In-place upgrades with Helm

Upgrade your ambient control and data plane components in your Solo Enterprise for Istio cluster.

Considerations

Before you upgrade your ambient components, review the following limitations and recommendations.

Revision and canary upgrade limitations

The upgrade guides in this documentation show you how to perform in-place upgrades for your Istio components, which is the recommended upgrade strategy.

If you use Kubernetes Gateway API resources to manage ingress traffic, a tag flip during a canary upgrade can push empty xDS configuration to Gateway pods and cause a brief traffic blackhole. For prerequisites and a zero-downtime procedure, see Canary upgrades with the Gateway API.

CNI upgrades

In an ambient installation, the istio-cni pods are enhanced for safe in-place upgrades. When istio-cni is scheduled for removal, it determines whether an upgrade is in process by checking the value of AGENT_UPGRADE_ID in the istio-cni ConfigMap against its internal upgrade ID. If the removal is due to an upgrade, istio-cni creates a “stub” CNI plug-in in its place on the node. This stub CNI plug-in stalls any newly scheduled pods on that node, and does not allow the pods to spin up until the replacement istio-cni is up and running.

ztunnel upgrades

When Kubernetes restarts ztunnel pods during an upgrade, long-lived connections on the node are dropped. You can reduce this impact by tuning the termination grace period and by cordoning nodes or using blue/green node pools to limit the number of active pods being upgraded simultaneously. For configuration steps, see Tune ztunnel performance.

Before you begin

Verify that the minor version of the Solo distribution of Istio that you want to upgrade to is tested and supported for your Solo Enterprise for Istio version. For Istio 1.29 and later, you can check available patch builds in the us-docker.pkg.dev/soloio-img/istio repo. For Istio version 1.28 and earlier, you can get the minor version repo URL from the Istio images built by Solo.io support article, and check the patch version builds in that repo.
Check the Solo Enterprise for Istio release notes for changes from the previous version.
Before you proceed with the upgrade, make sure that you review the breaking changes that were introduced in this release and the impact that they have on your current environment. For more information, see the Breaking changes.
Check the Istio release notes for the upgrade version to prepare for any breaking changes.
Be sure to review the following known Istio version restrictions.
- To use the Solo distribution of Istio 1.30 for multicluster setups in which waypoint proxies are deployed, use patch version 1.30.2 or later. Patch versions 1.30.0 and 1.30.1 contain a bug in which the peering controller does not create a remote `ServiceEntry` for services whose pod selector matches waypoint proxy pods.
- In the Solo distribution of Istio 1.30 and 1.31, WorkloadEntry resources created by autoregistration might not carry the networking.istio.io/tunnel: http label. When that label is absent, ambient-enrolled pods send connections to the VM as plaintext instead of over HBONE. Because plaintext connections carry no mTLS client identity, any AuthorizationPolicy that uses source.principals to control inbound access to the VM always returns 403. As a workaround, manually label the gateway WorkloadEntry with networking.istio.io/tunnel: http to force HBONE, or replace source.principals conditions with source.ipBlocks until a patch release is available.

Single cluster

Upgrade istioctl

Save the details for the version of the Solo distribution of Istio that you want to upgrade to.
1. Save the Solo distribution of Istio patch version and tag.
  export ISTIO_VERSION=1.30.2 # Change the tags as needed export ISTIO_IMAGE=${ISTIO_VERSION}-solo
2. Save the image and Helm repository information for the Solo distribution of Istio.
  - Istio 1.29 and later:
    export REPO=us-docker.pkg.dev/soloio-img/istio export HELM_REPO=us-docker.pkg.dev/soloio-img/istio-helm
  - Istio 1.28 and earlier: Save the repo key for the minor version of the Solo distribution of Istio that you want to install. This is the 12-character hash at the end of the repo URL us-docker.pkg.dev/gloo-mesh/istio-<repo-key>, which you can find in the Istio images built by Solo.io support article.
    # 12-character hash at the end of the minor version repo URL export REPO_KEY=<repo_key> export REPO=us-docker.pkg.dev/gloo-mesh/istio-${REPO_KEY} export HELM_REPO=us-docker.pkg.dev/gloo-mesh/istio-helm-${REPO_KEY}

Upgrade your istioctl CLI client to the new version.

curl -L https://istio.io/downloadIstio | ISTIO_VERSION=${ISTIO_VERSION} sh -
cd istio-${ISTIO_VERSION}
export PATH=$PWD/bin:$PATH

Upgrade CRDs and istiod

Upgrade the custom resources of the Kubernetes Gateway API to the latest supported version, 1.5.0.

kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.0/standard-install.yaml

Upgrade the Istio CRDs to the new version.

helm get values istio-base -n istio-system -o yaml > istio-base.yaml
helm upgrade istio-base oci://${HELM_REPO}/base \
--namespace istio-system \
--version ${ISTIO_IMAGE} \
-f istio-base.yaml

If you see an error such as Error: UPGRADE FAILED: Rendered manifests contain a resource that already exists, see the community Istio docs.

