Service Mesh (ASM) automatically applies security patches, bug fixes, and credential rotations to the managed control plane of each ASM instance as needed. By default, these maintenance tasks can run at any time. A maintenance window restricts them to a recurring time range you define, so they don't overlap with peak traffic or active deployments.
How it works
ASM performs two types of automatic maintenance on the managed control plane:
| Maintenance type | What happens | Why |
|---|---|---|
| Patch version hot updates | ASM applies security patches and bug fixes by performing hot updates of patch versions. For details about supported versions, see Support for Istio versions. | Keeps the control plane secure and stable |
| Credential rotation | ASM rotates the access credentials that the managed control plane uses to communicate with data plane clusters. | Maintains secure connectivity between the control plane and data plane |
During automatic maintenance, starting a new sidecar proxy in a data plane cluster or updating the ASM configuration may cause latencies in seconds. Schedule maintenance during off-peak hours when traffic is low or no release tasks are performed to minimize impact. If maintenance must run during business hours, assign a dedicated person to monitor the ASM instance so that exceptions can be handled in time.
Configure a maintenance window
Set the maintenance schedule
-
Log on to the ASM console. In the left-side navigation pane, choose .
-
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose .
In the Config Info section on the Base Information page, find Maintenance Window and click Edit.
In the Maintenance Window dialog box, configure the following parameters and click OK. The ASM instance status changes to updating. When the status returns to Running, the maintenance window is active. In the following example, automatic maintenance runs from 00:00:00 to 04:00:00, Monday through Friday.
Parameter Description Maintenance Cycle The days of the week when maintenance is allowed. For example, Monday through Friday. Maintenance Start Time The start time for the maintenance window. For example, 00:00:00. Maintenance End Time The end time for the maintenance window. For example, 04:00:00. 
Limits
Each ASM instance supports only one maintenance window. Configuring a new window overwrites the previous one.
Times in the maintenance window are displayed in the UTC+8 time zone.
FAQ
What is the default behavior without a maintenance window?
Without a maintenance window configured, ASM may perform automatic maintenance at any time.
Can I configure different windows for patch updates and credential rotation?
No. A single maintenance window applies to all automatic maintenance tasks for the ASM instance.
See also
Support for Istio versions: Learn which Istio versions ASM supports and how patch updates work.