Upgrade Istio using istioctl [Experimental]

The following information describes an experimental feature, which is intendedfor evaluation purposes only.

The istioctl experimental upgrade command performs an upgrade of Istio. Before performingthe upgrade, it checks that the Istio installation meets the upgrade eligibilitycriteria. Also, it alerts the user if it detects any changes in the profiledefault values between Istio versions.

The upgrade command can also perform a downgrade of Istio.

See the istioctl upgrade referencefor all the options provided by the istioctl experimental upgrade command.

Upgrade prerequisites

Ensure you meet these requirements before starting the upgrade process:

Upgrade steps

Traffic disruption may occur during the upgrade process. To minimize the disruption, ensurethat at least two replicas of each component (except Citadel) are running. Also, ensure thatPodDistruptionBudgetsare configured with a minimum availability of 1.

The commands in this section should be run using the new version of istioctl whichcan be found in the bin/ subdirectory of the downloaded package.

  • Download the new Istio releaseand change directory to the new release directory.

  • Verify that istoctl supports upgrading from your current Istio version byviewing the supported versions list:

  1. $ istioctl manifest versions
  • Ensure that your Kubernetes configuration points to the cluster to upgrade:
  1. $ kubectl config view
  • Begin the upgrade by running this command:
  1. $ istioctl experimental upgrade -f `<your-custom-configuration-file>`

<your-custom-configuration-file> is theIstioControlPlane API Custom Resource Definitionfile you used to customize the installation of the currently-running version of Istio.

If you installed Istio using the -f flag, for exampleistioctl manifest apply -f <IstioControlPlane-custom-resource-definition-file>,then you must provide the same -f flag value to the istioctl upgrade command.

istioctl upgrade does not support the —set flag. Therefore, if youinstalled Istio using the —set command, create a configuration file withthe equivalent configuration options and pass it to the istioctl upgradecommand using the -f flag instead.

If you omit the -f flag, Istio upgrades using the default profile.

After performing several checks, istioctl will ask you to confirm whether to proceed.

  • istioctl will install the new version of Istio control plane and indicate thecompletion status.

  • After istioctl completes the upgrade, you must manually update the Istio data planeby restarting any pods with Istio sidecars:

  1. $ kubectl rollout restart deployment

Downgrade prerequisites

Ensure you meet these requirements before starting the downgrade process:

  • Istio version 1.4 or higher is installed.

  • Your Istio installation was installed using istioctl.

  • Downgrade must be done using the istioctl binary version thatcorresponds to the Istio version that you intend to downgrade to.For example, if you are downgrading from Istio 1.4 to 1.3.3, use istioctlversion 1.3.3.

Downgrade to Istio 1.4 and higher versions steps

You can also use istioctl upgrade to downgrade versions. The process steps areidentical to the upgrade process mentioned in the previous section, only use theistioctl binary corresponding to the lower version. When completed, theprocess will restore Istio back to the Istio version that was installed beforeyou ran istioctl experimental upgrade.

Downgrade to Istio 1.3.3 and lower versions steps

The istioctl experimental upgrade command is not available in Istio 1.3.3 and lower.Therefore, downgrade must be performed using theistioctl experimental manifest apply command.

This command installs the same Istio control plane as istioctl experimental upgrade,but does not perform any checks. For example, default values applied to the clusterfor a configuration profile may change without warning.

See also

Upgrade using Helm

Upgrade the Istio control plane, and optionally, the CNI plug-in using Helm.

DNS Certificate Management

Provision and manage DNS certificates in Istio.

Secure Webhook Management

A more secure way to manage Istio webhooks.

Demystifying Istio's Sidecar Injection Model

De-mystify how Istio manages to plugin its data-plane components into an existing deployment.

Customizable Install with Helm

Install and configure Istio for in-depth evaluation or production use.

Customizable Install with Istioctl

Install and customize any Istio configuration profile for in-depth evaluation or production use.