ICA: Installation, Upgrade & Configuration

What this domain tests

The Installation, Upgrade & Configuration domain checks whether you can choose an Istio profile, install a control plane, upgrade by revision, and wire injection and mesh configuration without breaking workloads. Expect questions on istioctl, IstioOperator overlays, revisions, and namespace labels.

Core rules

• istioctl install -f overlay.yaml merges an IstioOperator overlay onto a profile. Profiles include default, demo, minimal, ambient, and empty. minimal installs only istiod, so an ingress Gateway resource has no gateway deployment behind it.
• Pin a revision with --set revision=canary. Namespaces select it with istio.io/rev=canary; do not also set istio-injection=enabled, because the two labels conflict.
• Canary upgrade: install the new revision beside the old, move namespaces by changing the revision label, restart pods, verify, then istioctl uninstall --revision <old>.
• istioctl x precheck checks cluster compatibility; istioctl analyze finds configuration errors before rollout.

Worked example

A cluster runs revision default. You install --set revision=1-20-0, then label namespace payments with istio.io/rev=1-20-0 and remove istio-injection=enabled. New pods get the 1-20-0 sidecar; existing pods keep the old proxy until restarted. After kubectl rollout restart deployment and a clean istioctl proxy-status, you uninstall the old revision. The reasoning: injection is decided at pod creation, so relabeling alone does not move running pods.

Traps

Installing minimal and expecting an ingress gateway; leaving both injection labels on a namespace; changing a revision label without restarting pods; applying an overlay that silently overrides meshConfig; and forgetting that demo is not a production profile.