// the take
A Kubernetes operator for installing and lifecycle-managing Istio via CRDs (IstioControlPlane, IstioMeshGateway), built by Banzai Cloud/Cisco as the open-source core of their commercial Calisti platform. It's for teams who want Istio managed declaratively instead of via istioctl, but the README leads with a banner telling you not to use it.
Clean separation of concerns via CRDs (IstioControlPlane for control plane, IstioMeshGateway for gateways) instead of one monolithic resource. Uses generated protobuf-backed types for the Istio values schema rather than hand-maintained Go structs, which keeps the operator in sync with upstream Istio's config surface. Multi-cluster support (active-active, active-passive) is documented with working YAML examples, not just a bullet point. Has real reconciler test suites with golden-file resource dumps (testdata/*-expected-resource-dump.yaml) per component, which is more rigor than most operators bother with.
The repo is explicitly unmaintained — the README's first line tells you to use the official Istio operator instead, and the comparison table makes clear the interesting features (observability, mTLS management, OIDC, outlier detection) were pulled into the paid Calisti/SMM product rather than kept here. Multi-cluster setup requires manual steps the commercial version automates, so you're doing by hand what the vendor already decided isn't worth maintaining for free. No CVE or security update is coming for this given the deprecation notice, which matters a lot for anything touching Istio's control plane and webhook configs. Last push was over a year ago, so it likely doesn't track recent Istio minor releases, and running it against current Istio versions is unverified.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →