📋 Recommended Actions
⚠️ Action Required
Immediate upgrade recommended to patch critical security vulnerabilities and ensure robust ambient mesh operation.
📝 Summary
This release, Istio 1.29.7, delivers essential security fixes and significant stability enhancements across the mesh. We’ve tackled multiple vulnerabilities, including an EnvoyFilter regex denial-of-service vector and an SSRF vulnerability in JWKS URI fetching. Critical functional security fixes ensure BackendTLSPolicy now fails closed when CA references are unresolved and close a Gateway API TLS certificateRef existence oracle. For Ambient Mesh users, stability and performance are greatly improved. We’ve resolved issues where ingress gateways bypassed waypoints in multi-cluster setups and prevented hostNetwork pods from erroneous enrollment. Resource management gets a boost with fixes for istio-cni file descriptor leaks and optimized policy scanning. Furthermore, WDS reconnects are now version-aware, significantly reducing traffic during ztunnel reconnections. Core platform reliability also sees important updates, like a fix for istiod leader election goroutine leaks and improved Gateway API port name disambiguation. Upgrade today to fortify your mesh against potential exploits and benefit from a more resilient and efficient Istio experience.
🔒 Critical Security Hardening
This release addresses several critical security vulnerabilities, strengthening Istio’s resilience against various attack vectors and ensuring your mesh components operate with a stronger security posture. These updates range from fixing fail-open scenarios to preventing resource exhaustion attacks, providing a more secure and robust service mesh environment for your applications.
A critical fix patches a fail-open scenario in BackendTLSPolicy where, if a policy’s caCertificateRefs could not be resolved, sidecar proxies would send upstream traffic in plaintext instead of failing closed. This update ensures traffic is properly secured or blocked. Additionally, a vulnerability in the Gateway API allowed an existence oracle for cross-namespace certificateRef or caCertificateRef lookups; this has been closed by ensuring ReferenceGrant authorization is performed before resource resolution, returning RefNotPermitted for any ungranted cross-namespace reference.
Another significant security update caps the proxyVersion match expression length in EnvoyFilters. Previously, an excessively long regex could consume disproportionate memory and CPU during compilation, posing a denial-of-service risk to istiod. This limit now prevents such resource exhaustion. The XDS api generator has also been restricted to verified control-plane identities, preventing unauthorized clients from reading cluster-wide Istio configuration. Lastly, an SSRF vulnerability in jwksUri fetching has been mitigated by blocking connections to link-local and known cloud metadata addresses by default, and by rejecting fetched responses that are not valid JWKS. A vulnerability allowing annotation-based YAML injection into sidecar/gateway templates has also been addressed, with annotations now consistently escaped.
Note for custom MCP consumers: The XDS api generator now requires a verified control-plane identity. Custom consumers connecting from non-system namespaces will be rejected. Set ENABLE_XDS_API_GENERATOR_AUTH=false to restore previous behavior if needed for compatibility.
Source:
pilot/pkg/networking/core/cluster_tls.go(119-122, 1482-1536)releasenotes/notes/backendtlspolicy-sidecar-failclosed.yaml()pilot/pkg/config/kube/gateway/conversion.go(2288-2315, 2328-2384)releasenotes/notes/gateway-tls-ref-grant-order.yaml()pilot/pkg/model/envoyfilter.go(189-192, 212-215)pkg/config/validation/envoyfilter/envoyfilter.go(99-105)releasenotes/notes/envoyfilter-proxyversion-length.yaml()pilot/pkg/features/pilot.go(103-107)pilot/pkg/networking/apigen/apigen.go(40-42, 60-61, 143-169)releasenotes/notes/xds-api-generator-auth.yaml()pilot/pkg/model/jwks_resolver.go(274-279, 601-641)pkg/security/dial.go(1-88)releasenotes/notes/jwks-ssrf-default-block.yaml()manifests/charts/istio-control/istio-discovery/files/gateway-injection-template.yaml(26-27, 39-41, 221-222)manifests/charts/istio-control/istio-discovery/files/grpc-agent.yaml(47-48, 60-62, 256-257)manifests/charts/istio-control/istio-discovery/files/injection-template.yaml(85-86, 130-131, 186-187, 200-202, 480-481)manifests/charts/istio-control/istio-discovery/files/kube-gateway.yaml(86-87)manifests/charts/istio-control/istio-discovery/files/waypoint.yaml(101-102)releasenotes/notes/sidecar-annotation-yaml-injection.yaml()
✨ Ambient Mesh Reliability & Performance
This release significantly boosts the stability and performance of Istio’s ambient mesh, addressing key areas from multi-cluster deployments to core CNI operations and resource efficiency. These improvements lead to a more predictable and scalable mesh, especially in complex, distributed environments.
