Istio add-on for AKS now allows upgrading the minor version of Istio using canary upgrade process.
When an Istio upgrade is initiated, the control plane of the new (canary) revision is deployed alongside the old (stable) revision's control plane. Workload pods can then be restarted while using monitoring tools to track the health of workloads during this process.
If no issues are observed with the health of workloads, upgrade can be completed so that only the new Istio revision remains on the cluster. Otherwise, you can roll back to the previous revision of Istio.
This feature is currently in public preview.
https://aka.ms/asm-aks-upgrade-docs