📋 Recommended Actions ⚠️ Action Required Immediate action is required for existing auto-registered WorkloadEntries if HBONE functionality is desired. These require re-registration or manual labeling. Review all updates for ambient mesh deployments to ensure proper traffic flow and resource management. 📝 Summary Istio 1.29.6 delivers critical stability and reliability enhancements, particularly for ambient mesh users. This release addresses a vital issue where cross-network ambient traffic through east-west gateways could be spuriously blocked by L7 AuthorizationPolicies. A deadlock in the ambient CNI node agent, which could occur during concurrent pod deletion and ztunnel reconnections, has also been resolved, improving robustness. Importantly, HBONE compatibility for non-Kubernetes auto-registered WorkloadEntries is now correctly propagated, though existing entries may need manual updates. Furthermore, a significant memory leak in Istiod related to needResync entries for failed pods has been fixed, enhancing controller stability and reducing resource consumption. These updates collectively bolster Istio’s ambient capabilities and overall operational efficiency. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is required to address critical security vulnerabilities. Operations engineers should review the RBAC changes, especially if directly manipulating ACME Challenge or Order resources, as this is a breaking change. 📝 Summary Cert-manager v1.19.6 lands with crucial security updates and hardened RBAC policies, fortifying your certificate management infrastructure. This release addresses three notable Go module vulnerabilities, including CVE-2023-3978 in golang.org/x/crypto and CVE-2023-39325 in github.com/moby/spdystream. These fixes bolster protection against denial-of-service attacks and improve overall system resilience. Additionally, a significant change restricts direct user interaction with ACME Challenge and Order resources. These Kubernetes objects, never intended for manual management, now have tighter controls on creation and modification verbs within the aggregate edit ClusterRole. This helps prevent misconfigurations and reinforces the intended operational model. Upgrading also bumps the Go runtime to v1.25.11 and updates base images, ensuring a more stable and secure environment. Review the RBAC changes to ensure no disruption if your workflows involve direct manipulation of ACME challenge/order resources, otherwise, upgrade promptly for a safer cert-manager deployment. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address multiple security vulnerabilities. Review RBAC changes for ACME Challenge and Order resources, especially if you have custom automation that directly manipulates these internal objects. 📝 Summary Cert-manager v1.20.3 delivers essential security updates and crucial internal refinements. This patch release addresses three vulnerabilities across core Go dependencies, including a high-severity HTTP/2 rapid reset variant in golang.org/x/net (CVE-2024-24783), and medium-severity fixes for golang.org/x/crypto (CVE-2024-24784) and github.com/moby/spdystream (CVE-2024-24785). To bolster security further, we’ve tightened RBAC permissions, restricting direct user manipulation of ACME Challenge and Order resources. Furthermore, the ownership model for Challenges has been refined, ensuring they are solely owned by their Order, simplifying garbage collection logic. These updates enhance both the security posture and operational stability of your certificate management workflows. Upgrade now to secure your clusters and leverage these improvements. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching required to address critical stability issues in Ambient Mode, Kubernetes Gateway API, and Multicluster deployments. 📝 Summary Istio 1.29.5 lands with crucial bug fixes that significantly bolster the stability of your mesh. This release tackles a critical issue in Ambient Mode where enrolled pods could drop from the host health-probe ipset, leading to broken health checks after node restarts. We’ve also resolved a major traffic outage scenario during Kubernetes Gateway API canary upgrades, ensuring smoother transitions when changing istio.io/rev labels. For multicluster users, a panic (close of closed channel) from rapid kubeconfig secret updates is now fixed, enhancing resilience. Additionally, a memory leak within the KRT controller framework has been patched, preventing gradual memory growth. These targeted fixes are essential for maintaining robust and predictable service mesh operations. Upgrade now to secure these vital stability improvements. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade is recommended. Critical bugs affecting Ambient mesh traffic distribution and CNI stability have been fixed. Review Gateway API header validation changes and unmanaged Gateway SA behavior. 📝 Summary Istio 1.29.4 delivers crucial stability and correctness enhancements, particularly for Ambient mesh deployments and Gateway API users. This patch release resolves a critical bug where PreferSameZone or PreferSameNode traffic distribution, combined with publishNotReadyAddresses: true, could lead to traffic being routed to unready endpoints cluster-wide. Another significant fix addresses a concurrent map writes panic in the CNI agent, improving Ambient mesh robustness. Gateway API users benefit from new header validation logic, preventing silently dropped configurations and providing clearer feedback for invalid HTTPRoute and GRPCRoute header values. Multi-network Ambient ingress routing also sees improvements, ensuring correct waypoint traversal based on configuration. This release also streamlines HTTP/2 handling and includes numerous dependency updates, reinforcing overall platform reliability. Upgrade now to secure these vital fixes and bolster your Istio environment. