#Updating with InPlace strategy

The InPlace update strategy runs only one revision of the control plane at a time. During an update, all the workloads immediately connect to the new control plane version. To maintain compatibility between the sidecars and the control plane, you can upgrade only one minor version at a time.

The InPlace strategy updates and restarts the existing Istio control plane in place. During this process, only one instance of the control plane exists, eliminating the need to move workloads to a new control plane instance. To complete the update, restart the application workloads and gateways to refresh the Envoy proxies.

While the InPlace strategy offers simplicity and efficiency, there's a slight possibility of application traffic interruption if a workload pod updates, restarts, or scales while the control plane is restarting. You can mitigate this risk by running multiple replicas of the Istio control plane (istiod).

#Selecting InPlace strategy

To select the InPlace strategy, set the spec.updateStrategy.type value in the Istio resource to InPlace.

Example specification to select InPlace update strategy

kind: Istio
spec:
  updateStrategy:
    type: InPlace

You can set this value while creating the resource or edit it later. If you edit the resource after creation, make the change before updating the Istio control plane.

#Installing with InPlace update strategy

You can install the Istio control plane, Istio CNI, and the Bookinfo demo application using the InPlace update strategy.

#Procedure

1. Create the istio-cni and istio-system namespace by running the following command:

   kubectl create ns istio-cni
   kubectl create ns istio-system

2. Attach the workloads to a control plane deployed using the InPlace strategy:

   • Label the namespace to automatically include all workloads by entering the following command:

     kubectl label namespace <namespace_name> istio.io/rev=<revision_name>

   • Apply the revision label to individual workloads by modifying the pod template in the Deployment resource. For example:

     apiVersion: apps/v1
     kind: Deployment
     spec:
       template:
         metadata:
           labels:
             istio.io/rev: <revision_name>

3. If the revision name is default, attach the workloads to the revision by running the following command. The following example labels the namespace with istio-injection: enabled label.

   kubectl label namespace <namespace_name> istio-injection=enabled

4. Install the Istio CNI plugin with the desired version. The following example configuration creates an IstioCNI resource named default in the istio-cni namespace:

   apiVersion: sailoperator.io/v1
   kind: IstioCNI
   metadata:
     name: default
   spec:
     version: v1.26.3
     namespace: istio-cni
     values:
       cni:
         cniConfDir: /etc/cni/multus/net.d # /etc/cni/net.d in ACP 4.0
         excludeNamespaces:
           - istio-cni
           - kube-system

5. Deploy the Istio control plane using the InPlace update strategy. The following example configuration creates an Istio resource named default in the istio-system namespace:

   Example configuration

   apiVersion: sailoperator.io/v1
   kind: Istio
   metadata:
     name: default
   spec:
     namespace: istio-system
     version: v1.26.3
     updateStrategy:
       type: InPlace

6. Set up the application workloads to execute in the cluster. For instance, you can deploy the bookinfo sample application into the bookinfo namespace.

   a. Generate the bookinfo namespace with the command below:

   kubectl create ns bookinfo

   b. Apply a label to the bookinfo namespace to activate automatic sidecar injection. Use the following command:

   kubectl label namespace bookinfo istio-injection=enabled

   c. Deploy the bookinfo application pods into the bookinfo namespace by executing this command:

   kubectl -n bookinfo apply -f https://raw.githubusercontent.com/istio/istio/refs/heads/master/samples/bookinfo/platform/kube/bookinfo.yaml

7. Inspect the Istio resource using the following command:

   kubectl get istio -n istio-system

   Example output

   NAME      NAMESPACE      PROFILE   REVISIONS   READY   IN USE   ACTIVE REVISION   STATUS    VERSION   AGE
   default   istio-system             1           1       1        default           Healthy   v1.26.3   6m3s

   A value of 1 in the IN USE column signifies that the IstioRevision resource is referenced by both the label on the namespace and the injected sidecar proxies.

