if revision := in.Annotations[appsv1.DeprecatedRollbackTo]; revision != "" {
		if revision64, err := strconv.ParseInt(revision, 10, 64); err != nil {
			return fmt.Errorf("failed to parse annotation[%s]=%s as int64: %v", appsv1.DeprecatedRollbackTo, revision, err)
		} else {
			out.Spec.RollbackTo = new(apps.RollbackConfig)
			out.Spec.RollbackTo.Revision = revision64
		}

apiVersion: release-notes/v2
kind: bug-fix
area: installation

releaseNotes:
  - |
    **Fixed** VMs are able to use a revisioned control plane specified by `--revision` on the `istioctl x workload entry`

apiVersion: release-notes/v2
kind: feature
area: installation
releaseNotes:
  - |
    **Removed** the `istioctl experimental revision` command. Revisions can be inspected by the stable `istioctl tag list` command.
  - |
    **Removed** the `installed-state` `IstioOperator` that was created when running `istioctl install`. This previously provided only a snapshot
    of what was installed.

		Label(label.CustomSetup).
		Setup(istio.Setup(nil, func(_ resource.Context, cfg *istio.Config) {
			cfg.ControlPlaneValues = `
revision: stable
`
		})).
		Setup(istio.Setup(nil, func(_ resource.Context, cfg *istio.Config) {
			cfg.ControlPlaneValues = `
profile: empty
revision: canary
components:
  pilot:
    enabled: true
`
		})).
		Run()
}

ing/src/k8s.io/client-go/tools/leaderelection) that includes [prioritized leader election](https://github.com/kubernetes/kubernetes/pull/103442). These changes are required in order to make it so that the default revision wins leader elections and steals locks from non-default revisions. The changes were not upstreamed to k8s in time for the Istio 1.12 release.

Ideally, prioritized leader election gets upstreamed in the near future ([KEP](https://github.com/kubernetes/enhancements/pull/2836)),...

	if revision := in.Annotations[appsv1beta2.DeprecatedRollbackTo]; revision != "" {
		if revision64, err := strconv.ParseInt(revision, 10, 64); err != nil {
			return fmt.Errorf("failed to parse annotation[%s]=%s as int64: %v", appsv1beta2.DeprecatedRollbackTo, revision, err)
		} else {
			out.Spec.RollbackTo = new(apps.RollbackConfig)
			out.Spec.RollbackTo.Revision = revision64
		}

// old version and then later decides to switch back to the old revision again.
func DeactivateIstioInjectionWebhook(ctx context.Context, client kubernetes.Interface) error {
	whs, err := GetWebhooksWithRevision(ctx, client, DefaultRevisionName)
	if err != nil {
		return err
	}
	if len(whs) == 0 {
		// no revision with default, no action required.
		return nil
	}

They are `tar`ed to avoid developer confusion and accidental edits.

## Adding a new version

1. Generate a revisioned IstioOperator for the version with equivalent settings:

```yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  hub: gcr.io/istio-release
  revision: 1-x-y
  components:
    base:
      enabled: false
    pilot:
      enabled: true
    ingressGateways:

{{- $revVerMap := .Revisions }}
{{- $subsets := .Subsets }}
{{- $cluster := .Cluster }}
{{- range $i, $subset := $subsets }}
{{- range $revision, $version := $revVerMap }}
apiVersion: apps/v1
{{- if $.StatefulSet }}
kind: StatefulSet
{{- else }}
kind: Deployment
{{- end }}
metadata:
{{- if $.Compatibility }}
  name: {{ $.Service }}-{{ $subset.Version }}-{{ $revision }}
{{- else }}
  name: {{ $.Service }}-{{ $subset.Version }}
{{- end }}

}

func allowExternalService(t framework.TestContext, ns string, externalNs string, revision string) {
	t.ConfigIstio().Eval(ns, map[string]any{
		"Namespace": externalNs,
		"Revision":  revision,
	}, `apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: external-service
  labels:
    istio.io/rev: {{.Revision}}
spec:
  hosts:
  - "fake.external.com"
  location: MESH_EXTERNAL