How to Upgrade Istio on Kubernetes to Version 1.27.3

Upgrade Istio on kubernetes with a structured process for control plane updates, sidecar migration, proxy validation, and workload health checks.

Upgrading Istio helps keep the service mesh aligned with supported Kubernetes and application environments. This guide specifically covers Istio 1.27.3. Istio 1.27 reached end of life on April 7, 2026, so use a currently supported Istio release for new deployments and upgrades where possible.

Upgrade Prerequisites

Before starting the upgrade, make sure you have:

• Access to the Kubernetes cluster with kubectl and Helm installed.
• The istioctl CLI installed or available in the downloaded Istio release.
• Appropriate permissions to modify Istio and application namespaces.
• A backup or documented copy of your existing Istio configuration.

Also, run the Istio precheck before making changes. This helps identify compatibility issues before the upgrade begins.

Repository Setup

First, add the Istio Helm repository and update the repository information.

helm repo add istio https://istio-release.storage.googleapis.com/charts

helm repo update

Upgrade Procedure

Step 1: Download Istio 1.27.3

Set the required Istio version and download the Windows package.

$version="1.27.3"

Invoke-WebRequest -Uri https://github.com/istio/istio/releases/download/$version/istio-$version-win.zip -OutFile istio.zip

Expand-Archive istio.zip -DestinationPath .

Istio 1.27.3 was released on October 20, 2025, as a patch release containing bug and security fixes.

Step 2: Navigate to the Istio Directory

Move to the downloaded Istio directory and run the precheck.

cd istio-$version

.\bin\istioctl x precheck

Then add the Istio binary to the current PowerShell session and verify the installed version.

$env:Path += ";$PWD\bin"

istioctl version

The precheck helps confirm that the cluster is suitable for the planned Istio operation.

Step 3: Upgrade Istio Base Components

Upgrade the Istio base components using the downloaded release.

helm upgrade istio-base manifests/charts/base -n istio-system

Step 4: Upgrade the Istio Control Plane

Next, upgrade the Istio control plane using the target revision.

istioctl upgrade --set revision=1-27-3

The revision format uses hyphens instead of periods, such as 1-27-3. Istio uses revision-based installations to run multiple control planes during migration.

Important: Confirm that the existing Istio installation method and configuration match the upgrade approach before running this command. Istio’s documentation distinguishes between in-place and revision-based upgrades.

Step 5: Check Istio System Pods

After the control plane upgrade, verify the pods in the istio-system namespace.

kubectl get pods -n istio-system

Make sure the Istio components reach a healthy running state before moving to the application namespace.

Step 6: Identify Namespaces Using Istio Injection

Check the namespace labels to identify workloads using Istio sidecar injection.

kubectl get ns --show-labels | Select-String istio

Step 7: Relabel the Application Namespace

Update the application namespace to use the new Istio revision.

kubectl label namespace <application-namespace> istio-injection- istio.io/rev=1-27-3 --overwrite

Replace <application-namespace> with the actual application namespace.

Step 8: Check Proxy Connectivity

Verify the status of the Istio proxies.

istioctl proxy-status

Check that the proxies connect to the expected Istio control plane and report a synchronized status.

Step 9: Restart Deployments

Restart the application deployments so that the workloads receive the new Istio sidecar configuration.

kubectl rollout restart deployment -n <application-namespace>

Then monitor the rollout to make sure the workloads return to a healthy state.

Step 10: Recheck Proxy Status

After the workloads restart, check the proxy status again.

istioctl proxy-status

Confirm that the application proxies appear healthy and synchronized with the new control plane.

Step 11: Verify the Istio Version

Finally, verify the installed Istio version.

istioctl version

Confirm that the expected Istio revision is running before completing the upgrade.

Post-Upgrade Validation Checklist

After completing the upgrade, verify the following:

• Application workloads are healthy and functioning.
• Application deployments complete their rollouts successfully.
• Istio sidecar proxies show the expected revision and synchronized status.
• Application-to-application communication works as expected.
• Ingress and egress traffic work correctly.
• The Application Team has verified end-to-end application functionality.

Conclusion 

Before using this procedure in production, verify the Istio upgrade path and the installation method used by the existing cluster. Istio recommends canary upgrades for production environments because they allow teams to test the new control plane with selected workloads before moving the entire mesh.

Also, review the upgrade notes for the target Istio version. Istio 1.27 introduced changes that can affect areas such as telemetry providers, native sidecars, and Gateway configurations.