Istio 1.17 Upgrade Notes
Important changes to consider when upgrading to Istio 1.17.
When you upgrade from Istio 1.16.x to Istio 1.17, you need to consider the changes on this page.
These notes detail the changes which purposefully break backwards compatibility with Istio
The notes also mention changes which preserve backwards compatibility while introducing new behavior.
Changes are only included if the new behavior would be unexpected to a user of Istio
Users upgrading from 1.15.x to Istio 1.17 should also reference the 1.16 change notes.
Gateway naming scheme updated
If you are using the Kubernetes Gateway
to manage your Istio gateways, the names of the
Kubernetes Deployment and
Service has been modified. The default
Service Account used has also switched to use its own token. To continue using the old convention during upgrades, the
gateway.istio.io/service-account annotations can be used.
Client-go auth plugins removed
istioctl 1.17 contains an upgraded version of client-go with the
azure auth plugins removed (similar to the kubectl 1.26 release). See kubelogin and Kubectl Auth Changes in GKE for details about the cloud-specific replacements. After migrating, be sure to update/regenerate your kubeconfig files before using istioctl.