shweshi/istio-upgrade-skill
Use when the user asks about upgrading Istio, checking Istio version compatibility, planning an Istio migration, performing pre-upgrade checks, preparing for a version bump, or creating an Istio upgrade plan. Checks CRD compatibility and storage version changes, validates sidecar proxy version skew against control-plane skew limits, reviews EnvoyFilter deprecated xDS API usage and Wasm ABI compatibility, analyzes east-west gateway upgrade ordering in multi-cluster environments, assesses federation controller compatibility and trust bundle exchange, identifies breaking changes across all intermediate Istio releases, and produces a scored upgrade readiness assessment with a go/no-go recommendation and rollback strategy.
84
97%
Does it follow best practices?
Impact
96%
1.18xAverage score across 1 eval scenario
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required runtime workflow runs `kubectl get ... -o yaml/json` and `istioctl analyze -A`, which ingests cluster resource YAML/JSON (e.g., EnvoyFilters, CRDs, federation resources) authored by other parties than the operating user, into the agent’s LLM context for analysis—an outsider free-text/prose injection surface.
Where we found it
EnvoyFilter resources (kubectl get envoyfilter -A -o yaml)
content-type · 2 sites
The plugin instructs the agent to fetch all EnvoyFilter resources across all namespaces in YAML format, which are user-authored configuration resources that could contain arbitrary Envoy configuration including Lua scripts, Wasm module references, and custom filter logic - an outsider free-text injection surface.
SKILL.md
Line 90
references/ENVOYFILTER_ANALYSIS.md
Line 6
Istio CRD resources (kubectl get crd -o json)
content-type · 2 sites
The plugin instructs the agent to fetch all Istio CRD definitions in JSON format, which includes the full schema and stored versions of all Istio custom resources - these are cluster configuration resources that define the shape of all Istio objects.
SKILL.md
Line 78
references/CRD_ANALYSIS.md
Line 6
PeerAuthentication resources (kubectl get peerauthentication -A -o yaml)
content-type · 1 site
The plugin instructs the agent to fetch all PeerAuthentication resources across all namespaces in YAML format, which define mTLS modes and certificate configurations - security policy resources authored by platform teams.
references/SECURITY_ANALYSIS.md:6
AuthorizationPolicy resources (kubectl get authorizationpolicy -A -o yaml)
content-type · 1 site
The plugin instructs the agent to fetch all AuthorizationPolicy resources across all namespaces in YAML format, which define access control rules including custom actions, principals, and conditions - security policy resources authored by platform teams.
references/SECURITY_ANALYSIS.md:7
RequestAuthentication resources (kubectl get requestauthentication -A -o yaml)
content-type · 1 site
The plugin instructs the agent to fetch all RequestAuthentication resources across all namespaces in YAML format, which define JWT validation rules including issuer URLs, JWKS URIs, and token forwarding behavior - security policy resources authored by platform teams.
references/SECURITY_ANALYSIS.md:8
ServiceExport resources (kubectl get serviceexport -A -o wide)
content-type · 1 site
The plugin instructs the agent to fetch all ServiceExport resources across all namespaces, which define services exported for multi-cluster federation - federation resources authored by platform teams.
references/FEDERATION_ANALYSIS.md:7
ServiceImport resources (kubectl get serviceimport -A -o wide)
content-type · 1 site
The plugin instructs the agent to fetch all ServiceImport resources across all namespaces, which define services imported from other clusters in multi-cluster federation - federation resources authored by platform teams.
references/FEDERATION_ANALYSIS.md:8
East-West Gateway deployment resources (kubectl get deploy -A -o json)
content-type · 1 site
The plugin instructs the agent to fetch all deployments matching east-west gateway patterns in JSON format, which includes the full deployment spec with container images, environment variables, and configuration - infrastructure resources authored by platform teams.
references/EAST_WEST_GATEWAY.md:7
Multi-cluster secret resources (kubectl get secret -A -l istio/multiCluster=true -o wide)
content-type · 1 site
The plugin instructs the agent to fetch all secrets labeled for multi-cluster communication, which contain remote cluster credentials and certificates - sensitive infrastructure resources authored by platform teams.
references/EAST_WEST_GATEWAY.md:10
Remote secret resources (kubectl get secret -A | grep istio-remote-secret)
content-type · 1 site
The plugin instructs the agent to fetch all remote cluster secrets, which contain cross-cluster authentication credentials - sensitive infrastructure resources authored by platform teams.
references/EAST_WEST_GATEWAY.md:11
Federation CRD resources (kubectl get crd | grep federation|serviceexport|serviceimport)
content-type · 2 sites
The plugin instructs the agent to discover federation-related CRDs, which reveals the federation mechanism in use (MCS, Admiral, Sail Operator, custom) - cluster configuration resources authored by platform teams.
SKILL.md
Line 116
references/FEDERATION_ANALYSIS.md
Line 6
istioctl analyze -A (full cluster resource analysis)
content-type · 2 sites
The plugin instructs the agent to run istioctl analyze across all namespaces, which validates all Istio resources (VirtualServices, DestinationRules, Gateways, EnvoyFilters, AuthorizationPolicies, PeerAuthentications, RequestAuthentications, ServiceEntries, etc.) against the target CRD schema - this ingests the complete set of user-authored Istio configuration into the LLM context.
SKILL.md
Line 142
references/SECURITY_ANALYSIS.md
Line 36
kubectl get virtualservice,destinationrule,serviceentry -A
content-type · 1 site
The plugin instructs the agent to fetch all VirtualService, DestinationRule, and ServiceEntry resources across all namespaces, which are core traffic management resources authored by platform teams (routing rules, fault injection, retries, external service definitions).
SKILL.md
141
kubectl get virtualservice,destinationrule,serviceentry -A
kubectl get admiral -A
content-type · 1 site
The plugin instructs the agent to fetch all Admiral federation custom resources across all namespaces, which are Admiral-specific federation CRs authored by platform teams.
references/FEDERATION_ANALYSIS.md
11
kubectl get admiral -A 2>/dev/null || true
kubectl get federatedservice -A
content-type · 1 site
The plugin instructs the agent to fetch all FederatedService resources across all namespaces, which are Sail Operator federation resources authored by platform teams.
references/FEDERATION_ANALYSIS.md
12
kubectl get federatedservice -A 2>/dev/null || true
kubectl get all -A | grep -i federation
content-type · 1 site
The plugin instructs the agent to fetch all resources across all namespaces and filter for federation-related resources, catching any federation-related resources across all types authored by platform teams.
references/FEDERATION_ANALYSIS.md
9
kubectl get all -A | grep -i federation
istioctl remote-clusters
content-type · 3 sites
The plugin instructs the agent to run istioctl remote-clusters, which fetches remote cluster connection state and metadata from the control plane.
SKILL.md
104
istioctl remote-clusters
references/EAST_WEST_GATEWAY.md
14
istioctl remote-clusters
34
run `istioctl remote-clusters` -- all remote clusters must show `SYNCED`
istioctl proxy-config endpoints
content-type · 2 sites
The plugin instructs the agent to run istioctl proxy-config endpoints to fetch resolved cross-cluster endpoints from gateway proxy config.
references/EAST_WEST_GATEWAY.md
15
istioctl proxy-config endpoints <east-west-gw-pod> | grep cross-cluster
references/FEDERATION_ANALYSIS.md
33
Run `istioctl proxy-config endpoints <federation-gateway-pod> | grep <exported-service>` before and after upgrade.
- Audited
- Security analysis