215
# block in the relevant section below and setting the desired resources values.
216
defaultResources:
217
requests:
218
cpu: 10m
219
# memory: 128Mi
220
# limits:
221
# cpu: 100m
222
# memory: 128Mi
223
# Default hub for Istio images.
224
# Releases are published to docker hub under 'istio' project.
225
# Dev builds from prow are on registry.istio.io/testing.
226
hub: registry.istio.io/testing
227
# Default tag for Istio images.
228
tag: latest
229
# Variant of the image to use.
230
# Currently supported are: [debug, distroless]
231
variant: ""
232
# Specify image pull policy if default behavior isn't desired.
233
# Default behavior: latest images will be Always else IfNotPresent.
234
imagePullPolicy: ""
235
# ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace
236
# to use for pulling any images in pods that reference this ServiceAccount.
237
# For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing)
238
# ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects.
239
# Must be set for any cluster configured with private docker registry.
240
imagePullSecrets: []
241
# - private-registry-key
242
243
# Enabled by default in master for maximising testing.
244
istiod:
245
enableAnalysis: false
246
# To output all istio components logs in json format by adding --log_as_json argument to each container argument
247
logAsJson: false
248
# In order to use native nftable rules instead of iptable rules, set this flag to true.
249
nativeNftables: false
250
# Comma-separated minimum per-scope logging level of messages to output, in the form of <scope>:<level>,<scope>:<level>
251
# The control plane has different scopes depending on component, but can configure default log level across all components
252
# If empty, default scope and level will be used as configured in code
253
logging:
254
level: "default:info"
255
# When enabled, default NetworkPolicy resources will be created
256
networkPolicy:
257
enabled: false
258
omitSidecarInjectorConfigMap: false
259
# resourceScope controls what resources will be processed by helm.
260
# This is useful when installing Istio on a cluster where some resources need to be owned by a cluster administrator and some can be owned by the mesh administrator.
261
# It can be one of:
262
# - all: all resources are processed
263
# - cluster: only cluster-scoped resources are processed
264
# - namespace: only namespace-scoped resources are processed
265
resourceScope: all
266
# Configure whether Operator manages webhook configurations. The current behavior
267
# of Istiod is to manage its own webhook configurations.
268
# When this option is set as true, Istio Operator, instead of webhooks, manages the
269
# webhook configurations. When this option is set as false, webhooks manage their
270
# own webhook configurations.
271
operatorManageWebhooks: false
272
# Custom DNS config for the pod to resolve names of services in other
273
# clusters. Use this to add additional search domains, and other settings.
274
# see
275
# https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config
276
# This does not apply to gateway pods as they typically need a different
277
# set of DNS settings than the normal application pods (e.g., in
278
# multicluster scenarios).
279
# NOTE: If using templates, follow the pattern in the commented example below.
280
#podDNSSearchNamespaces:
281
#- global
282
#- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
283
284
# Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and
285
# system-node-critical, it is better to configure this in order to make sure your Istio pods
286
# will not be killed because of low priority class.
287
# Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
288
# for more detail.
289
priorityClassName: ""
290
proxy:
291
image: proxyv2
292
# This controls the 'policy' in the sidecar injector.
293
autoInject: enabled
294
# CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value
295
# cluster domain. Default value is "cluster.local".
296
clusterDomain: "cluster.local"
297
# Per Component log level for proxy, applies to gateways and sidecars. If a component level is
298
# not set, then the global "logLevel" will be used.
299
componentLogLevel: "misc:error"
300
# istio ingress capture allowlist
301
# examples:
302
# Redirect only selected ports: --includeInboundPorts="80,8080"
303
excludeInboundPorts: ""
304
includeInboundPorts: "*"
305
# istio egress capture allowlist
306
# https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
307
# example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
308
# would only capture egress traffic on those two IP Ranges, all other outbound traffic would
309
# be allowed by the sidecar
310
includeIPRanges: "*"
311
excludeIPRanges: ""
312
includeOutboundPorts: ""
313
excludeOutboundPorts: ""
314
# Log level for proxy, applies to gateways and sidecars.
315
# Expected values are: trace|debug|info|warning|error|critical|off
316
logLevel: warning
317
# Specify the path to the outlier event log.
318
# Example: /dev/stdout
319
outlierLogPath: ""
320
#If set to true, istio-proxy container will have privileged securityContext
321
privileged: false
322
seccompProfile: {}
323
# The number of successive failed probes before indicating readiness failure.
324
readinessFailureThreshold: 4
325
# The initial delay for readiness probes in seconds.
326
readinessInitialDelaySeconds: 0
327
# The period between readiness probes.
328
readinessPeriodSeconds: 15
329
# Enables or disables a startup probe.
330
# For optimal startup times, changing this should be tied to the readiness probe values.
331
#
332
# If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4.
333
# This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval),
334
# and doesn't spam the readiness endpoint too much
335
#
336
# If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30.
337
# This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly.
338
startupProbe:
339
enabled: true
340
failureThreshold: 600 # 10 minutes
341
# Resources for the sidecar.
342
resources:
343
requests:
344
cpu: 100m
345
memory: 128Mi
346
limits:
347
cpu: 2000m
348
memory: 1024Mi
349
# Default port for Pilot agent health checks. A value of 0 will disable health checking.
350
statusPort: 15020
351
# Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none.
352
# If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file.
353
tracer: "none"
354
proxy_init:
355
# Base name for the proxy_init container, used to configure iptables.
356
image: proxyv2
357
# Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures.
358
# Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases.
