How to install Istio and enable mTLS for service-to-service traffic

Installing Istio and enabling mTLS

Istio is a service mesh that adds traffic management, security, and observability to Kubernetes services without changing application code. It injects an Envoy sidecar proxy into each pod, intercepting traffic to apply policy. A common first win is encrypting all service-to-service traffic with mutual TLS.

Prerequisites

• A Kubernetes cluster with sufficient resources.
• istioctl and kubectl installed.

Steps

1. Install Istio with istioctl

istioctl install --set profile=demo -y
kubectl get pods -n istio-system

The demo profile is good for evaluation; use default for production.

2. Label a namespace for injection

kubectl label namespace default istio-injection=enabled

New pods in this namespace get an Envoy sidecar automatically.

3. Deploy sample services

Deploy two or more services and confirm each pod now has two containers (app plus istio-proxy):

kubectl get pod -o jsonpath='{.items[*].spec.containers[*].name}'

4. Enable strict mTLS

Apply a mesh-wide PeerAuthentication:

apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT

Now only mTLS traffic is accepted between meshed services.

5. Add traffic routing rules

Use a VirtualService and DestinationRule to split traffic, for example 90/10 between two versions, enabling canary releases.

6. Verify mTLS and telemetry

istioctl x describe pod <pod>

Install the Kiali, Prometheus, and Grafana addons to see the service graph and confirm encrypted links.

Verification

Confirm sidecars are injected (two containers per pod). With STRICT mTLS, a plaintext request from a non-meshed pod should be rejected, while meshed services communicate normally. Kiali should show lock icons indicating mTLS on each edge.

Next Steps

Layer on authorization policies for fine-grained access, configure retries, timeouts, and circuit breaking, and connect mesh telemetry to your tracing backend. Compare with Linkerd if you want a lighter-weight mesh.