istio-system. Since the external IP is associated with the Service and bound to the namespace, it is recommended to: 1. Install the new gateway in a new namespace. 2. Copy any TLS certificate to the new namespace, and configure the domains. 3. Checking the new gateway work - for example by overriding the IP in /etc/hosts 4. Modify the DNS server to add the A record of the new namespace 5. Check traffic 6. Delete the A record corresponding to the gateway in istio-system 7. Upgrade istio-system, disabling...