• Installing with Istioctl
    • Prerequisites
    • Install Istio using the default profile
    • Install a different profile
    • Display the list of available profiles
    • Display the configuration of a profile
    • Show differences in profiles
    • Generate a manifest before installation
    • Show differences in manifests
    • Verify a successful installation
    • Customizing the configuration
      • Identify an Istio feature or component
      • Configure the feature or component settings
      • Customize Kubernetes settings
      • Customize Istio settings using the Helm API
    • Uninstall Istio
    • 相关内容

    Installing with Istioctl

    Follow this guide to install and configure an Istio mesh for in-depth evaluation or production use.

    This installation guide uses the istioctl command linetool to provide rich customization of the Istio control plane and of the sidecars for the Istio data plane.It has user input validation to help prevent installation errors and customization options tooverride any aspect of the configuration.

    Using these instructions, you can select any one of Istio’s built-inconfiguration profilesand then further customize the configuration for your specific needs.

    Prerequisites

    Before you begin, check the following prerequisites:

    • Download the Istio release.
    • Perform any necessary platform-specific setup.
    • Check the [Requirements for Pods and Services]/docs/ops/prep/requirements/).

    Install Istio using the default profile

    The simplest option is to install the default Istioconfiguration profileusing the following command:

    1. $ istioctl manifest apply

    This command installs the default profile on the cluster defined by yourKubernetes configuration. The default profile is a good starting pointfor establishing a production environment, unlike the larger demo profile thatis intended for evaluating a broad set of Istio features.

    Install a different profile

    Other Istio configuration profiles can be installed in a cluster by passing theprofile name on the command line. For example, the following command can be usedto install the demo profile:

    1. $ istioctl manifest apply --set profile=demo

    Display the list of available profiles

    You can display the names of Istio configuration profiles that areaccessible to istioctl by using this command:

    1. $ istioctl profile list
    2.     minimal
    3.     demo
    4.     sds
    5.     default

    Display the configuration of a profile

    You can view the configuration settings of a profile. For example, to view the setting for the default profilerun the following command:

    1. $ istioctl profile dump
    2. autoInjection:
    3.   components:
    4.     injector:
    5.       enabled: true
    6.       k8s:
    7.         replicaCount: 1
    8.   enabled: true
    9. configManagement:
    10.   components:
    11.     galley:
    12.       enabled: true
    13.       k8s:
    14.         replicaCount: 1
    15.         resources:
    16.           requests:
    17.             cpu: 100m
    18.   enabled: true
    19. defaultNamespace: istio-system
    20. gateways:
    21.   components:
    22.     egressGateway:
    23.       enabled: false
    24.       k8s:
    25.         hpaSpec:
    26.           maxReplicas: 5
    27.           metrics:
    28.           - resource:
    29.               name: cpu
    30.               targetAverageUtilization: 80
    31.             type: Resource
    32.           minReplicas: 1
    33. ...

    To view a subset of the entire configuration, you can use the —config-path flag, which selects only the portionof the configuration under the given path:

    1. $ istioctl profile dump --config-path trafficManagement.components.pilot
    2. enabled: true
    3. k8s:
    4.   env:
    5.   - name: POD_NAME
    6.     valueFrom:
    7.       fieldRef:
    8.         apiVersion: v1
    9.         fieldPath: metadata.name
    10.   - name: POD_NAMESPACE
    11.     valueFrom:
    12.       fieldRef:
    13.         apiVersion: v1
    14.         fieldPath: metadata.namespace
    15.   - name: GODEBUG
    16.     value: gctrace=1
    17.   - name: PILOT_TRACE_SAMPLING
    18.     value: "1"
    19.   - name: CONFIG_NAMESPACE
    20.     value: istio-config
    21.   hpaSpec:
    22.     maxReplicas: 5
    23.     metrics:
    24.     - resource:
    25.         name: cpu
    26.         targetAverageUtilization: 80
    27.       type: Resource
    28.     minReplicas: 1
    29.     scaleTargetRef:
    30.       apiVersion: apps/v1
    31.       kind: Deployment
    32.       name: istio-pilot
    33.   readinessProbe:
    34.     httpGet:
    35.       path: /ready
    36.       port: 8080
    37.     initialDelaySeconds: 5
    38.     periodSeconds: 30
    39.     timeoutSeconds: 5
    40.   resources:
    41.     requests:
    42.       cpu: 500m
    43.       memory: 2048Mi

    Show differences in profiles

    The profile diff sub-command can be used to show the differences between profiles,which is useful for checking the effects of customizations before applying changes to a cluster.