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address critical security vulnerabilities related to authorization bypasses. Operations engineers should review the updated Ambient Mesh configurations for AWS deployments and consider tuning HBONE window sizes for performance. Review istioctl analyze output for new JWKS URI security warnings. 📝 Summary Istio 1.29.3 lands with crucial security fixes, fortifying your mesh against potential bypasses. This release tackles an authorization policy regex vulnerability, ensuring principal and namespace matching behaves as intended. It also tightens XDS debug endpoint access, preventing cross-namespace information exposure for non-system callers. Plus, leaf certificates now respect CA validity, preventing expired cert usage. AWS EKS users with Security Groups for Pods get a critical fix for kubelet health probe failures in Ambient Mesh, ensuring smoother operations. We’ve also added configurable HTTP/2 window sizes for HBONE, offering fine-tuned performance. Tooling improves with a new istioctl analyze warning for JWKS URI security, better handling of Helm webhook failurePolicy during upgrades, and enhanced proxy resource injection for null values. Several core bug fixes, including a multicluster secret controller deadlock and robust Kubernetes secret rotation, contribute to overall stability. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address CVE-2024-29018, a high-severity vulnerability in the gRPC dependency. Review updated E2E testing procedures if you maintain custom CI workflows. 📝 Summary cert-manager v1.19.5 delivers essential security and maintenance updates, crucial for maintaining a robust certificate management infrastructure. This release directly addresses CVE-2024-29018, a high-severity vulnerability in the gRPC dependency that could lead to CPU exhaustion. Upgrading promptly is vital to protect your systems. Beyond security, we’ve bumped the core Go runtime to version 1.25.9 and updated numerous transitive dependencies like golang.org/x/crypto and cel.dev/expr to ensure improved stability and performance. Internal CI/CD workflows also see significant enhancements, including support for Kubernetes 1.35 and a migration of upgrade E2E tests to leverage Helm OCI registries. Minor textual cleanups in CRD descriptions also enhance clarity. These updates balance critical security fixes with ongoing platform compatibility and foundational improvements. Upgrade to secure your deployments and benefit from these stability enhancements. ...

📋 Recommended Actions ⚠️ Action Required Immediate action is required for users deploying Istio with Helm v4 (server-side apply) or those with newer Gateway API CRDs. Review the section on Helm failurePolicy to configure base.validationFailurePolicy: Fail as needed. Also, be aware of the new Gateway API CRD maximum version filter, which may ignore newer TLSRoute versions (v1.5.0+). All users should upgrade to benefit from critical security hardening and stability fixes. ...

📋 Recommended Actions ⚠️ Action Required Immediate review and upgrade are recommended to benefit from critical security hardening, traffic management improvements, and enhanced multi-cluster reliability. If using Helm with server-side apply, explicitly configure ‘base.validationFailurePolicy: Fail’ during initial installations or when templating for SSA to avoid potential webhook conflicts. During upgrades, the webhook’s ‘failurePolicy’ will be omitted from the template, preserving the runtime value. 📝 Summary Istio 1.29.2 fortifies your service mesh with significant stability, security, and multi-cluster resilience enhancements. This patch release addresses several critical bugs, including a fix for AuthorizationPolicy regex metacharacter handling and a robust improvement to JWKS URI CIDR blocking, preventing potential bypasses. Operations engineers will appreciate the improved Helm upgrade experience with server-side apply, which resolves a webhook ‘failurePolicy’ conflict and ensures smoother installations. A new CRD filter safeguards against issues with unsupported Gateway API versions, enhancing upgrade predictability. Traffic management sees key improvements: waypoints now support multiple VirtualServices for a single host, and DestinationRule ‘retryBudget’ configurations are more consistently applied. Multi-cluster deployments gain a crucial fallback mechanism for mesh configuration, ensuring continued operation even if remote mesh config is temporarily unreadable. Upgrade promptly to secure your mesh and leverage these vital operational improvements. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is required. This release addresses critical security vulnerabilities in core dependencies like go-jose and the Go runtime. Upgrade promptly to protect your cert-manager deployments. 📝 Summary cert-manager v1.20.2 lands with crucial security fixes and essential dependency updates. This patch release tackles CVE-2024-28180, a critical authentication bypass in the underlying go-jose library. Furthermore, it incorporates Go runtime v1.26.2, which includes fixes for high-severity issues like CVE-2024-24791 (TLS DoS) and CVE-2024-24792 (HTTP/2 memory exhaustion). These updates are vital for maintaining the integrity and availability of your certificate management infrastructure. You’ll also find updated OpenTelemetry libraries, improving observability foundations, and a minor Helm chart indentation fix. Upgrade quickly to secure your clusters. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching required. Upgrade cert-manager to v1.20.1 to secure your deployments against a high-severity gRPC vulnerability and resolve critical RBAC issues. 