Before you start the upgrade, make sure to upgrade to the latest available 3.5.x version. This will make sure that you are building against the most recent dependencies of that line. Please take time ...
Not all traffic in your pods should go through the Istio sidecar. Some protocols don't work well with Envoy's Layer 7 processing, some services handle their own TLS, and some legacy systems just break ...