diff --git a/bin/migrate.sh b/bin/migrate.sh
index 617cf43..42d3d2c 100755
--- a/bin/migrate.sh
+++ b/bin/migrate.sh
@@ -1,3 +1,3 @@
 #kubectl get all,cm,secret,ing,role,clusterrole,rolebindings,clusterrolebindings -l app.kubernetes.io/managed-by=Helm -l app.kubernetes.io/instance=cert-manager -A --no-headers --output  custom-columns="POD-NAME":.kind,"NAMESPACE":.metadata.name | while read -r var1 var2; do kubectl annotate $var1 $var2 "meta.helm.sh/release-namespace"="cert-manager" "meta.helm.sh/release-name"="cert-manager" --overwrite; done
 
-kubectl get ValidatingWebhookConfiguration,all,cm,secret,ing,role,clusterrole,rolebindings,clusterrolebindings,MutatingWebhookConfiguration -l app.kubernetes.io/managed-by=Helm -l app.kubernetes.io/instance=cert-manager -A --no-headers --output  custom-columns="POD-NAME":.kind,"NAMESPACE":.metadata.name,"ns":.metadata.namespace | while read -r var1 var2 var3; do kubectl annotate $var1 $var2 -n $var3 "meta.helm.sh/release-namespace"="cert-manager" "meta.helm.sh/release-name"="cert-manager"; done
+kubectl get sa,ValidatingWebhookConfiguration,all,cm,secret,ing,role,clusterrole,rolebindings,clusterrolebindings,MutatingWebhookConfiguration -l argocd.argoproj.io/instance=istio-base -A --no-headers --output  custom-columns="POD-NAME":.kind,"NAMESPACE":.metadata.name,"ns":.metadata.namespace | while read -r var1 var2 var3; do kubectl annotate $var1 $var2 -n $var3 "meta.helm.sh/release-namespace"="istio-system" "meta.helm.sh/release-name"="istio-base" && kubectl label $var1 $var2 -n $var3 app.kubernetes.io/managed-by=Helm; done
diff --git a/helmfile.yaml b/helmfile.yaml
index eb27dc7..1973e67 100644
--- a/helmfile.yaml
+++ b/helmfile.yaml
@@ -11,6 +11,11 @@ releases:
     namespace: kube-system
     createNamespace: false
 
+  - <<: *istio-base
+    installed: true
+    namespace: istio-system
+    createNamespace: false
+  
   - <<: *cert-manager 
     installed: true
     namespace: cert-manager
diff --git a/releases.yaml b/releases.yaml
index 0f511a6..67704aa 100644
--- a/releases.yaml
+++ b/releases.yaml
@@ -37,6 +37,13 @@ templates:
     inherit: 
       - template: crd-management-hook
 
+  istio-base: &istio-base
+    name: istio-base
+    chart: istio/base
+    version: 1.16.1
+    inherit: 
+      - template: crd-management-hook
+
   openvpn: &openvpn
     name: openvpn
     chart: allanger-charts/openvpn
diff --git a/repositories.yaml b/repositories.yaml
index 0214adc..67edd60 100644
--- a/repositories.yaml
+++ b/repositories.yaml
@@ -6,4 +6,5 @@ repositories:
     url: https://allanger.github.io/allanger-charts
   - name: jetstack
     url: https://charts.jetstack.io
-
+  - name: istio
+    url: https://istio-release.storage.googleapis.com/charts