#Updating Istio control plane with InPlace strategy

When updating Istio using the InPlace strategy, you can increment the version by only one minor release at a time. To update by more than one minor version, you must increment the version and restart the workloads after each update. Restarting workloads ensures compatibility between the sidecar and control plane versions. The update process is complete after restarting all workloads.

#Prerequisites

• You are logged in to the Alauda Container Platform web console as cluster-admin.
• You have installed the Alauda Container Platform Networking for Multus plugin, and kube-ovn must be v4.1.5 or later.
• You have installed the Alauda Service Mesh v2 Operator, and deployed Istio.
• You have installed istioctl on your local machine.
• You have configured the Istio control plane to use the InPlace update strategy. In this example, the Istio resource named default is deployed in the istio-system namespace.
• You have installed the Istio CNI plugin with the desired version. In this example, the IstioCNI resource named default is deployed in the istio-cni namespace.
• You have labeled the bookinfo namespace to enable sidecar injection.
• You have application workloads running in the cluster. In this example, the bookinfo application is deployed in the bookinfo namespace.

#Procedure

1. Change the version in the Istio resource. For example, to update to Istio 1.28.1, set the spec.version field to v1.28.1 by running the following command:

   kubectl patch istio default --type='merge' -p '{"spec":{"version":"v1.28.1"}}'

   Version update in Istio CR

   kind: Istio
   spec:
     version: v1.28.1
     updateStrategy:
       type: InPlace

   The Service Mesh v2 Operator deploys a new version of the control plane that replaces the old version of the control plane. The sidecars automatically reconnect to the new control plane.

2. Confirm that the new version of the control plane is ready by running the following command:

   kubectl get istio

   Example output

   NAME      NAMESPACE      PROFILE   REVISIONS   READY   IN USE   ACTIVE REVISION   STATUS    VERSION   AGE
   default   istio-system             1           1       1        default           Healthy   v1.28.1   18m5s

3. Restart the application workloads so that the new version of the sidecar gets injected by running the following command:

   kubectl rollout restart deployment -n bookinfo

#Verification

Verify that the new version of the sidecar is running by entering the following command:

istioctl proxy-status

Example output

NAME                                        CLUSTER        CDS              LDS              EDS              RDS              ECDS        ISTIOD                      VERSION
details-v1-5c89dbb599-4t927.bookinfo        Kubernetes     SYNCED (92s)     SYNCED (92s)     SYNCED (85s)     SYNCED (92s)     IGNORED     istiod-57559f96c4-v2h9g     1.28.1-asm-r0
productpage-v1-f8fdd5649-xmxkt.bookinfo     Kubernetes     SYNCED (92s)     SYNCED (92s)     SYNCED (85s)     SYNCED (92s)     IGNORED     istiod-57559f96c4-v2h9g     1.28.1-asm-r0
ratings-v1-ccf8bc48c-766tl.bookinfo         Kubernetes     SYNCED (93s)     SYNCED (93s)     SYNCED (85s)     SYNCED (93s)     IGNORED     istiod-57559f96c4-v2h9g     1.28.1-asm-r0
reviews-v1-85dc746bfc-gsf6l.bookinfo        Kubernetes     SYNCED (92s)     SYNCED (92s)     SYNCED (85s)     SYNCED (92s)     IGNORED     istiod-57559f96c4-v2h9g     1.28.1-asm-r0
reviews-v2-5bd759b4c5-nkb62.bookinfo        Kubernetes     SYNCED (93s)     SYNCED (93s)     SYNCED (85s)     SYNCED (93s)     IGNORED     istiod-57559f96c4-v2h9g     1.28.1-asm-r0
reviews-v3-55d5b84fb9-wq9ds.bookinfo        Kubernetes     SYNCED (94s)     SYNCED (94s)     SYNCED (85s)     SYNCED (94s)     IGNORED     istiod-57559f96c4-v2h9g     1.28.1-asm-r0

The column VERSION should match with the new control plane version.