The Istio CNI plugin removes the need for each application pod to have a privileged container. For further information, see the Istio CNI Plugin docs. Please note that the .

The steps differ based on the Rancher version.

  1. Set the PodSecurityPolicy to unrestricted
  3. Verify that the CNI is working.

Set the PSP to unrestricted in the project where is Istio is installed, or the project where you plan to install Istio.

  1. From the cluster view of the Cluster Manager, select Projects/Namespaces.
  2. Find the Project: System and select the ⋮ > Edit.

2. Enable the CNI

When installing or upgrading Istio through Apps & Marketplace,

  1. Click Components.
  2. Check the box next to Enabled CNI.
  3. Finish installing or upgrading Istio.

The CNI can also be enabled by editing the values.yaml:

Istio should install successfully with the CNI enabled in the cluster.

Prerequisites:

  • The cluster must be an RKE Kubernetes cluster.
  • The cluster must have been created with a default PodSecurityPolicy.

To enable pod security policy support when creating a Kubernetes cluster in the Rancher UI, go to Advanced Options. In the Pod Security Policy Support section, click Enabled. Then select a default pod security policy.

  1. Configure the System Project Policy to allow Istio install.
  3. Install Istio.

1. Configure the System Project Policy to allow Istio install

  1. From the cluster view of the Cluster Manager, select Projects/Namespaces.
  2. Find the Project: System and select the ⋮ > Edit.
  3. Change the Pod Security Policy option to be unrestricted, then click Save.
  1. From the main menu of the Dashboard, select Projects/Namespaces.
  2. Choose Tools > Catalogs in the navigation bar.
  3. Add a catalog with the following:
    1. Name: istio-cni
    2. Catalog URL: https://github.com/istio/cni
    3. Branch: The branch that matches your current release, for example: .
  4. From the main menu select Apps
  5. Click Launch and select istio-cni
  6. Update the namespace to be “kube-system”
  7. In the answers section, click “Edit as YAML” and paste in the following, then click launch:
  1. ---
  2.   logLevel: "info"
  4.     - "kube-system"

3. Install Istio

Follow the primary instructions, adding a custom answer: .

After Istio has finished installing, the Apps page in System Projects should show both istio and istio-cni applications deployed successfully. Sidecar injection will now be functional.