Guide to performing a revisioned canary upgrade of Istio control plane, running old and new revisions side-by-side, migrating workloads, and uninstalling the old revision safely
In this lesson we will walk through a canary upgrade of Istio control plane from 1.26.2 to 1.26.3 and how to migrate workloads safely to the new revision. The process uses Istio revisioned installs so you can run the old and new control planes side-by-side, move workloads to the new revision, and then uninstall the old one.Prerequisites used in this article:
A Kubernetes cluster with Istio installed (profile: demo).
Bookinfo sample application for testing.
Check the current Istio and workload state
First, verify the Istio system components and the Bookinfo workloads.
kubectl get pods -n istio-system
Example output:
NAME READY STATUS RESTARTS AGEistio-egressgateway-5478b96959-h7gzm 1/1 Running 0 5m10sistio-ingressgateway-7dddb56f89-wjsp4 1/1 Running 0 5m10sistiod-57dcc6d8b-wkf2n 1/1 Running 0 5m20s
Also check istioctl proxy-status to ensure the proxies are attached to the new istiod revision:
istioctl proxy-status
Example output (all proxies pointing to istiod 1.26.3):
NAME ISTIOD VERSIONdetails-v1-... istiod-1-26-3-774fb5c659-xgx82 1.26.3productpage-v1-... istiod-1-26-3-774fb5c659-xgx82 1.26.3...
You can also use kubectl rollout restart deployment/<deployment-name> to trigger a restart and pick up the new revision tag.
Before uninstalling the old control plane, ensure every workload has been migrated to the new revision. Uninstalling the old revision while proxies still point to it will detach those proxies and break traffic.
Uninstall the old revision
Once you’re confident all workloads and gateways are using the new revision, uninstall the old control plane revision (for example the default revision). First confirm which pods are still associated with the default revision (labels and istioctl proxy-status help with this).Uninstall the old revision:
istioctl uninstall --revision default
If there are still proxies pointing to the revision, istioctl will warn you and list those proxies. Confirm only after you have migrated everything.Example uninstall output:
There are still 8 proxies pointing to the control plane revision defaultdetails-v1-...defaultproductpage-v1-...default...If you proceed with the uninstall, these proxies will become detached from any control plane and will not function correctly.Proceed? (y/n) yRemoved apps/v1, Kind-Deployment/istio-istio-systemRemoved v1, Kind-Service/istio-istio-system...✔ Uninstall complete
Final verification
Check that only the new revision remains in the istio-system namespace and that all application pods are using the new proxy:
kubectl get pods -n istio-system --show-labelskubectl get podsistioctl proxy-status
Example istio-system output after cleanup:
NAME READY STATUS RESTARTS AGEistio-egressgateway-... 1/1 Running 0 7m27sistio-ingressgateway-... 1/1 Running 0 7m27sistiod-1-26-3-774fb5c659-xg82 1/1 Running 0 7m38s
And your workloads should show 2/2 with the updated sidecar proxy version (1.26.3).Summary
Download and use a new istioctl client for the target control plane version.
Install the new control plane as a revision with --revision=....
Create a tag (e.g., latest) pointing to the new revision with istioctl tag set.
Label namespaces with istio.io/rev=<tag> to route injection to the new revision.
Redeploy or restart workloads to pick up the new sidecar (or reapply manifests).
After confirming all proxies are attached to the new control plane, uninstall the old revision.
This revision-based canary install flow lets you upgrade Istio with minimal disruption and a straightforward rollback path if needed.