Upgrade with Helm

    The Helm charts used in this guide are the same underlying charts used when installing Istio via or the Operator.

    This feature is currently considered .

    Prior to Istio 1.9.0, installations using the Helm charts required hub and tag arguments: and --set global.tag="1.8.2". As of Istio 1.9.0 these are no longer required.

    1. Download the Istio release.

    2. Perform any necessary .

    3. Check the Requirements for Pods and Services.

    Helm 2 is not supported for installing Istio.

    Change directory to the root of the release package and then follow the instructions below.

    The default chart configuration uses the secure third party tokens for the service account token projections used by Istio proxies to authenticate with the Istio control plane. Before proceeding to install any of the charts below, you should verify if third party tokens are enabled in your cluster by following the steps describe . If third party tokens are not enabled, you should add the option --set global.jwtPolicy=first-party-jwt to the Helm install commands. If the jwtPolicy is not set correctly, pods associated with istiod, gateways or workloads with injected Envoy proxies will not get deployed due to the missing istio-token volume.

    Before upgrading Istio, it is recommended to run the istioctl x precheck command to make sure the upgrade is compatible with your environment.

    Before upgrading Istio in your cluster, we recommend creating a backup of your custom configurations, and restoring it from backup if necessary:

    You can restore your custom configuration like this:

    1. $ kubectl apply -f "$HOME"/istio_resource_backup.yaml

    You can install a canary version of Istio control plane to validate that the new version is compatible with your existing configuration and data plane using the steps below:

    Note that when you install a canary version of the istiod service, the underlying cluster-wide resources from the base chart are shared across your primary and canary installations.

    Currently, the support for canary upgrades for Istio ingress and egress gateways is actively in development and is considered experimental.

    2. Verify that you have two versions of istiod installed in your cluster:

      1. $ kubectl get pods -l app=istiod -L istio.io/rev -n istio-system
      2.   NAME                            READY   STATUS    RESTARTS   AGE   REV
      3.   istiod-5649c48ddc-dlkh8         1/1     Running   0          71m   default

    3. Follow the steps to test or migrate existing workloads to use the canary control plane.

    You can perform an in place upgrade of Istio in your cluster using the Helm upgrade workflow.

    This upgrade path is only supported from Istio version 1.8 and above.

    Add your override values file or custom options to the commands below to preserve your custom configuration during Helm upgrades.

    1. Upgrade the Istio base chart:

    2. Upgrade the Istio discovery chart:

      1. $ helm upgrade istiod manifests/charts/istio-control/istio-discovery \
      2.     -n istio-system
      1. $ helm upgrade istio-ingress manifests/charts/gateways/istio-ingress \
      2.     -n istio-system
      3. $ helm upgrade istio-egress manifests/charts/gateways/istio-egress \

    Please refer to the uninstall section in our Helm install guide.