<p>I have K8s installed in a 3 nodes cluster. I want to install Istio in a secure way. My question is: When installing Istio via Helm (as recommended in the <a href="https://istio.io/docs/setup/kubernetes/helm-install/#option-1-install-with-helm-via-helm-template" rel="nofollow noreferrer">docs</a>) do I need to install Helm securely (RABC and TSL/SSL) as recommended in the <a href="https://docs.helm.sh/using_helm/#installing-helm" rel="nofollow noreferrer">Docs</a>?</p>

<p>The reason for this question is the conflicting information between the two documentations. The Istio docs say only to do a simple <code>helm init --service-account tiller</code>. However in the Helm documentations it is recommended to go through all the security of Helm. In other words: Does Istio covers Helm insecure installation?</p>

Guilherme Uzeda
<p>According to the <a href="https://istio.io/docs/setup/kubernetes/helm-install/#option-1-install-with-helm-via-helm-template" rel="nofollow noreferrer">Documentation</a> about deploying Istio via Helm chart, the implementation steps won’t cover any security configuration to your <code>Tiller</code> service by default. Therefore, if you consider using a cluster with no concerns to the development environment the best solution would be applying <a href="https://docs.helm.sh/using_helm/#securing-your-helm-installation" rel="nofollow noreferrer">Security configuration</a> to Helm chart.</p>

<p>In general, Istio security implementation covers three concepts: <a href="https://istio.io/docs/concepts/security/#authentication-policies" rel="nofollow noreferrer">Authentication policies</a>, <a href="https://istio.io/docs/concepts/security/#mutual-tls-authentication" rel="nofollow noreferrer">Mutual TLS authentication</a> and <a href="https://istio.io/docs/concepts/security/#authorization-policy" rel="nofollow noreferrer">Authorization policy</a>.</p>

<p>Basically, Istio mesh installation via Helm chart enables Mutual TLS authentication by default with the existing parameter <code>global.mtls.enabled</code> in Helm template.</p>
