Applications

The deployable binaries this repository produces. Five Go binaries plus the Helm-rendered ztunnel (whose source is in istio/ztunnel and is consumed via istio.deps).

Binary	Image	Source	One-line role
istiod / pilot-discovery	pilot	pilot/cmd/pilot-discovery/	Control plane: serves xDS, signs certs, runs webhooks
pilot-agent	proxyv2	pilot/cmd/pilot-agent/	Sidecar PID 1: bootstraps Envoy, runs SDS, proxies xDS
istioctl	(CLI)	istioctl/cmd/istioctl/	User CLI: install, analyze, debug, describe
istio-cni	install-cni	cni/cmd/istio-cni/, cni/cmd/install-cni/, cni/pkg/nodeagent/	CNI plugin + node agent for sidecar/Ambient redirection
operator	operator (legacy)	operator/pkg/, operator/cmd/	Manifest renderer: turns IstioOperator + profiles into install YAML. Library used by istioctl install.

Test workloads are also built but not deployed:

• pkg/test/echo/cmd/server and pkg/test/echo/cmd/client — the echo client/server used by integration tests.
• samples/extauthz/cmd/extauthz — sample external authorization server.

Where each binary runs

graph TB
    subgraph CP["Control plane (Deployment)"]
        istiod[istiod]
    end
    subgraph DS["Per-node DaemonSet"]
        cni[istio-cni node agent]
    end
    subgraph PR["Per-pod sidecar (sidecar mode)"]
        agent[pilot-agent]
        envoy[Envoy]
        agent --> envoy
    end
    subgraph DEV["Developer workstation / CI"]
        ctl[istioctl]
    end
    istiod -->|xDS| agent
    istiod -->|workload API| zt[ztunnel<br/>per-node DaemonSet]
    cni --> zt
    cni --> envoy
    ctl --> istiod

In Ambient mode, pilot-agent and Envoy only run inside dedicated waypoint Deployments (and in gateway pods); workload pods have neither.

How they're packaged

Helm charts under manifests/charts/ map binaries to Kubernetes resources:

Chart	Includes
base/	CRDs and cluster-scoped resources. Deployed once per cluster.
istio-control/istio-discovery/	The istiod Deployment, services, validating/mutating webhooks, RBAC.
gateway/	Per-gateway Deployment generated by Gateway API templates.
gateways/istio-ingress/, gateways/istio-egress/	The classic istio-ingressgateway / istio-egressgateway Deployments. The egress chart is auto-derived from the ingress chart (make copy-templates).
istio-cni/	The istio-cni-node DaemonSet with the install-cni binary.
ztunnel/	The ztunnel DaemonSet (ambient mode).

Profiles in manifests/profiles/ (default, demo, minimal, ambient, openshift, remote, empty) layer on top to produce different shapes of installs. The renderer is the operator library, which is invoked client-side by istioctl install.

Read these in order

1. istiod — the largest piece, and the system every other component talks to.
2. pilot-agent — the sidecar's local bootstrap and SDS.
3. istio-cni — pod redirection mechanics, especially in Ambient mode.
4. istioctl — the user surface; understanding it tells you what users actually use Istio for.
5. operator — install rendering, the smallest of the five.