Skip to main content

Upgrading Istio

warning
  • istiod upgrades may restart every Gateway. A Gateway with a single replica goes down during the restart. Run 2 or more replicas on every Gateway before taking an a.b+1.d release.
  • CNI and ztunnel upgrades cause a short outage. Both are DaemonSets, so every node restarts a pod. Schedule the a.b+1.d release in an upgrade window.

Scenario: To go from addon version a.b.c to a.b+1.d:

  1. Perform any manual patches and updates to the CRDs and their resources as needed. See below for more information on the specific manual patches and updates to CRDs for a specific istio version.
  2. Upgrade the addon to a.b+1.d. This will upgrade all CRDs and istio components to the desired version. The wrapper chart leverages argocd dry-runs and sync-waves to ensure all the istio components remaining on compatible versions throughout the upgrade.
  3. Many of the Gateway pods should've been restarted as part of step 2. If there are any Gateway pods still not on the correct version, you will need to force them to be updated by annotating the appropriate Gateways.

Use the following command to identify all Gateway pods that have not been updated to the correct version yet:

Replace <target-istio-version> with the Istio Version listed for the target Installable below.

kubectl --context=<your-cluster> get pods -o custom-columns='NAMESPACE:.metadata.namespace,NAME:.metadata.name,STATUS:.status.phase,IMAGES:.spec.containers[].image' -A -l gateway.networking.k8s.io/gateway-name | grep -vF ':<target-istio-version>'

The version of the Installable is usually not the same as the version of istio that will be installed. See the appropriate section below to determine which version of the Installable to install.

Version 1.0.0​

Istio Version: 1.30.7