Deploy Istio over Kubernetes

This guide walks you through the steps to deploy Istio Pilot and Istio Proxy over Kubernetes in a minikube environment. Minikube is a local Kubernetes setup that requires only Docker or a Virtual Machine environment which makes it ideal for testing. This setup automatically injects Istio sidecars into application pods, enabling service mesh features like traffic management, security, and observability. For the backend, we will use the Minimus Darkhttpd image to deploy a simple HTTP server. For the frontend, we will use the Minimus BusyBox image to call the backend every 10 seconds.

Set up minikube

If you already have a Kubernetes cluster available, you can skip this step. Otherwise, install a single node cluster using minikube to set up a testing environment.Follow the minikube get started guide to deploy a cluster, install kubectl, and test that everything is working. The instructions are platform-specific and provided for Windows, MacOS, and Linux.

Fetch the example Kubernetes YAML configuration files

The configurations are based on our general NGINX guide. To simplify the process we provide example configuration files in our GitHub repo.Save the example yaml files to your project folder:

Create cluster secret

To avoid using a Minimus token in plaintext, we will create a Kubernetes Secret containing the credentials needed to pull images from the Minimus registry.

Copy a token from your Minimus console.

Create a Docker auth JSON by executing the following command. Add the token from the previous step as your password:

kubectl -n istio-system create secret docker-registry my-registry-secret \
   --docker-server=reg.mini.dev \
   --docker-username=minimus \
   --docker-password={minimus_token}

Check that the secret with the name my-registry-secret was successfully created:
kubectl -n istio-system get secrets

Deploy Istio

Run the following command from the project directory to deploy your NGINX container:

    helm install istiod istio/istiod -n istio-system \
    --set global.proxy.image=istio-proxy \
    --set pilot.image=istio-pilot \
    --set global.hub=reg.mini.dev \
    --set global.tag=latest \
    --set global.imagePullSecrets[0]=my-registry-secret

Deploy application

Run the following command from the project directory to deploy the frontend and backend apps. The period at the end of the command applies all YAML files in the current directory:

kubectl apply -f .

Check the logs

Run the following command to check the logs:

kubectl -n istio-system istiod-pod-number logs -f

Look for the string below to make sure that the two endpoints were created: XDS: Pushing Services:19 ConnectedEndpoints:2 Version:2025-08-10T07:38:55Z/6Check the frontend logs:

kubectl -n istio-system frontend-pod-number logs -f

You should see calls to the backend pod:

Calling backend...
Hello World - Sun Aug 10 07:38:39 UTC 2025

Building Secure Apps

Tutorials

K8s Guides

TLS Guides

Troubleshooting

Debugging