Twitter ● User discussions ● Upgrade survey #IstioCon Common Feedback ● Users found upgrades challenging ● Releases were inconsistent ○ Release and Upgrade Notes ○ Release date slip ○ Release Istio community didn’t have a process #IstioCon Led To ● Upgrade Working Group ● Release Note Generation ● Definition of Done #IstioCon Upgrade Working Group Mission: To improve the stability, user user experience, and test infrastructure around Istio upgrades #IstioCon Upgrade Working Group - Stability ● Standards and processes ○ Control plane behavior ○ Data plane communication ● Promote revision-based

1.4 but in Istio 1.5, it was disabled again with notes that it should be replaced by a DNS-based secure signing method. So the updated change log notes: “Despite the naming, in Istio 1.5 when control namespace that is not managed by Istio 1https://istio.io/latest/news/releases/1.5.x/announcing-1.5/upgrade-notes/#control-plane-security 5 | Google Istio Security Assessment Google / NCC Group Confidential

服务网格数据平面热升级技术分享 ServiceMesh Data-Plane Hot-Upgrade 阿里云服务网格团队 – 史泽寰 • 为什么需要服务网格数据面热升级 • 实现热升级 • 实践热升级 目录 Catalog 2 为什么需要服务网格数据面热升级 Why do we need Hot-Upgrade for ServiceMesh Data-Plane • 造成请求失败，影响业务质量 增加workload保持服务容量不变，应对大规模场景难以在扩容规模和操作便捷度上取 得令人满意的平衡 传统Sidecar升级方式的缺点 3 为什么需要服务网格数据面热升级 Why do we need Hot-Upgrade for ServiceMesh Data-Plane • 只替换/重启Sidecar • 替换/重启过程中进/出不会出现请求失败，连接失败 • 易于运维，可以控制升级策略 理想的Sidecar升级 io/envoy-hot-restart-1d16b14555b5 实现热升级 Implement Hot-Upgrade 6 • Sidecar生命周期管理能力 • 启动两个Sidecar，以进行Envoy热重启的排水流程两个实例并存的阶段 • 能够对整个热升级流程中的镜像替换进行控制 实现热升级 Implement Hot-Upgrade 7 • Sidecar生命周期管理能力 • 启动两个Sidecar，以

/ #IstioCon Listening to our users UX Working Group - Upgrade Survey 2020 #IstioCon Listening to our users ... UX Working Group - Upgrade Survey 2020 Do users on old versions understand their security security and support posture? #IstioCon Listening to our users ... UX Working Group - Upgrade Survey 2020 #IstioCon Theme for Istio 2021 #IstioCon Day 2 operations https://dzone.com/articles/de latest & greatest Istio ● Utilize new capabilities ● Desire tooling to ensure frictionless upgrade https://istio.io/latest/blog/2020/tradewinds-2020/ ● Fixed budget for infrastructure maintenance

Welcome App #IstioCon istioctl... ● analyze ● experimental ● proxy-config ● proxy-status ● upgrade (--dry-run) ● verify-install ● bug-report #IstioCon Maintaining Istio ● Deployments ○ IstioOperator

Filters ○ Gateways Developer Platform Integration ● Mesh Automation ○ Control Plane Install/Upgrade ○ Admiral cluster registration ● Higher Level Logical Service for Developers ○ Multi-cluster

Platform owner Mesh operator (could be your cloud provider) 3 Key Personas install verify-install upgrade Istio simplify install helm3 #IstioCon Pilot Mixer Citadel Node Agent Injector Galley istio-system

use by pilot-agent ○ For gateways this environmental variable also must be set on installation/upgrade #IstioCon istioctl iop.yaml Install with istioctl install -f iop.yaml apiVersion: install.istio

than envoy filter is already there Cons: ● You have to maintain a fork of Istio, which makes upgrade painful ● Writing an Envoy Filter for AwesomeRPC is painful Istio Config Envoy Config #IstioCon

：No Freestyle • 非功能需求：并发、成功率、响应时间等服务质量参数。 • 故障处理需求：故障预案。 • 影响范围分析。 • 选定测试版本：研读开放Issue以及Release Notes。测试方案部署 • Istio部署 • 复查集群环境 • 调整资源参数 • 调整亲和性参数 • 调整HPA • 日志输出和调试开关复查 • Istio功能裁剪 • 备用业务部署 • 试用服务部署