Istio 1.12 Upgrade Notes

When you upgrade from Istio 1.10.0 or 1.11.0 to Istio 1.12.0, you need to consider the changes on this page. These notes detail the changes which purposefully break backwards compatibility with Istio 1.10.0 and 1.11.0. The notes also mention changes which preserve backwards compatibility while introducing new behavior. Changes are only included if the new behavior would be unexpected to a user of Istio 1.12.0.

TCP probes now working as expected

When using TCP probes with older versions of Istio, the check was always successful. TCP probes simply check the port will accept a connection, and because all traffic is first redirected to the Istio sidecar, the sidecar will always accept the connection. In Istio 1.12, this issue is resolved by using the same mechanism used for HTTP probes. As a result, TCP probes in 1.12+ will start to properly check the health of the configured port. If your probes previously would have failed, they may now start failing unexpectedly. This change can be disabled temporarily by setting the REWRITE_TCP_PROBES=false environment variable in the Istiod deployment. The entire probe rewrite feature (HTTP and TCP) can also be disabled.

Default revision must be switched when performing a revision-based upgrade

When installing a new Istio control plane revision the previous resource validator will remain unchanged to prevent unintended effects on the existing, stable revision. Once prepared to migrate over to the new control plane revision, cluster operators should switch the default revision. This can be done through istioctl tag set default --revision <new revision>, or if using a Helm-based flow, helm upgrade istio-base manifests/charts/base -n istio-system --set defaultRevision=<new revision>.