📋 Recommended Actions
⚠️ Action Required
Immediate patching required to address multiple security vulnerabilities and benefit from critical bug fixes, especially for ambient mesh users. Review the details for specific impacts on your deployment.
📝 Summary
Istio 1.30.4 is here, bringing crucial security patches, significant ambient mesh hardening, and key performance improvements. This release addresses multiple security vulnerabilities, including a critical fix for sidecar annotation injection, preventing potential spec manipulation. It also tightens EnvoyFilter proxyVersion validation against DoS attacks and strengthens JWKS URI fetching to prevent SSRF. Ambient mesh users will find enhanced stability with fixes for CNI kubeconfig deadlocks, improved network namespace ownership validation, and critical goroutine/memory leak remediations in multi-cluster environments. Gateway API operations are smoother: listener conflict resolution is more robust, and TLS ReferenceGrant authorization is corrected. Performance gets a boost with optimized AuthorizationPolicy/PeerAuthentication scanning and more efficient Workload Discovery Service updates. Upgrade now to secure your mesh and leverage these vital enhancements.
🔒 Critical Security Patches and Hardening
This release prioritizes your mesh’s security by delivering a suite of critical patches and hardening measures. These updates close potential attack vectors, preventing unauthorized access, denial-of-service, and data exfiltration, ensuring your workloads remain protected against emerging threats.
Several sidecar.istio.io/* annotations, including proxyImage, bootstrapOverride, logLevel, componentLogLevel, and agentLogLevel, were vulnerable to YAML injection. This release now diligently escapes these annotation values during sidecar and gateway injection, preventing attackers from injecting arbitrary fields into generated pod or deployment specifications. Additionally, to combat potential Denial-of-Service attacks, the EnvoyFilter proxyVersion match expression is now capped at 1024 characters. Overly long patterns, which are expensive to compile and serve no legitimate purpose, will now be ignored by Istiod, preserving system stability. The XDS api generator (MCP config serving) now enforces stricter authorization, requiring a verified control-plane identity. This prevents unauthenticated clients or workloads in unrelated namespaces from accessing cluster-wide Istio configuration. Furthermore, Istiod’s RequestAuthentication jwksUri fetching now proactively blocks connections to link-local and known cloud metadata IP addresses (like 169.254.169.254) by default. This crucial SSRF protection also rejects non-JWKS responses. Lastly, a critical fail-open bug in BackendTLSPolicy has been resolved; sidecar proxies will now correctly fail closed (instead of sending plaintext traffic) if caCertificateRefs cannot be resolved, ensuring mTLS integrity.
Source:
manifests/charts/istio-control/istio-discovery/files/gateway-injection-template.yaml(29-31, 34-36, 39-41, 224)manifests/charts/istio-control/istio-discovery/files/grpc-agent.yaml(50-52, 55-57, 60-62, 259)manifests/charts/istio-control/istio-discovery/files/injection-template.yaml(88-90, 133-135, 189-191, 203-205, 208-210, 488)manifests/charts/istio-control/istio-discovery/files/kube-gateway.yaml(89-91)manifests/charts/istio-control/istio-discovery/files/waypoint.yaml(104-106)releasenotes/notes/sidecar-annotation-yaml-injection.yaml(1-13)pilot/pkg/model/envoyfilter.go(91-94, 180-184)pilot/pkg/model/envoyfilter_test.go(97-104, 115-123, 171-189)pkg/config/validation/envoyfilter/envoyfilter.go(38-42, 94-99)pkg/config/validation/envoyfilter/envoyfilter_test.go(134-149)releasenotes/notes/envoyfilter-proxyversion-length.yaml(1-15)pilot/pkg/networking/apigen/apigen.go(40-44, 60-62, 143-162)pilot/pkg/networking/apigen/apigen_test.go(60-71, 76-100)releasenotes/notes/xds-api-generator-auth.yaml(1-21)pilot/pkg/model/jwks_resolver.go(274-279, 602-646)pilot/pkg/model/jwks_resolver_test.go(835-861, 863-888)pkg/security/dial.go(1-88)pkg/security/dial_test.go(1-112)releasenotes/notes/jwks-ssrf-default-block.yaml(1-9)pilot/pkg/networking/core/cluster_tls.go(120-123)pilot/pkg/networking/core/cluster_tls_test.go(1482-1563)releasenotes/notes/backendtlspolicy-sidecar-failclosed.yaml(1-13)
✨ Ambient Mesh & CNI Resilience
Istio 1.30.4 significantly strengthens the Ambient Mesh, particularly in multi-cluster and CNI operations. These fixes enhance reliability, prevent unintended behavior, and ensure a more robust and stable ambient environment, reducing operational overhead and improving overall traffic management.
Host-networked pods are now explicitly excluded from Ambient enrollment, resolving a bug where istio-cni would incorrectly attempt to capture their network namespace. This prevents traffic from being misdirected for such pods. A critical fix addresses a deadlock in the istio-cni node agent, where it could fail to start due to waiting on a kubeconfig it hadn’t yet written. The preemptive check now applies to both Ambient and Sidecar modes, ensuring smoother agent pod startup. Furthermore, network namespace ownership validation has been enhanced in the istio-cni node agent. It now verifies that a network namespace holds one of the pod’s IPs before enrollment, preventing incorrect pairings when third-party processes are present. This release also resolves a file descriptor leak in the istio-cni node agent when multiple network namespaces were detected for the same pod. For multi-cluster ambient deployments, a bug has been fixed where ingress gateways would bypass waypoint proxies for multi-cluster services if remote workloads were on different networks. Previously, this would lead to authorization policies not being enforced. Significant work went into fixing several memory and goroutine leaks within Istiod’s internal KRT collections, especially when remote clusters are removed or updated. This addresses issues where per-cluster node locality collections and cached cluster states were not properly torn down, accumulating resources over time. The multi-cluster aggregated collections now properly gate their readiness on all remote clusters syncing, preventing Istiod from serving local-cluster-only data during startup. This ensures remote workloads, services, and endpoints are consistently available from the outset.
Source:
cni/pkg/nodeagent/informers.go(138-140, 289-291, 401-403)cni/pkg/nodeagent/informers_test.go(355-403, 985-1010)cni/pkg/util/enablement_selector.go(73-82)cni/pkg/util/podutil_test.go(114-116, 172-243)releasenotes/notes/61168.yaml(1-9)cni/pkg/plugin/plugin.go(173-195, 300-307, 422-427)cni/pkg/plugin/plugin_test.go(422-458)releasenotes/notes/60668.yaml(1-12)cni/pkg/nodeagent/podcgroupns_linux.go(183-205, 417-463)cni/pkg/nodeagent/podcgroupns_linux_test.go(15-28, 259-328)releasenotes/notes/validate-netns-ownership.yaml(1-11)cni/pkg/nodeagent/fakes_test.go(19-21, 92-120)cni/pkg/nodeagent/testdata/cgroupns/0/cgroup(1-1)cni/pkg/nodeagent/testdata/cgroupns/0/ns/net(1-0)cni/pkg/nodeagent/testdata/cgroupns/0/stat(1-1)cni/pkg/nodeagent/testdata/cgroupns/3/cgroup(1-1)cni/pkg/nodeagent/testdata/cgroupns/3/ns/net(1-0)cni/pkg/nodeagent/testdata/cgroupns/3/stat(1-1)releasenotes/notes/close-scan-netns-fd-leak.yaml(1-8)releasenotes/notes/61092.yaml(1-9)pilot/pkg/serviceregistry/ambient/multicluster.go(295-312)pilot/pkg/serviceregistry/ambient/networks.go(60-70, 179-191)pkg/kube/multicluster/secretcontroller.go(212-216)releasenotes/notes/ambient-multicluster-sync-gating.yaml(1-12)releasenotes/notes/ambient-global-nodes-collection-leak.yaml(1-10)releasenotes/notes/ambient-remote-networks-leak.yaml(1-9)pkg/kube/multicluster/collections.go(79-106, 108-115, 117-124)pkg/kube/multicluster/collections_test.go(1-120)pkg/kube/multicluster/clusterstore.go(96-103, 114-116, 157-175, 265-271)pkg/kube/multicluster/clusterstore_test.go(1-110)releasenotes/notes/multicluster-rebuild-collections-on-update.yaml(1-12)releasenotes/notes/krt-collection-teardown-leaks.yaml(1-11)releasenotes/notes/krt-debugger-leak.yaml(1-12)pkg/kube/krt/collection.go(647-668)pkg/kube/krt/collection_leak_test.go(1-271)pkg/kube/krt/debug.go(17-21, 69-79, 82-87)pkg/kube/krt/debug_test.go(1-166)pkg/kube/krt/fetch.go(55-63)pkg/kube/krt/index.go(122-128)pkg/kube/krt/informer.go(216-224)pkg/kube/krt/internal.go(63-67, 110-113)pkg/kube/krt/map.go(171-177)pkg/kube/krt/mergejoin.go(377-384)pkg/kube/krt/nestedjoinmerge.go(142-155)pkg/kube/krt/singleton.go(63-69)pkg/kube/krt/static.go(74-80)pkg/kube/krt/testing.go(19-21)
🛠️ Gateway API Enhancements and Fixes
This release brings several important enhancements and fixes to the Gateway API, ensuring more reliable and conformant behavior for your ingress and egress traffic. These updates address long-standing issues with listener conflicts, TLS reference handling, and the robustness of Gateway deployments, providing a smoother experience for Gateway API users.
Listener conflict resolution for both Gateway and ListenerSet resources has been significantly improved, now correctly identifying and reporting hostname and protocol conflicts. This aligns with Gateway API 1.5 merge semantics, ensuring that conflicting listeners are correctly rejected and only winning listeners are programmed. A related fix prevents issues where a Gateway and a ListenerSet with the same namespace and name could incorrectly read each other’s conflict entries, leading to misreported Conflicted status. A security-related fix addresses the order of TLS ReferenceGrant authorization: cross-namespace certificateRef or caCertificateRef are now authorized before resolution, preventing an information leak that could distinguish between existing and missing secrets/configmaps without proper grants. The generated Gateway Service resources now correctly handle cases where two listener names might sanitize to the same Kubernetes Service port name (e.g., names differing only by periods vs. dashes, or exceeding the 63-character limit). Such collisions, which previously blocked all unpublished ports on the Gateway, are now disambiguated by appending the listener’s port number. Finally, a bug preventing Gateway proxy Deployments from being permanently created during Istiod startup has been resolved, improving the reliability of Gateway resource provisioning.
Source:
pilot/pkg/config/kube/agentgateway/conditions.go(24-25, 75-76, 78-83)pilot/pkg/config/kube/agentgateway/controller.go(265-271, 285-288, 357-363, 447-452)pilot/pkg/config/kube/agentgateway/gateway_collection.go(130-132, 187-206, 211-218, 298-316, 357-377)pilot/pkg/config/kube/agentgateway/gateway_collection_test.go(1-27)pilot/pkg/config/kube/agentgateway/gateway_status.go(165-172, 174-192, 207-217)pilot/pkg/config/kube/agentgateway/listener.go(82-88, 110-112, 117-119, 124-126)pilot/pkg/config/kube/gateway/controller.go(240-248, 259-262, 305-308)pilot/pkg/config/kube/gateway/conversion.go(576-621, 745-752, 1861-1900, 2055-2070, 2075-2077, 2112-2126, 2236-2244, 2250-2270, 2271-2287, 2358-2396)pilot/pkg/config/kube/gateway/conversion_test.go(715-731, 771-789, 1401-1407, 1793-1811)pilot/pkg/config/kube/gateway/gateway_collection.go(131-133, 187-206, 211-218, 299-317, 357-377, 412-421)pilot/pkg/config/kube/gateway/route_collections.go(702-707)pilot/pkg/config/kube/gateway/supported_features.go(29-31)pilot/pkg/config/kube/gateway/testdata/foreign-waypoint.status.yaml.golden(1-21)pilot/pkg/config/kube/gateway/testdata/foreign-waypoint.yaml(1-79)pilot/pkg/config/kube/gateway/testdata/frontend-tls-refgrant.status.yaml.golden(1-225)pilot/pkg/config/kube/gateway/testdata/frontend-tls-refgrant.yaml(1-151)pilot/pkg/config/kube/gateway/testdata/invalid.status.yaml.golden(260-277, 311-328, 363-380, 415-432)pilot/pkg/config/kube/gateway/testdata/listenerset-cross-namespace.status.yaml.golden(96-113)pilot/pkg/config/kube/gateway/testdata/listenerset-hostname-conflict.status.yaml.golden(1-361)pilot/pkg/config/kube/gateway/testdata/listenerset-hostname-conflict.yaml(1-140)pilot/pkg/config/kube/gateway/testdata/listenerset-hostname-conflict.yaml.golden(1-101)pilot/pkg/config/kube/gateway/testdata/listenerset-https-missing-tls.status.yaml.golden(1-113)pilot/pkg/config/kube/gateway/testdata/listenerset-https-missing-tls.yaml(1-54)pilot/pkg/config/kube/gateway/testdata/listenerset-protocol-conflict.status.yaml.golden(1-353)pilot/pkg/config/kube/gateway/testdata/listenerset-protocol-conflict.yaml(1-136)pilot/pkg/config/kube/gateway/testdata/listenerset-protocol-conflict.yaml.golden(1-101)pilot/pkg/config/kube/gatewaycommon/conversion.go(1-412)pilot/pkg/config/kube/gatewaycommon/conversion_test.go(1-98)pilot/pkg/config/kube/gatewaycommon/gateway_utils.go(140-153)pilot/pkg/config/kube/gatewaycommon/gatewayclass_collection.go(25-39)pilot/pkg/config/kube/gatewaycommon/listener_conflict.go(1-230)pilot/pkg/config/kube/gatewaycommon/listener_conflict_collection.go(1-109)pilot/pkg/config/kube/gatewaycommon/listener_conflict_test.go(1-614)releasenotes/notes/listenerset-conflict-resolution.yaml(1-12)releasenotes/notes/listenerset-conflict-owner-kind.yaml(1-9)releasenotes/notes/gateway-tls-ref-grant-order.yaml(1-14)pilot/pkg/config/kube/gatewaycommon/deploymentcontroller.go(917-944)pilot/pkg/config/kube/gatewaycommon/deploymentcontroller_test.go(1439-1441, 1473-1516)releasenotes/notes/service-port-name-collision.yaml(1-10)releasenotes/notes/61095.yaml(1-8)pilot/pkg/bootstrap/server.go(367-370, 515-518)pilot/pkg/bootstrap/server_test.go(809-847)pilot/pkg/bootstrap/validation.go(39-42)releasenotes/notes/61049.yaml(1-13)
