Permissions to install istio

We have a CICD pipeline to install istio, the CICD user is one which is maintained by the application team .Due to seperation of duties we dont want that user to be given cluster-admin access . Can you please let me know the necessary permissions needed for istio installation