Get the current values for the istiod Helm release in your cluster.

helm get values istiod -n istio-system -o yaml > istiod.yaml
open istiod.yaml

Make edits to the istiod Helm values, and save the file. If you update the Istio minor version, such as in the global.tag field, be sure to also update the value of the hub field to the repo for the correct version of the Solo distribution of Istio.

Upgrade your Helm release with the updated values.

helm upgrade istiod oci://${HELM_REPO}/istiod \
-n istio-system \
--version ${ISTIO_IMAGE} \
-f istiod.yaml

Verify that the istiod pods are successfully restarted. Note that it might take a few seconds for the pods to become available.
```
kubectl get pods -n istio-system | grep istiod
```
Example output:
```
istiod-b84c55cff-tllfr   1/1     Running   0          58s
```

Upgrade the CNI and ztunnel

If your changes include upgrading the Istio version of the components, be sure to upgrade the istiod control plane before you upgrade the CNI and ztunnel components. Otherwise, these components might have an outdated image.

For the component that you want to update, get the current values for its Helm release in your cluster.

helm get values istio-cni -n istio-system -o yaml > cni.yaml
open cni.yaml

helm get values ztunnel -n istio-system -o yaml > ztunnel.yaml
open ztunnel.yaml

helm get values istio-cni -n kube-system -o yaml > cni.yaml
open cni.yaml

helm get values ztunnel -n kube-system -o yaml > ztunnel.yaml
open ztunnel.yaml

Make edits to the Helm values of the components that you want to upgrade, and save the files. If you update the Istio minor version, such as in tag fields, be sure to also update the value of the hub field to the repo for the correct version of the Solo distribution of Istio.

Upgrade your Helm releases with the updated values.

helm upgrade istio-cni oci://${HELM_REPO}/cni -n istio-system --version ${ISTIO_IMAGE} -f cni.yaml

helm upgrade ztunnel oci://${HELM_REPO}/ztunnel -n istio-system --version ${ISTIO_IMAGE} -f ztunnel.yaml

helm upgrade istio-cni oci://${HELM_REPO}/cni -n kube-system --version ${ISTIO_IMAGE} -f cni.yaml

helm upgrade ztunnel oci://${HELM_REPO}/ztunnel -n kube-system --version ${ISTIO_IMAGE} -f ztunnel.yaml

Verify that the ztunnel and Istio CNI pods are successfully restarted. Note that it might take a few seconds for the pods to become available.

kubectl get pods -n istio-system

kubectl get pods -n kube-system

Example output:

istiod-85c4dfd97f-mncj5            1/1     Running   0             42s
istio-cni-node-pr5rl               1/1     Running   0             42s
istio-cni-node-pvmx2               1/1     Running   0             42s
istio-cni-node-lcrcd               1/1     Running   0             42s
ztunnel-tvtzn                      1/1     Running   0             40s
ztunnel-vtpjm                      1/1     Running   0             40s
ztunnel-hllxg                      1/1     Running   0             40s

Multicluster

Upgrade the multicluster ambient mesh in your multicluster setup.

Upgrade istioctl

Set environment variables for the Solo distribution of Istio that you want to upgrade to.

Istio 1.29 and later:

# Solo distribution of Istio patch version
# in the format 1.x.x, with no tags
export ISTIO_VERSION=1.30.2
export ISTIO_IMAGE=${ISTIO_VERSION}-solo
export REPO=us-docker.pkg.dev/soloio-img/istio
export HELM_REPO=us-docker.pkg.dev/soloio-img/istio-helm

Istio 1.28 and earlier: Find these values in the Istio images built by Solo.io support article.

# Solo distribution of Istio patch version
# in the format 1.x.x, with no tags
export ISTIO_VERSION=<istio_version>
# Repo key for the minor version of the Solo distribution of Istio
# This is the 12-character hash at the end of the repo URL: 'us-docker.pkg.dev/gloo-mesh/istio-<repo-key>'
export REPO_KEY=<repo_key>
export HELM_REPO=us-docker.pkg.dev/gloo-mesh/istio-helm-${REPO_KEY}
export ISTIO_IMAGE=${ISTIO_VERSION}-solo
export REPO=us-docker.pkg.dev/gloo-mesh/istio-${REPO_KEY}

Upgrade your istioctl CLI client to the new version. This script automatically detects your OS and architecture, downloads the appropriate Solo distribution of Istio binary, and verifies the installation.
```
bash <(curl -sSfL https://raw.githubusercontent.com/solo-io/doc-examples/main/istio/install-istioctl.sh)
export PATH=${HOME}/.istioctl/bin:${PATH}
```