📝 Summary Cert-manager v1.20.1 delivers vital updates, addressing a high-severity security vulnerability and crucial operational stability fixes. You’ll want to upgrade promptly to protect your clusters from CVE-2023-44487, an HTTP/2 Rapid Reset attack vulnerability in google.golang.org/grpc. This patch hardens cert-manager’s foundational security. Operations teams will also appreciate a critical RBAC fix, resolving an issue where cert-manager couldn’t properly update finalizers on Issuers and ClusterIssuers in Kubernetes environments with OwnerReferencesPermissionEnforcement enabled. This directly impacts certificate lifecycle management. Additionally, we’ve refined the Gateway API integration for ACME HTTP01 challenges, preventing duplicate ParentRefs from being added to HTTPRoutes, ensuring cleaner, more reliable configurations. Along with these significant improvements, v1.20.1 includes various other dependency updates, enhancing overall stability and performance. Don’t delay—secure your certificate management with this essential upgrade. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade to Istio 1.28.5 is strongly recommended for all users due to critical security patches addressing JWT forgery, XDS debug endpoint authentication bypasses, and WasmPlugin SSRF vulnerabilities. Review changes to XDS debug endpoints if you rely on unauthenticated plaintext access, as this behavior now requires explicit configuration or authentication. 📝 Summary Istio 1.28.5 lands with crucial security updates and significant enhancements across the mesh. This release patches a critical vulnerability where Istio’s JWT authentication fallback mechanism could leak a private key, enabling attackers to forge tokens. A high-severity fix now secures XDS debug endpoints (like syncz and config_dump), preventing unauthenticated access on plaintext ports. Additionally, WasmPlugin image fetching is fortified with SSRF protection, closing another potential attack vector. Beyond security, the Gateway API sees improvements, specifically addressing issues where InferencePool configurations were lost during VirtualService merges. Ambient Mesh deployments get smarter port discovery for native sidecars, ensuring correct inbound listener configuration, and gain new flexibility with a ZtunnelNamespace flag. These updates combine critical fixes with valuable operational improvements, making 1.28.5 a vital upgrade for a more secure and robust service mesh. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is strongly recommended to address critical security vulnerabilities, especially the JWKS private key leak and XDS debug endpoint authentication bypass. Review all updates to ensure smooth operation and leverage new features. 📝 Summary Istio 1.29.1 delivers crucial security fixes, fortifying your mesh against potential exploits. This release patches a critical JWKS private key leak, preventing attackers from forging JWT tokens, and tightens authentication on XDS debug endpoints. Gateway API users will appreciate enhanced CORS wildcard handling and robust backend policy dependency tracking. For ambient mode, a panic with cross-network WorkloadEntries has been resolved, along with a fix for TLS inspection on exclusively TLS ports, improving routing reliability. Deployments now correctly handle null or zero resource limits, eliminating validation errors. Additional improvements include IP allocator stability, SSRF protection in WasmPlugin image fetching, and various nil-pointer dereference fixes, ensuring a more resilient and secure Istio experience. Upgrade promptly to secure your environment. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade is highly recommended to address CVE-2024-24791 and benefit from the latest security patches in underlying dependencies. 📝 Summary cert-manager v1.18.6 delivers critical security enhancements, primarily addressing the CVE-2024-24791 vulnerability found in the Go standard library’s HTTP/2 implementation. This high-severity fix mitigates a potential denial-of-service risk, making an immediate upgrade essential for operational security. Beyond the Go toolchain bump to 1.24.13, this release also incorporates refreshed distroless base images (Debian 12). These updates bring the latest security patches from the Debian ecosystem, ensuring a more robust and secure runtime environment for your cert-manager deployments. No new features or breaking changes are introduced; this is a focused stability and security release. Operations engineers should prioritize this update to safeguard their Kubernetes clusters and maintain certificate issuance integrity. Review the release notes for full details. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address the OpenTelemetry security vulnerability (GO-2026-4394) and to benefit from the latest Go runtime and base image security updates. 📝 Summary Cert-manager v1.19.4 brings crucial security and maintenance updates, bolstering the reliability of your certificate management. This release addresses a medium-severity OpenTelemetry vulnerability (GO-2026-4394) related to sensitive data exposure in HTTP headers, making an upgrade vital for enhanced security posture. We’ve also updated the Go runtime to version 1.25.7, incorporating the latest performance improvements and bug fixes. Furthermore, all base images have been refreshed to Debian 12, ensuring cert-manager components run on the most current and secure foundations. These updates are essential for maintaining a stable and secure Kubernetes environment. Upgrade soon to protect your clusters and leverage these core improvements. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade to Istio 1.28.4 is strongly recommended to address critical security vulnerabilities and enhance mesh stability. Operations engineers should review the new debug endpoint authorization policy (enabled by default) and consider its impact on existing monitoring or tooling that accesses Istiod debug endpoints from non-system namespaces. Enabling ambient.enableAmbientDetectionRetry in the CNI chart is also recommended for increased ambient mesh robustness against transient failures. ...

📋 Recommended Actions ⚠️ Action Required Immediate action required for environments utilizing debug endpoints from non-system namespaces, or if you’re using sidecar.istio.io/proxy* annotations. Review upgrade notes carefully for the debug endpoint authorization feature. For all users, upgrading is strongly recommended to apply critical security fixes and enhancements. 📝 Summary Istio 1.27.6 rolls out critical security enhancements, significantly bolstering the control plane’s resilience against potential vulnerabilities. This patch release introduces robust safeguards to the gateway deployment controller, preventing unauthorized resource creation via template injection. Furthermore, a critical fix addresses a template injection vector in sidecar.istio.io/proxy* annotations, rejecting malicious control characters. Security around debug endpoints is tightened, with namespace-based authorization now enabled by default, restricting access from non-system namespaces. This change requires review if your tooling interacts with these endpoints. Lastly, a bug fix ensures correct application of minimum TLS protocol versions. These updates collectively enhance Istio’s security posture and gateway management, making this a vital upgrade for all deployments. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade is recommended to address a high-severity DNS-01 solver stability issue (GHSA-gx3x-vq4p-mhhv) and ensure robust certificate issuance validation. 📝 Summary Cert-manager v1.18.5 delivers critical updates. It fixes a high-severity DNS-01 solver panic (GHSA-gx3x-vq4p-mhhv), preventing service disruptions. It also adds robust validation for issued certificates, ensuring public keys match CSRs, and improves HTTP-01 IPv6 handling. Upgrade now for enhanced stability and security! 🔒 High-Severity Fix: ACME DNS-01 Solver Panic (GHSA-gx3x-vq4p-mhhv) A critical vulnerability identified as GHSA-gx3x-vq4p-mhhv has been addressed in this release, preventing potential denial-of-service scenarios for the ACME DNS-01 solver. Previously, the solver would incorrectly assume that DNS SOA records would always be the first entry in a DNS query response. If a DNS provider returned the SOA record at a different position, cert-manager’s DNS-01 solver could panic and crash, making it unable to process new challenges and disrupting certificate issuance. ...

📋 Recommended Actions ⚠️ Action Required Immediate review recommended for all users. Upgrade promptly to benefit from critical security hardening, fix potential denial-of-service vectors, and enhance certificate issuance reliability. 📝 Summary cert-manager v1.19.3 delivers crucial security enhancements and improved issuance robustness. This release directly addresses GHSA-gx3x-vq4p-mhhv, preventing a potential panic in the ACME DNS solver that could lead to denial-of-service. This high-severity fix solidifies the reliability of your ACME challenges. We’ve also introduced a vital new check: certificate issuance will now fail if the public key in the signed certificate doesn’t match the original Certificate Signing Request (CSR). This prevents infinite re-issuance loops with misconfigured external issuers, ensuring cryptographic integrity. Furthermore, the HTTP-01 solver gained more robust handling of IPv6 address literals, improving compliance and reliability for diverse network configurations. Essential tooling updates, including Go 1.25.6 and Kind 0.31.0, round out this focused release. Upgrade to boost the security and stability of your certificate management. ...

📋 Recommended Actions ⚠️ Action Required For users leveraging Istio’s ambient multicluster, an immediate upgrade is highly recommended to address persistent informer errors and improve stability. All users should review the new gateway Helm chart feature for enhanced deployment flexibility. 📝 Summary Istio 1.28.3 significantly bolsters ambient multicluster reliability, rectifying a critical issue where remote cluster informer errors previously necessitated an Istiod restart. This update means your multicluster deployments will operate with much greater resilience, ensuring smoother operations and reduced downtime. Additionally, the Istio Gateway Helm chart introduces new service.selectorLabels functionality. This empowers operators with granular control, simplifying complex deployment patterns like revision-based migrations by allowing custom labels on gateway service selectors. Core component updates for proxy and ztunnel alongside nftables ensure overall stability and security. This release focuses on crucial bug fixes for multicluster environments and key enhancements for gateway management, making it a valuable upgrade for improved operational robustness and deployment agility. Review the details to leverage these improvements. ...