    You can show differences between the default and demo profiles using these commands:

    1. $ istioctl profile dump default > 1.yaml
    2. $ istioctl profile dump demo > 2.yaml
    3. $ istioctl profile diff 1.yaml 2.yaml

    Generate a manifest before installation

    You can generate the manifest before installing Istio using the manifest generatesub-command, instead of manifest apply.For example, use the following command to generate a manifest for the default profile:

    1. $ istioctl manifest generate > $HOME/generated-manifest.yaml

    Inspect the manifest as needed, then apply the manifest using this command:

    1. $ kubectl apply -f $HOME/generated-manifest.yaml

    This command might show transient errors due to resources not being available inthe cluster in the correct order.

    Show differences in manifests

    You can show the differences in the generated manifests between the default profile and a customized install using these commands:

    1. $ istioctl manifest generate > 1.yaml
    2. $ istioctl manifest generate -f samples/pilot-k8s.yaml > 2.yaml
    3. $ istioctl manifest diff 1.yam1 2.yaml

    Verify a successful installation

    You can check if the Istio installation succeeded using the verify-install commandwhich compares the installation on your cluster to a manifest you specify.

    If you didn’t generate your manifest prior to deployment, run the following command togenerate it now:

    1. $ istioctl manifest generate <your original installation options> > $HOME/generated-manifest.yaml

    Then run the following verify-install command to see if the installation was successful:

    1. $ istioctl verify-install -f $HOME/generated-manifest.yaml

    Customizing the configuration

    In addition to installing any of Istio’s built-inconfiguration profiles,istioctl manifest provides a complete API for customizing the configuration.

    • The IstioControlPlane APIThe configuration parameters in this API can be set individually using —set options on the commandline. For example, to disable the telemetry feature in a default configuration profile, use this command:
    1. $ istioctl manifest apply --set telemetry.enabled=false

    Alternatively, a complete configuration can be specified in a YAML file and passed toistioctl using the -f option:

    1. $ istioctl manifest apply -f samples/pilot-k8s.yaml

    Identify an Istio feature or component

    The IstioControlPlane API groups control plane components by feature, as shown in the table below:

    FeatureComponents
    BaseCRDs
    Traffic ManagementPilot
    PolicyPolicy
    TelemetryTelemetry
    SecurityCitadel
    SecurityNode agent
    SecurityCert manager
    Configuration managementGalley
    GatewaysIngress gateway
    GatewaysEgress gateway
    AutoInjectionSidecar injector

    In addition to the core Istio components, third-party addon features and components are also available:

    FeatureComponents
    TelemetryPrometheus
    TelemetryPrometheus Operator
    TelemetryGrafana
    TelemetryKiali
    TelemetryTracing
    ThirdPartyCNI

    Features can be enabled or disabled, which enables or disables all of the components that are a part of the feature.Namespaces that components are installed into can be set by component, feature, or globally.

    Configure the feature or component settings

    After you identify the name of the feature or component from the previous table, you can use the API to set the valuesusing the —set flag, or create an overlay file and use the —filename flag. The —set flagworks well for customizing a few parameters. Overlay files are designed for more extensive customization, ortracking configuration changes.

    The simplest customization is to turn a feature or component on or off from the configuration profile default.

