<p>Is it possible to install Istio on a project-level? Every Istio installation guide I see is cluster-wide. But since multiple departments share the same cluster in my company that is not an option.</p>

Anders Lassen
<p>Istio is installed in one namespace but is not necessarily working for all the cluster. Actually, Istio works only for those workloads that have the Istio sidecar injected.</p>

<p>For example, the following command will create some Deployments (and thus, pods) that will have the Istio Sidecar injected. Those pods will have enabled the whole Istio features.</p>

<pre><code>kubectl apply -f &lt;(./bin/istioctl kube-inject -f samples/bookinfo/platform/kube/bookinfo.yaml) -n bookinfo
</code></pre>

<p>However, the following command won't inject the Istio sidecar and as a consequence, Istio control plane won't modify their behavior.</p>

<pre><code>kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml -n bookinfo
</code></pre>

<p>In order to manage the incoming/outgoing traffic to the istio service mesh, you can create Istio Gateways (edge of the mesh): <a href="https://istio.io/docs/reference/config/networking/v1alpha3/gateway/" rel="nofollow noreferrer">https://istio.io/docs/reference/config/networking/v1alpha3/gateway/</a></p>

<p>Also related to traffic ingress, Istio has its own istio-ingressgateway (similar to K8S Ingress Resource but without any default traffic rule applied):
<a href="https://istio.io/docs/tasks/traffic-management/ingress/" rel="nofollow noreferrer">https://istio.io/docs/tasks/traffic-management/ingress/</a></p>

<p>The rest of the traffic not going through these ways, won't be part of the traffic managed by Istio Service Mesh.</p>

<p>In order to test that, you can easily install the default Istio demo <code>bookinfo</code> without sidecars (second command above) and see that there is no telemetry registered and no tracing data. If you are using Kiali (www.kiali.io) you are going to see that the service graph shows empty and desconnected (meaning that there is no telemetry registered).</p>

<p><a href="https://i.stack.imgur.com/IOU2U.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/IOU2U.png" alt="Service Graph in Kiali for pods outside of service mesh"></a></p>

<p>Also, you can expose any service of bookinfo and consume them without any Istio interacting:</p>

<p><a href="https://i.stack.imgur.com/GFx6N.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/GFx6N.png" alt="Calling Ratings service where sidecar is not injected"></a></p>
