Introducing the Istio Operator
Introduction to Istio's new operator-based installation and control plane management feature.
Kubernetes operators provide a pattern for encoding human operational knowledge in software and are a popular way to simplify the administration of software infrastructure components. Istio is a natural candidate for an automated operator as it is challenging to administer.
Up until now, Helm has been the primary tool to install and upgrade Istio. Istio 1.4 introduces a new method of installation using istioctl. This new installation method builds on the strengths of Helm with the addition of the following:
- Users only need to install one tool:
- All API fields are validated
- Small customizations not in the API don’t require chart or API changes
- Version specific upgrade hooks can be easily and robustly implemented
istioctl installation commands use a
to configure the installation. The custom resource is part of a new Istio operator
implementation intended to simplify the common administrative tasks of installation, upgrade,
and complex configuration changes for Istio. Validation and checking for installation and upgrade
is tightly integrated with the tools to prevent common errors and simplify troubleshooting.
The Operator API
Every operator implementation requires a
custom resource definition (CRD)
to define its custom resource, that is, its API. Istio’s operator API is defined by the
which is generated from an
The API supports all of Istio’s current configuration profiles
using a single field to select the profile. For example, the following
configures Istio using the
You can then customize the configuration with additional settings. For example, to disable telemetry:
Installing with istioctl
The recommended way to use the Istio operator API is through a new set of
For example, to install Istio into a cluster:
$ istioctl manifest apply -f <your-istiocontrolplane-customresource>
Make changes to the installation configuration by editing the configuration file and executing
istioctl manifest apply again.
To upgrade to a new version of Istio:
$ istioctl x upgrade -f <your-istiocontrolplane-config-changes>
In addition to specifying the complete configuration in an
istioctl commands can also be passed individual settings using a
$ istioctl manifest apply --set telemetry.enabled=false
There are also a number of other
istioctl commands that, for example, help you list, display,
and compare configuration profiles and manifests.
Refer to the Istio install instructions for more details.
Istio Controller (alpha)
Operator implementations use a Kubernetes controller to continuously monitor their custom resource
and apply the corresponding configuration changes. The Istio controller monitors an
resource and reacts to changes by updating the Istio installation configuration in the corresponding cluster.
In the 1.4 release, the Istio controller is in the alpha phase of development and not fully
istioctl. It is, however,
available for experimentation using
For example, to install the controller and a default version of Istio into your cluster,
run the following command:
$ kubectl apply -f https://<repo URL>/operator.yaml
$ kubectl apply -f https://<repo URL>/default-cr.yaml
You can then make changes to the Istio installation configuration:
$ kubectl edit istiocontrolplane example-istiocontrolplane -n istio-system
As soon as the resource is updated, the controller will detect the changes and respond by updating the Istio installation correspondingly.
Both the operator controller and
istioctl commands share the same implementation. The significant
difference is the execution context. In the
istioctl case, the operation runs in the admin user’s
command execution and security context. In the controller case, a pod in the cluster runs the code
in its security context. In both cases, configuration is validated against a schema and the same correctness
checks are performed.
Migration from Helm
To help ease the transition from previous configurations using Helm,
istioctl and the controller support pass-through access for the full Helm installation API.
You can pass Helm configuration options using
istioctl --set by prepending the string
values. to the option name.
For example, instead of this Helm command:
$ helm template ... --set global.mtls.enabled=true
You can use this
$ istioctl manifest generate ... --set values.global.mtls.enabled=true
You can also set Helm configuration values in an
IstioControlPlane custom resource.
See Customize Istio settings using Helm
Another feature to help with the transition from Helm is the alpha
istioctl manifest migrate command.
This command can be used to automatically convert a Helm
values.yaml file to a corresponding
Several frameworks have been created to help implement operators by generating stubs for some or all of the components. The Istio operator was created with the help of a combination of kubebuilder and operator framework. Istio’s installation now uses a proto to describe the API such that runtime validation can be executed against a schema.
More information about the implementation can be found in the README and ARCHITECTURE documents in the Istio operator repository.
Starting in Istio 1.4, Helm installation is being replaced by new
istioctl commands using
a new operator custom resource definition,
IstioControlPlane, for the configuration API.
An alpha controller is also available for early experimentation with the operator.
istioctl commands and operator controller both validate configuration schemas and perform a range of
checks for installation change or upgrade. These checks are tightly integrated with the tools to prevent
common errors and simplify troubleshooting.
The Istio maintainers expect that this new approach will improve the user experience during Istio installation and upgrade, better stabilize the installation API, and help users better manage and monitor their Istio installations.
We welcome your feedback about the new installation approach at discuss.istio.io.