# Setting up Istio

> How to set up Istio, an open-source service mesh, including installation, configuration, and integration with other tools. It enables a more efficient and unified way to secure, connect, and monitor services in distributed applications.

- Canonical URL: https://marcelocarmona.com/istio-setup
- Language: English (en-US)
- Published: 2021-08-05
- Tags: Kubernetes, Cloud native, Devops

---

![Istio and Kubernetes logo](/static/images/blog/istio-kubernetes.jpeg)

Istio is an open-source service mesh that layers transparently onto existing distributed applications. Istio's powerful features provide a uniform and more efficient way to secure, connect, and monitor services. https://istio.io

# Install Istio (macOS)

Check Kubernetes namespaces with `kubectl get ns`.

![check Kubernetes namespaces](/static/images/blog/istio-setup-1.png)

Install `istioctl`.

```
brew install istioctl
istioctl install
```

![istioctl install](/static/images/blog/istio-setup-2.png)

With `kubectl get ns`, you will see the new namespace created by `istioctl`.

![check Kubernetes namespaces after installing istioctl](/static/images/blog/istio-setup-3.png)

With `kubectl get pod -n istio-system`, you will see the new pods created by Istio.

![check Kubernetes namespaces after installing istioctl](/static/images/blog/istio-setup-4.png)

![Istio mesh diagram](/static/images/blog/istio-mesh.png)

Istio is a very feature-rich service mesh that includes the following capabilities.

- Traffic Management: This is the most basic feature of Istio.
- Policy Control: Enables access control systems, telemetry capture, quota management, billing, etc.
- Observability: Implemented in the sidecar proxy.
- Security and Authentication: The Citadel component does key and certificate management.

# Run an example in Kubernetes

I'm going to use this example: [microservices-demo](https://github.com/GoogleCloudPlatform/microservices-demo.git).

```bash
git clone https://github.com/GoogleCloudPlatform/microservices-demo.git
# or download https://github.com/GoogleCloudPlatform/microservices-demo/blob/master/release/kubernetes-manifests.yaml
cd microservices-demo/release
```

Run the demo manifest: `kubectl apply -f kubernetes-manifests.yaml`.

![run the demo manifest](/static/images/blog/istio-setup-5.png)

Run `kubectl get pod` and wait until the status is `Running`.

![wait until the status is running](/static/images/blog/istio-setup-6.png)

![the demo is running](/static/images/blog/istio-setup-7.png)

To configure Envoy proxy injection, we need to label the default namespace with `istio-injection=enabled`.

Let's see the current labels with `kubectl get ns default --show-labels`.

![show Kubernetes labels](/static/images/blog/istio-setup-8.png)

Run `kubectl label namespace default istio-injection=enabled`.

![show kubernetes labels with istio-injection=enabled](/static/images/blog/istio-setup-9.png)

So now we can shut down all the pods and recreate them to see the proxies being injected.

Run `kubectl delete -f kubernetes-manifests.yaml`.

![delete pods](/static/images/blog/istio-setup-10.png)

Run `kubectl get pod`.

![check that we don](/static/images/blog/istio-setup-11.png)

Run `kubectl apply -f kubernetes-manifests.yaml`.

Run `kubectl get pod`.

![check the new pods](/static/images/blog/istio-setup-12.png)

You can now see the proxy inside any pod with `kubectl describe pod <a-pod-name>`.

![see the Istio container inside the pod](/static/images/blog/istio-setup-13.png)

# Install Istio integrations for visualization and monitoring (Kiali, Grafana, Prometheus, and Jaeger)

We are going to use these [add-ons](https://github.com/istio/istio/tree/master/samples/addons).

```
git clone https://github.com/istio/istio.git
cd istio
# To quickly deploy all addons:
kubectl apply -f samples/addons
```

![install Istio integrations](/static/images/blog/istio-setup-addons-1.png)

You can see the new pods running with `kubectl get pod -n istio-system`.

![show addons](/static/images/blog/istio-setup-addons-2.png)

To see the services, run `kubectl get svc -n istio-system`.

![show services](/static/images/blog/istio-setup-addons-3.png)

Port-forward to access the frontend and Kiali.

Run `kubectl port-forward svc/kiali -n istio-system 8081:80`.

![port-forward frontend](/static/images/blog/istio-setup-addons-4.png)

Run `kubectl port-forward svc/kiali -n istio-system 20001`.

![port-forward Kiali](/static/images/blog/istio-setup-addons-5.png)

Go to http://localhost:20001/ and you will see the Kiali dashboard.

![Kiali screenshot](/static/images/blog/kiali.png)

---

Site entrypoint for agents: [llms.txt](https://marcelocarmona.com/llms.txt) · [llms-full.txt](https://marcelocarmona.com/llms-full.txt) · [ai-index.json](https://marcelocarmona.com/ai-index.json) · [sitemap.xml](https://marcelocarmona.com/sitemap.xml)

Every HTML page on this site also serves this Markdown representation via
`Accept: text/markdown`, or by appending `.md` to the URL.