359
forceApplyIptables: false
360
# configure remote pilot and istiod service and endpoint
361
remotePilotAddress: ""
362
##############################################################################################
363
# The following values are found in other charts. To effectively modify these values, make #
364
# make sure they are consistent across your Istio helm charts #
365
##############################################################################################
366
367
# The customized CA address to retrieve certificates for the pods in the cluster.
368
# CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint.
369
# If not set explicitly, default to the Istio discovery address.
370
caAddress: ""
371
# Enable control of remote clusters.
372
externalIstiod: false
373
# Configure a remote cluster as the config cluster for an external istiod.
374
configCluster: false
375
# configValidation enables the validation webhook for Istio configuration.
376
configValidation: true
377
# Mesh ID means Mesh Identifier. It should be unique within the scope where
378
# meshes will interact with each other, but it is not required to be
379
# globally/universally unique. For example, if any of the following are true,
380
# then two meshes must have different Mesh IDs:
381
# - Meshes will have their telemetry aggregated in one place
382
# - Meshes will be federated together
383
# - Policy will be written referencing one mesh from the other
384
#
385
# If an administrator expects that any of these conditions may become true in
386
# the future, they should ensure their meshes have different Mesh IDs
387
# assigned.
388
#
389
# Within a multicluster mesh, each cluster must be (manually or auto)
390
# configured to have the same Mesh ID value. If an existing cluster 'joins' a
391
# multicluster mesh, it will need to be migrated to the new mesh ID. Details
392
# of migration TBD, and it may be a disruptive operation to change the Mesh
393
# ID post-install.
394
#
395
# If the mesh admin does not specify a value, Istio will use the value of the
396
# mesh's Trust Domain. The best practice is to select a proper Trust Domain
397
# value.
398
meshID: ""
399
# Configure the mesh networks to be used by the Split Horizon EDS.
400
#
401
# The following example defines two networks with different endpoints association methods.
402
# For `network1` all endpoints that their IP belongs to the provided CIDR range will be
403
# mapped to network1. The gateway for this network example is specified by its public IP
404
# address and port.
405
# The second network, `network2`, in this example is defined differently with all endpoints
406
# retrieved through the specified Multi-Cluster registry being mapped to network2. The
407
# gateway is also defined differently with the name of the gateway service on the remote
408
# cluster. The public IP for the gateway will be determined from that remote service (only
409
# LoadBalancer gateway service type is currently supported, for a NodePort type gateway service,
410
# it still need to be configured manually).
411
#
412
# meshNetworks:
413
# network1:
414
# endpoints:
415
# - fromCidr: "192.168.0.1/24"
416
# gateways:
417
# - address: 1.1.1.1
418
# port: 80
419
# network2:
420
# endpoints:
421
# - fromRegistry: reg1
422
# gateways:
423
# - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
424
# port: 443
425
#
426
meshNetworks: {}
427
# Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
428
mountMtlsCerts: false
429
multiCluster:
430
# Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
431
# to properly label proxies
432
clusterName: ""
433
# Network defines the network this cluster belong to. This name
434
# corresponds to the networks in the map of mesh networks.
435
network: ""
436
# Configure the certificate provider for control plane communication.
437
# Currently, two providers are supported: "kubernetes" and "istiod".
438
# As some platforms may not have kubernetes signing APIs,
439
# Istiod is the default
440
pilotCertProvider: istiod
441
sds:
442
# The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3.
443
# When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the
444
# JWT is intended for the CA.
445
token:
446
aud: istio-ca
447
sts:
448
# The service port used by Security Token Service (STS) server to handle token exchange requests.
449
# Setting this port to a non-zero value enables STS server.
450
servicePort: 0
451
# The name of the CA for workload certificates.
452
# For example, when caName=GkeWorkloadCertificate, GKE workload certificates
453
# will be used as the certificates for workloads.
454
# The default value is "" and when caName="", the CA will be configured by other
455
# mechanisms (e.g., environmental variable CA_PROVIDER).
456
caName: ""
457
waypoint:
458
# Resources for the waypoint proxy.
459
resources:
460
requests:
461
cpu: 100m
462
memory: 128Mi
463
limits:
464
cpu: "2"
465
memory: 1Gi
466
# If specified, affinity defines the scheduling constraints of waypoint pods.
467
affinity: {}
468
# Topology Spread Constraints for the waypoint proxy.
469
topologySpreadConstraints: []
470
# Node labels for the waypoint proxy.
471
nodeSelector: {}
472
# Tolerations for the waypoint proxy.
473
tolerations: []
474
base:
475
# For istioctl usage to disable istio config crds in base
476
enableIstioConfigCRDs: true
477
# Override the failurePolicy for the validation webhook.
478
# By default, the webhook starts with "Ignore" and istiod flips it to "Fail" once ready.
479
# Set to "Fail" to avoid the flip-flop, which is useful for server-side apply tools
480
# that do not support .Release.IsUpgrade (e.g. helm template | kubectl apply --server-side).
481
# validationFailurePolicy: Fail
482
# Gateway Settings
483
gateways:
484
# Define the security context for the pod.
485
# If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443.
486
# On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl.
487
securityContext: {}
488
# Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it
489
seccompProfile: {}
490
# gatewayClasses allows customizing the configuration of the default deployment of Gateways per GatewayClass.
491
# For example:
492
# gatewayClasses:
493
# istio:
494
# service:
495
# spec:
496
# type: ClusterIP
497
# Per-Gateway configuration can also be set in the `Gateway.spec.infrastructure.parametersRef` field.
498
gatewayClasses: {}
499
pdb:
500
# -- Minimum available pods set in PodDisruptionBudget.
501
# Define either 'minAvailable' or 'maxUnavailable', never both.
502
minAvailable: 1
503
# -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
504
# maxUnavailable: 1
505
# -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.
506
# Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/
507
unhealthyPodEvictionPolicy: ""
508
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.