shweshi/istio-upgrade-skill
Use when the user asks about upgrading Istio, checking Istio version compatibility, planning an Istio migration, performing pre-upgrade checks, preparing for a version bump, or creating an Istio upgrade plan. Checks CRD compatibility and storage version changes, validates sidecar proxy version skew against control-plane skew limits, reviews EnvoyFilter deprecated xDS API usage and Wasm ABI compatibility, analyzes east-west gateway upgrade ordering in multi-cluster environments, assesses federation controller compatibility and trust bundle exchange, identifies breaking changes across all intermediate Istio releases, and produces a scored upgrade readiness assessment with a go/no-go recommendation and rollback strategy.
84
97%
Does it follow best practices?
Impact
96%
1.18xAverage score across 1 eval scenario
Advisory
Suggest reviewing before use
PROXY_COMPATIBILITY.mdreferences/
Proxy Compatibility Reference
Version Skew Classification
| Skew | Classification |
|---|---|
| Same minor version | PASS |
| +1 minor version | GOOD |
| +2 minor versions | WARNING |
| +3 minor versions | HIGH RISK -- rolling restart required before cutover |
| > +3 minor versions | CRITICAL -- upgrade blocked; must stage through intermediate versions |
Rule: Istio supports N-1 proxy/control-plane skew officially. N-2 is tolerated but unsupported. Beyond N-2, proxies may fail to connect to istiod.
Commands
istioctl proxy-status
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.spec.containers[*].image}{"\n"}{end}' | grep istio-proxyDecision Logic
- Extract oldest proxy version from
istioctl proxy-status. - Compute skew =
target_minor - oldest_proxy_minor. - Apply the classification table above.
- If skew >= 3: block upgrade -- require rolling restart of workloads first to bring proxies to N-1.
- If any proxy version predates the source control plane: classify as CRITICAL (stale proxy).
Risk Triggers
- Pods with
istio-proxyimage from a revision that no longer has a live istiod -> proxy cannot reconnect after control plane upgrade. - DaemonSets (e.g. istio-cni) pinned to old node image -> node-level injection failure after upgrade.
- Jobs/CronJobs with
istio-proxysidecars that are not restarted -> permanent skew after upgrade.