IstioOperator migration story (with "canary")

1

Salve!

Could someone please confirm for us, if we misunderstood how the upgrade procedure works?

  1. We have Istio 1.5 deployed with helm
  2. We want to upgrade to Istio 1.7 deployed with Istio Operator (via terraform, and hence no istioctl)
  3. We have the existing old Istio Pods without istiod
  4. We want to deploy a new Istio in parallel, so we need a revision to add the suffix to all resources

So, so achieve this we:

  1. Deploy istio-operator using helm
  2. Create IstioOperator CR which contains .spec.revision: plswork
  3. The operator will pick up the new CR, see the revision, and hence add various resources named like this: istiod-plswork-...

But this is not what is happening: the revision does not show up, and the resources of the existing old Istio are overwritten or clobbered, and the label istio.io/rev : default can be seen on the resources.Is that a bug, or did we misunderstand how this is supposed to work?

Now one problem could be that we want to use only one Istio operator to handle all Istios, and we are not giving a revision to the operator itself. Is that necessary? We tried to install multiple operator via helm and that only lead to collisions because they tried to install the same cluster-wide resources.