    To disable the telemetry feature in a default configuration profile, use this command:

    1. $ istioctl manifest apply --set telemetry.enabled=false

    Alternatively, you can disable the telemetry feature using a configuration overlay file:

    • Create this file with the name telemetry_off.yaml and these contents:
    1. apiVersion: install.istio.io/v1alpha2
    2. kind: IstioControlPlane
    3. spec:
    4.   telemetry:
    5.     enabled: false
    • Use the telemetry_off.yaml overlay file with the manifest apply command:
    1. $ istioctl manifest apply -f telemetry_off.yaml

    You can also use this approach to set the component-level configuration, such as enabling the node agent:

    1. $ istioctl manifest apply --set security.components.nodeAgent.enabled=true

    Another customization is to select different namespaces for features and components. The following is an exampleof installation namespace customization:

    1. apiVersion: install.istio.io/v1alpha2
    2. kind: IstioControlPlane
    3. spec:
    4.   defaultNamespace: istio-system
    5.   security:
    6.     namespace: istio-security
    7.     components:
    8.       citadel:
    9.         namespace: istio-citadel

    Applying this file will cause the default profile to be applied, with components being installed into the followingnamespaces:

    • The Citadel component is installed into istio-citadel namespace
    • All other components in the security feature installed into istio-security namespace
    • Remaining Istio components installed into istio-system namespace

    Customize Kubernetes settings

    The IstioControlPlane API allows each component’s Kubernetes settings to be customized in a consistent way.

    Each component has a KubernetesResourceSpec,which allows the following settings to be changed. Use this list to identify the setting to customize:

    • Resources
    • Readiness probes
    • Replica count
    • HorizontalPodAutoscaler
    • PodDisruptionBudget
    • Pod annotations
    • Service annotations
    • ImagePullPolicy
    • Priority class name
    • Node selector
    • Affinity and anti-affinityAll of these Kubernetes settings use the Kubernetes API definitions, so Kubernetes documentation can be used for reference.

    The following example overlay file adjusts the TrafficManagement feature’s resources and horizontal pod autoscalingsettings for Pilot:

    1. apiVersion: install.istio.io/v1alpha2
    2. kind: IstioControlPlane
    3. spec:
    4.   trafficManagement:
    5.     components:
    6.       pilot:
    7.         k8s:
    8.           resources:
    9.             requests:
    10.               cpu: 1000m # override from default 500m
    11.               memory: 4096Mi # ... default 2048Mi
    12.           hpaSpec:
    13.             maxReplicas: 10 # ... default 5
    14.             minReplicas: 2  # ... default 1

    Use manifest apply to apply the modified settings to the cluster:

    Zip

    1. $ istioctl manifest apply -f @samples/pilot-k8s.yaml@

    Customize Istio settings using the Helm API

    The IstioControlPlane API includes a pass-through interface to the Helm APIusing the values field.

    The following YAML file configures global and Pilot settings through the Helm API:

    1. apiVersion: install.istio.io/v1alpha2
    2. kind: IstioControlPlane
    3. spec:
    4.   trafficManagement:
    5.     components:
    6.       pilot:
    7.         values:
    8.           traceSampling: 0.1 # override from 1.0
    10.   # global Helm settings
    11.   values:
    12.     monitoringPort: 15050

    Some parameters will temporarily exist in both the Helm and IstioControlPlane APIs, including Kubernetes resources,namespaces and enablement settings. The Istio community recommends using the IstioControlPlane API as it is moreconsistent, is validated, and follows the community graduation process.

    Uninstall Istio

    To uninstall Istio, run the following command:

    1. $ istioctl manifest generate <your original installation options> | kubectl delete -f -

    相关内容

    使用 Istioctl 安装

    安装和自定义任何 Istio 配置文件以进行深入评估或用于生产。

    Helm Changes

    Details the Helm chart installation options differences between Istio 1.0 and Istio 1.1.

    Helm Changes

    Details the Helm chart installation options differences between Istio 1.2 and Istio 1.3.

    Helm Changes

    Details the Helm chart installation options differences between Istio 1.3 and Istio 1.4.

    Helm Changes

    Details the Helm chart installation options differences between Istio 1.1 and Istio 1.2.

    Installation Options

    Describes the options available when installing Istio using the included Helm chart.