Updating

The OpenShift Service Mesh Operator will upgrade automatically to the latest available version based on the selected channel when the approval strategy field is set to Automatic (default). If the approval strategy field is set to Manual, Operator Lifecycle Manager (OLM) will generate an update request, which a cluster administrator must approve to update the Operator to the latest version.

The Operator update process does not automatically update the Istio control plane unless the Istio resource version is set to an alias (for example, vX.Y-latest) and the updateStrategy is set to InPlace. This triggers a control plane update when a new version is available in the Operator. By default, the Operator will not update the Istio control plane unless the Istio resource is updated with a new version.

To select the InPlace strategy, set the spec.updateStrategy.type value in the Istio resource to InPlace.

kind: Istio
spec:
  updateStrategy:
    type: InPlace

You can set this value when you first create the resource or you can edit the resource later. If you choose to edit the resource after it is created, make the change prior to updating the Istio control plane.

When Istio is configured to use the InPlace strategy, the IstioRevision resource that the Operator creates always has the same name as the Istio resource. To attach the workloads to a control plane deployed using the InPlace strategy, you can set the istio.io/rev namespace label to the name of the IstioRevision.

$ oc label namespace <namespace-name> istio.io/rev=<revision-name>

Alternatively, you can apply the label to the workload pods by modifying the pod template in deployment resource.

apiVersion: apps/v1
kind: Deployment
spec:
  template:
    metadata:
      labels:
        istio.io/rev: <revision-name>

If the revision name is default, then you can attach the workloads to the revision by labeling the namespace with the label istio-injection: enabled.

oc label namespace <namespace-name> istio-injection=enabled

When updating Istio using the InPlace strategy, you can only increment by one minor version at a time. If you want to update by more than one minor version, then you must increment the version and restart the workloads after each update. This ensures that the sidecar version is compatible with the control plane version. After all the workloads are restarted, the update process is complete.

To deploy Istio with the RevisionBased strategy, create the Istio resource with the following spec.updateStrategy value:

kind: Istio
spec:
  version: v1.24.3
  updateStrategy:
    type: RevisionBased

After you select the strategy for the Istio resource, the Operator creates a new IstioRevision resource with the name <istio_resource_name>-<version>.

To attach the workloads to a control plane deployed by using the RevisionBased strategy, you must set the istio.io/rev namespace label to the name of the IstioRevision resource. Alternatively, you can apply the label to the workload pods.

When updating Istio using the RevisionBased strategy, you may increment by more than one minor version at a time because the existing sidecars do not automatically connect to the new revision of the control plane. Instead, you must manually move the workloads to the new control plane.