Which namespace label tells Istio to inject sidecars from a specific control plane revision during a canary upgrade?

Answer: istio.io/rev=<revision>

Explanation

The istio.io/rev label selects the revision (or revision tag) whose injector handles pods in the namespace. The istio-injection label only takes enabled or disabled, and it takes precedence over istio.io/rev, so remove it when you switch a namespace to a revision.