A crucial fix resolves an issue where ingress gateways would bypass waypoint proxies for multi-cluster services when remote workloads resided on a different network. This meant authorization policies were not being enforced as intended. Now, proper waypoint interception is ensured. The istio-cni node agent has also been hardened against incorrect pod enrollments; hostNetwork pods are no longer considered eligible for ambient enrollment, preventing unintended traffic redirection, and a bug that could pair an ambient pod with a foreign network namespace has been resolved by verifying IP ownership. Further CNI reliability improvements include a fix for file descriptor leaks that occurred when multiple network namespaces were detected for the same pod.
Performance-wise, istiod now handles Workload Discovery Service (WDS) reconnects more efficiently. Instead of triggering a full push on ztunnel reconnections (such as those from keepaliveMaxServerConnectionAge), istiod assigns a content-based version to each WDS resource. This allows reconnecting clients to report versions they already hold, ensuring only changed resources are re-sent, thus reducing traffic and improving scalability. Furthermore, istiod CPU usage has been optimized by indexing on namespaces when scanning AuthorizationPolicy and PeerAuthentication resources, significantly reducing processing overhead. Finally, goroutine and memory leaks in internal KRT collections, which occurred when remote clusters were removed or updated in ambient multi-cluster mode, have been fixed.
Source:
pilot/pkg/serviceregistry/kube/controller/ambient/ambientindex_multicluster_test.go(721-801, 800-990)pilot/pkg/serviceregistry/kube/controller/ambient/multicluster.go(486-501, 287-289)releasenotes/notes/61092.yaml()cni/pkg/nodeagent/informers.go(127, 271, 371)cni/pkg/nodeagent/informers_test.go(355-391, 985-1032)cni/pkg/nodeagent/net_test.go(288-294, 357-363, 385-391, 418-424, 451-457, 483-489)cni/pkg/plugin/plugin.go(423-424)cni/pkg/util/enablement_selector.go(73-83)cni/pkg/util/podutil.go(52, 68)cni/pkg/util/podutil_test.go(172-263)releasenotes/notes/61168.yaml()cni/pkg/nodeagent/podcgroupns_linux.go(103-104, 183-207, 417-458)cni/pkg/nodeagent/podcgroupns_linux_test.go(69-122, 122-167, 259-270, 26-68)releasenotes/notes/validate-netns-ownership.yaml()cni/pkg/nodeagent/fakes_test.go(104-106, 137-141)cni/pkg/nodeagent/podcgroupns.go(38-40)releasenotes/notes/close-scan-netns-fd-leak.yaml()pilot/pkg/model/service.go(1052-1060)pilot/pkg/serviceregistry/kube/controller/ambient/services.go(739-756)pilot/pkg/serviceregistry/kube/controller/ambient/services_test.go(694-733)pilot/pkg/serviceregistry/kube/controller/ambient/workloads.go(1662-1670, 65, 82, 97, 147, 175, 204, 230, 414, 466, 514, 663, 743, 787, 896, 1001, 1093, 1156, 1363)pilot/pkg/xds/delta.go(297-302, 388)pilot/pkg/xds/workload.go(66-67, 98-100, 105-106, 163-164)pilot/pkg/xds/workload_test.go(171-331)pkg/xds/server.go(36-42)releasenotes/notes/wds-reconnect-version-skip.yaml()pilot/pkg/serviceregistry/kube/controller/ambient/ambientindex.go(328, 433-435, 964-972)releasenotes/notes/61254.yaml()releasenotes/notes/peerauth-by-ns.yaml()pkg/kube/krt/collection.go(591, 639, 797, 807-822)pkg/kube/krt/fetch.go(55-61)pkg/kube/krt/mergejoin.go(377-384)pkg/kube/krt/nestedjoinmerge.go(142-173)pkg/kube/krt/testing.go(19-20)pkg/kube/krt/collection_leak_test.go(1-271)releasenotes/notes/krt-collection-teardown-leaks.yaml()pilot/pkg/config/kube/gateway/conversion.go(569-605)pilot/pkg/config/kube/gateway/testdata/foreign-waypoint.status.yaml.golden(0-21)pilot/pkg/config/kube/gateway/testdata/foreign-waypoint.yaml(0-79)pilot/pkg/config/kube/gateway/testdata/foreign-waypoint.yaml.golden(0-0)
⚙️ Gateway API Stability Improvements
This release includes several fixes that enhance the reliability and robustness of Istio’s Gateway API implementation, crucial for users managing ingress and mesh traffic. These improvements ensure more consistent and error-free operation of your Gateway resources, leading to a smoother traffic management experience.
