Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 4. Updating the Istio CNI

Review the update procedure for the Istio Container Network Interface (CNI). Ensure the CNI plugin remains compatible with the OpenShift Service Mesh control plane during an upgrade.

4.1. About the Istio CNI update process
Copy link

The Istio Container Network Interface (CNI) update process uses Inplace updates. When the IstioCNI resource changes, the daemonset automatically replaces the existing istio-cni-node pods with the specified version of the CNI plugin.

You can use the following field to manage version updates:

spec.version
defines the CNI plugin version to install. Specify the value in the format vX.Y.Z, where X.Y.Z represents the required version. For example, use v1.27.3 to install the CNI plugin version 1.27.3.

To update the CNI plugin, change the spec.version field with the target version. The IstioCNI resource also includes a values field that exposes configuration options from the istio-cni chart.

In ambient mode, the Istio CNI component manages traffic redirection. During RevisionBased upgrades, the component remains compatible with the control plane’s old version and continues to manage traffic redirection for both the old and the new control planes throughout the migration.

Note

The Istio CNI is compatible with a control plane running the same minor version or one minor version higher.

After you update the Istio control plane, update the Istio CNI component. The OpenShift Service Mesh Operator deploys a new version of the CNI plugin, replacing the existing one. The istio-cni-node DaemonSet pods update using a rolling update strategy, ensuring that traffic redirection rules remain active during the entire update process.

4.1.1. Updating the Istio CNI resource version
Copy link

You can update the Istio Container Network Interface (CNI) resource version by changing the version in the resource. Then, the Service Mesh Operator deploys a new version of the CNI plugin that replaces the old version of the CNI plugin. The istio-cni-node pods automatically reconnect to the new CNI plugin.

Prerequisites

  • You are logged in to OpenShift Container Platform as a user with the cluster-admin role.
  • You have installed the Red Hat OpenShift Service Mesh Operator and deployed Istio.
  • You have installed the Istio CNI plugin with the required version. In the following example, the IstioCNI resource named default is deployed in the istio-cni namespace.
  • You have either updated the Istio control plane to the required version (for Inplace strategy) or created a new control plane revision (for RevisionBased strategy).

Procedure

  1. Change the version in the Istio resource. For example, to update to Istio 1.27.3, set the spec.version field to 1.27.3 by running the following command: 

    $ oc patch istiocni default -n istio-cni --type='merge' -p '{"spec":{"version":"v1.27.3"}}'
    Copy to Clipboard Toggle word wrap

  2. Wait for the IstioCNI DaemonSet to reach the Ready status after the update by running the following command: 

    $ oc wait --for=condition=Ready istiocnis/default --timeout=5m
    Copy to Clipboard Toggle word wrap

  3. Confirm that the new version of the CNI plugin is ready by running the following command: 

    $ oc get istiocni default
    Copy to Clipboard Toggle word wrap

    You should see an output similar to the following example: 

    NAME      READY   STATUS    VERSION   AGE
default   True    Healthy   v{istio-latest}   7d1h
    Copy to Clipboard Toggle word wrap

  4. Check the status of the pods by running the following command: 

    $ oc get pods -n istio-cni
    Copy to Clipboard Toggle word wrap

    You should see an output similar to the following example: 

    NAME                   READY   STATUS    RESTARTS   AGE
istio-cni-node-abc12   1/1     Running   0          3m
istio-cni-node-def34   1/1     Running   0          3m
istio-cni-node-ghi56   1/1     Running   0          3m
    Copy to Clipboard Toggle word wrap
Note

When you use the RevisionBased strategy, the Istio CNI component remains compatible with many control plane versions. It continues to manage traffic redirection for both the old and the new control planes throughout the migration. The Istio CNI is compatible with a control plane running the same minor version or one minor version higher.

Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat