📋 Recommended Actions

✅ No Immediate Action Required
No immediate action required. Review updates, especially for Ambient Mesh and Gateway API users, to better support your users and leverage new security features.

📝 Summary

Istio 1.30.2 arrives with a bundle of important bug fixes and a powerful new security feature, significantly enhancing the mesh’s robustness and operational control. This release introduces AuthorizationPolicy trust domains, allowing granular security policies based on the peer certificate’s trust domain. This is a crucial addition for fine-grained access control, enabling users to match or exclude requests from specific trust boundaries.A significant stability improvement comes for Ambient Mesh users with a fix addressing pods that could lose host health-probe IPSet entries after node or kubelet restarts. This change prevents broken probes and ensures more reliable health checks. Gateway API users will benefit from a fix resolving brief traffic outages experienced during canary upgrades when changing istio.io/rev labels on Gateways, ensuring smoother, disruption-free transitions.For better resource management, a memory leak in the KRT controller framework has been patched, leading to more stable memory usage and preventing unnecessary recomputations. Telemetry also sees an update: pilot-agent now correctly handles Prometheus content types by excluding protobuf and offers a new environment variable to disable merging Envoy stats if desired. Improved warning messages for outdated Gateway API CRDs provide clearer guidance. These updates collectively strengthen Istio’s security, stability, and overall operational experience.

✨ Enhanced Security: AuthorizationPolicy trustDomains

Operators can now define granular access control policies based on the trust domain embedded in a client’s SPIFFE identity. This is vital for multi-cluster or multi-tenant environments where you need to restrict communication to identities from specific trust boundaries, enhancing zero-trust security.

The new trustDomains and notTrustDomains fields are available in the Source section of an AuthorizationPolicy rule. You can use them as follows:

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: my-policy
  namespace: default
spec:
  selector:
    matchLabels:
      app: my-service
  rules:
  - from:
    - source:
        trustDomains: ["cluster.local", "external.domain"]
        notTrustDomains: ["bad.actors"]
    to:
    - operation:
        methods: ["GET"]

Istio’s policy engine converts these into Envoy RBAC rules using principalName matchers (e.g., prefix: spiffe://<trust-domain>/). Wildcards (*, foo*, *bar) are also supported for flexible matching. Validation ensures correct usage, disallowing slashes within trust domain values.

Source:

  • releasenotes/notes/add-trust-domains-to-authz-policy.yaml (1-8)
  • pilot/pkg/security/authz/model/model.go (38, 99, 124, 162)
  • pilot/pkg/security/authz/model/generator.go (217-235)
  • pkg/config/validation/validation.go (1440, 1453, 1495)
  • pkg/config/security/security.go (112-132, 213)
  • tests/integration/security/testdata/authz/allow-trust-domain.yaml.tmpl (1-56)

🩹 Ambient Mesh: Resilient Host Probe IPSet Reconciliation

In Ambient Mesh deployments, pods rely on accurate host health probes. Previously, a node or kubelet restart could cause ambient-enrolled pods to be temporarily dropped from the host’s health-probe IPSet. This fix ensures that the istio-cni node agent correctly re-asserts IPSet membership, preventing kubelet probes from being misdirected and maintaining application health checks even after disruptive events.

The MeshDataplane interface now includes a SyncHostProbeIPSet method. The informer handlers (cni/pkg/nodeagent/informers.go) have been updated to call this method when an enrolled pod’s IP reappears (e.g., after a cold cache or restart), but only if the IP actually changes to avoid redundant syscalls. This self-healing mechanism makes Ambient Mesh more resilient to transient networking issues post-restart. The syncHostAddrSets function also now skips destructive pruning if the startup snapshot is incomplete, preventing the eviction of live, enrolled pods.

Source:

  • releasenotes/notes/ambient-probe-ipset-reconcile.yaml (1-10)
  • cni/pkg/nodeagent/informers.go (329-340)
  • cni/pkg/nodeagent/server.go (47-53)
  • cni/pkg/nodeagent/meshdataplane_linux.go (237-240, 252-263)
  • cni/pkg/nodeagent/informers_test.go (1240-1360)

🚀 Smoother Gateway API Upgrades: Preserving Config Across Revisions

Performing canary upgrades for Kubernetes Gateways previously risked brief traffic outages when a Gateway’s istio.io/rev label was changed. The old control plane would incorrectly cease emitting configuration, leading to empty xDS pushes. This fix ensures that the prior owning control plane continues to emit configuration, preventing traffic disruption and enabling seamless transitions during rolling upgrades between different Istio revisions.