A significant issue addressed concerns generated Gateway Services being rejected due to colliding service port names. This could happen when two listener names, after sanitization (e.g., periods converting to dashes, or names only differing past the 63-character limit for Service port names), resulted in the same name. This prevented all unpublished ports on the Gateway from functioning. The controller now intelligently disambiguates colliding port names using the listener’s port number, ensuring uniqueness and proper Service creation.
Furthermore, a race condition has been fixed during istiod startup where the readiness probe could report ready before the dedicated webhook server (for injection and validation) was fully accepting connections. This led to intermittent failed calling webhook timeouts when creating resources immediately after istiod became ready. Webhooks are now marked ready only once their respective servers are actively serving requests. Gateway deployments have also been made more robust by ensuring PushContext is initialized before the deployment controller starts processing Gateway resources, preventing failures during istiod startup.
Source:
pilot/pkg/config/kube/gateway/deploymentcontroller.go(1035-1056, 1058-1077, 427-428, 494-497)pilot/pkg/config/kube/gateway/deploymentcontroller_test.go(1423-1463, 1400-1421)releasenotes/notes/service-port-name-collision.yaml()pilot/pkg/bootstrap/server.go(357-362, 505-509)pilot/pkg/bootstrap/server_test.go(683-722)pilot/pkg/bootstrap/validation.go(39-42)releasenotes/notes/61049.yaml()pilot/pkg/model/context.go(179-183)releasenotes/notes/61095.yaml()
🚀 Core Platform Enhancements
This release brings several foundational improvements to Istio’s core platform, enhancing stability, resource management, and overall operational efficiency. These updates ensure that Istio runs more smoothly and reliably, especially under demanding conditions.
A significant goroutine leak in istiod’s leader election mechanism has been resolved. Previously, every election cycle (when leadership was lost and re-acquired) would leak a goroutine until the process exited, potentially leading to increased resource consumption over time. This fix ensures that only the current cycle’s watcher goroutine remains active, promoting long-term stability.
Additionally, the nftables version pinning in Istio’s distroless images has been removed. This pinning was a workaround for a bug in older nftables versions on Kubernetes nodes. With major Linux distributions having released fixes, Istio is now unpinning the version, allowing users to benefit from newer nftables releases. Users are advised to update their node’s nftables package to the latest version. Another resource management fix addresses an issue where istiod permanently retained a copy of every workload resource name for each Envoy MDS (WDS) connection that sent initial_resource_versions, preventing unnecessary memory growth.
Source:
pilot/pkg/leaderelection/leaderelection.go(121-127)pilot/pkg/leaderelection/leaderelection_test.go(165-170, 170-205)releasenotes/notes/leaderelection-cycle-goroutine-leak.yaml()docker/iptables.yaml(12-13)tools/build-base-images.sh(77-85)releasenotes/notes/58492.yaml()pilot/pkg/xds/delta.go(302)releasenotes/notes/delta-wds-watchset-retention.yaml()
Minor Updates & Housekeeping
This release includes several dependency updates, bumping automemlimit to v1.0.0, pb/v3 to v3.2.1, docker/cli to v29.7.2, cel-go to v0.31.0, go-containerregistry to v0.21.9, prometheus clients and common to their latest versions, quic-go to v0.61.0, testify to v1.12.1, otel components to v1.45.0, golang.org/x/net to v0.58.0, grpc to v1.83.0, and protobuf to v1.36.12. Several new licenses have been added for these updated dependencies.