Handling Policy of Resource Configuration Using IstioOperator

When Istio is installed using Istio Operator, the workloads (istiod, istio-ingressgateway, and istio-egressgateway) managed by Istio Operator need to be updated. For example, upgrade the version of the service mesh enabled for the workload, or add more istio-ingressgateway instances. You can update these workloads on the Workloads page of the CCE console.

Handling Policy

In ASM 1.8.6, to avoid configuration conflicts and ensure stable running of Istio workloads, you are advised to:

Define key and non-key running configurations for workloads.

**Table 1** Key running configurations of each resource type
Workload	Resource Type	Item	Description	Applicable Version
istiod istio-ingressgateway istio-egressgateway	Deployment	spec.replicas	Number of pods	1.8.6 or later
		spec.strategy	Upgrade policies
		spec.template.spec.nodeSelector	Scheduling policies
		spec.template.spec.affinity	Scheduling policies
		spec.template.spec.tolerations	Scheduling policies
		spec.template.spec.containers.resources	Resource requests and limits
istiod istio-ingressgateway istio-egressgateway	Deployment	spec.template.spec.containers.env	Container environment variables	1.13.9-r10, 1.15.7-r3, or later 1.18.7-r3 or later
istio-cni-node	DaemonSet	spec.updateStrategy	Upgrade policies	1.18.5-r1 or later
		spec.template.spec.nodeSelector	Scheduling policies
		spec.template.spec.affinity	Scheduling policies
		spec.template.spec.tolerations	Scheduling policies
		spec.template.spec.containers.resources	Resource requests and limits
		spec.template.spec.containers.env	Container environment variables	1.18.7-r3 or later

By default, the Istio Operator does not update key running configurations of workloads in the current cluster. Only non-key running configurations can be updated.
If you need to modify key running configurations, you are advised to modify them on the Workloads page of the CCE console. If you have special requirements, submit a service ticket.