9.4.1 Install Istio with the helm command Before the installation, we assume that you have downloaded the  couldctl ,  kubectl , and  helm  tools for your platform from the IBM Cloud Private dashboard. Run the command  cloudctl -a https://Your_ICP_Host:8443/ . Log in with the admin ID  and password. Upon successful login, the tool sets up the  kubctl  and the Helm client. Note that the ca-file, the key-file, and the cert-file are created automatically when you  perform the first step. Refresh the repository with the  helm repo update  command.  The secret for the console login is required. Create the files as in Example 9-2 and in  Example 9-3 on page 296. 1. Log in to IBM Cloud Private: 2. Next you will set up the Helm repository. Run the command in Example 9-1 to add a Helm  repository that points to the management repository from IBM Cloud Private. 3. Create the secret for Grafana and Kali. We enable Grafana and Kali for this deployment.  Example 9-1 Command to add a Helm repository Example 9-2 Secret object for Kiali Example 9-3 Secret object for Grafana Notice that the username and passphrase are base64 encoded. You can get the encoded  value by running  echo yourtext | base64 . helm repo add --ca-file ~/.helm/ca.pem --key-file ~/.helm/key.pem --cert-file  ~/.helm/cert.pem icp https://Your_ICP_Host:8443/mgmt-repo/charts apiVersion: v1 kind: Secretometadata: name: kiali namespace: istio-system labels: app: kiali type: Opaque data: username: YWRtaW4K passphrase: YWRtaW4K  apiVersion: v1 kind: Secret metadata: name: grafana namespace: istio-system labels: app: grafana type: Opaque data: username: YWRtaW4K passphrase: YWRtaW4K  296  IBM Cloud Private System Administrator’s Guide