The tagWatcher.IsMine() filter has been intentionally removed from the config-emission layer in ListenerSetCollection and GatewayCollection. This allows a control plane to continue processing Gateway API resources, even if their istio.io/rev label points to a different revision. Status writes and Deployment management remain filtered to the owning revision, preventing conflicts while maintaining config stability. A new test case TestListGatewayResourceAcrossRevisions confirms this behavior, showing that a Gateway labeled for a different revision is still emitted as configuration.

Source:

  • releasenotes/notes/59959.yaml (1-14)
  • pilot/pkg/config/kube/agentgateway/gateway_collection.go (143-149)
  • pilot/pkg/config/kube/gateway/gateway_collection.go (87-93)
  • pilot/pkg/config/kube/gateway/controller_test.go (139-172)

📉 KRT Memory Leak and Resource Management Fix

The Kubernetes Resource Tracking (KRT) framework, a core component for Istio’s configuration processing, previously suffered from a memory leak. Changing a Fetch filter key, such as relabeling a pod’s waypoint, would leave stale reverse-index entries, increasing memory usage and triggering unnecessary recomputations. This fix ensures that dependencies are properly cleaned up, leading to a more efficient and stable control plane with reduced memory footprint and improved performance.

The dependencyState.update method in pkg/kube/krt/collection.go was modified to explicitly delete existing dependencies from the reverse index (indexedDependencies) before adding new ones. This ensures that when an object’s dependencies change (e.g., a pod’s waypoint label changes), the old entries are correctly removed, preventing memory accumulation. A new test TestCollectionChangingFilterKeyDependency was added to validate this behavior, confirming that stale entries are removed and new ones are correctly tracked after a filter key change or resource deletion.

Source:

  • releasenotes/notes/krt-dependency-reverse-index-leak.yaml (1-8)
  • pkg/kube/krt/collection.go (57-69)
  • pkg/kube/krt/dependency_state_test.go (1-137)

🛠️ Pilot Agent Telemetry Enhancements

The pilot-agent is responsible for scraping and merging metrics from Envoy and application containers. This release introduces greater control over this process and fixes a bug with content type handling. Users can now disable merging Envoy stats to reduce overhead if preferred, and the agent correctly handles Prometheus metrics formats, preventing issues when Envoy reports metrics using problematic content types like protobuf.

A new environment variable, PILOT_AGENT_MERGE_ENVOY_STATS, is introduced (pilot/pkg/features/telemetry.go), defaulting to true. Setting it to false disables the merging of Envoy stats. Additionally, the pilot-agent’s handleStats function (pilot/cmd/pilot-agent/status/server.go) now explicitly excludes protobuf content types when scraping Envoy metrics, allowing only text/plain and application/openmetrics-text. A new allowedContentTypes helper function manages the Accept header negotiation, preventing incorrect metric parsing and ensuring compatibility with Prometheus scraping. This resolves an issue where protobuf content types led to incorrect metric merging.

Source:

  • releasenotes/notes/agent-merge-envoy-stats-flag.yaml (1-7)
  • releasenotes/notes/60322.yaml (1-10)
  • pilot/pkg/features/telemetry.go (72-75)
  • pilot/cmd/pilot-agent/status/server.go (49-55, 548-552, 608-641)
  • pilot/cmd/pilot-agent/status/server_test.go (530-666)

Minor Updates & Housekeeping

This release also includes several dependency bumps, fixes an issue where WasmPlugins caused duplicate and excessive pushes due to TrafficExtension conversions, addresses a configuration generation bug for sidecars prior to Istio 1.29.2 related to HBONE filter keys, and improves build reliability by widening retry logic for go-fetch operations. Additionally, the Gateway API CRD version warnings are now logged at a warn level for better visibility.