diff --git a/charts/kubezero-sql/example-mariadb-galera.yaml b/charts/kubezero-sql/example-mariadb-galera.yaml
index 4c1f882..bb199be 100644
--- a/charts/kubezero-sql/example-mariadb-galera.yaml
+++ b/charts/kubezero-sql/example-mariadb-galera.yaml
@@ -17,6 +17,9 @@ spec:
             enabled: true
             serviceMonitor:
               enabled: true
+          istio:
+            enabled: true
+            url: mariadb.dev.mayneinc.com
 
   destination:
     server: 'https://kubernetes.default.svc'
diff --git a/charts/kubezero-sql/templates/mariadb/istio-service.yaml b/charts/kubezero-sql/templates/mariadb/istio-service.yaml
new file mode 100644
index 0000000..d346491
--- /dev/null
+++ b/charts/kubezero-sql/templates/mariadb/istio-service.yaml
@@ -0,0 +1,22 @@
+{{- if index .Values "mariadb-galera" "istio" "enabled" }}
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: mariadb
+  namespace: {{ .Release.Namespace }}
+  labels:
+{{ include "kubezero-lib.labels" . | indent 4 }}
+spec:
+  hosts:
+  - {{ index .Values "mariadb-galera" "istio" "url" }}
+  gateways:
+  - {{ index .Values "mariadb-galera" "istio" "gateway" }}
+  tcp:
+  - match:
+    - port: {{ default 3306 ( index .Values "mariadb-galera" "service" "port" ) }}
+    route:
+    - destination:
+        host: {{ .Release.Name }}-mariadb-galera-headless
+        port:
+          number: {{ default 3306 ( index .Values "mariadb-galera" "service" "port" ) }}
+{{- end }}
diff --git a/charts/kubezero-sql/values.yaml b/charts/kubezero-sql/values.yaml
index 5a42a11..8381fb1 100644
--- a/charts/kubezero-sql/values.yaml
+++ b/charts/kubezero-sql/values.yaml
@@ -7,6 +7,7 @@ mariadb-galera:
   rootUser:
     password: 12345qwert
   db:
+    user: mariadb
     password: 12345qwert
   galera:
     mariabackup:
@@ -19,3 +20,8 @@ mariadb-galera:
 
     prometheusRules:
       enabled: false
+
+  istio:
+    enabled: false
+    gateway: istio-system/private-ingressgateway
+    url: mariadb.example.com