🚀 Performance & Resource Optimization
Istio 1.30.4 delivers meaningful performance enhancements and resource optimizations across various components. These updates directly contribute to a more efficient and responsive mesh, reducing CPU and memory footprint, and ensuring that Istiod can handle larger, more dynamic environments with greater stability.
AuthorizationPolicy scanning has been significantly optimized by indexing policies on their namespace, dramatically reducing the CPU usage in Istiod as the number of AuthorizationPolicies grows. Similarly, PeerAuthentication fetching for workloads has been improved, leading to better performance in environments with many mTLS policies. The Workload Discovery Service (WDS) now uses content-based versioning. When ztunnel reconnects, it reports the versions of resources it already holds. Istiod now leverages this initial_resource_versions information to send only resources that have actually changed while the client was disconnected, reducing unnecessary full pushes and improving ztunnel reconnect efficiency. A persistent goroutine leak in Istiod’s leader election mechanism has been resolved, where each election cycle previously leaked a goroutine until process exit. This fix prevents gradual resource exhaustion in highly dynamic or contested leadership scenarios. General improvements to KRT (Kubernetes Resource Tree) collections address various goroutine and memory leaks. This includes ensuring that internal collections (especially in ambient multi-cluster mode) and debugger registrations are properly unregistered and torn down when remote clusters are removed or reconfigured, preventing resource accumulation over time.
Source:
d0c0400a26(0-0)releasenotes/notes/61254.yaml(1-8)8db8136dac(0-0)pilot/pkg/serviceregistry/ambient/ambientindex.go(360-362, 896-908)pilot/pkg/serviceregistry/ambient/workloads.go(536-537, 688-689, 870-871, 1025-1026, 1222-1240)releasenotes/notes/peerauth-by-ns.yaml(1-6)pilot/pkg/xds/delta.go(297-302, 388-390)pilot/pkg/xds/workload.go(66-68, 85-99, 163-165)pilot/pkg/xds/workload_test.go(171-305)pkg/xds/server.go(36-41)releasenotes/notes/wds-reconnect-version-skip.yaml(1-30)pilot/pkg/leaderelection/leaderelection.go(121-127)pilot/pkg/leaderelection/leaderelection_test.go(165-209)releasenotes/notes/leaderelection-cycle-goroutine-leak.yaml(1-9)
⚙️ Other Notable Fixes and Enhancements
Beyond the major security, ambient, and Gateway API updates, Istio 1.30.4 includes several other important fixes and improvements that enhance the overall stability and functionality of your mesh. These changes ensure more accurate configurations, better resource management, and smoother operations for specific scenarios.
External SDS providers configured via extensionProviders now correctly use the configured service hostname as the gRPC authority, improving compatibility and reliability for external certificate management. A bug has been fixed where ServiceEntry membership changes did not reliably force a proxy to recompute its configuration, leading to stale inbound configurations for sidecars. This ensures that pods selected by a ServiceEntry always receive the correct and up-to-date service information. For multi-cluster deployments, an issue where rotating a remote cluster’s istio-remote-secret could permanently wipe endpoint shards for services with stable endpoints has been resolved. This prevents services from becoming unreachable across clusters after a credential rotation. Lastly, the nftables version used by Istio distroless images has been unpinned, removing a workaround for an older bug in nftables that affected Kubernetes nodes. Users are advised to update nftables on their nodes to the latest version to ensure compatibility and stability.
Source:
pilot/pkg/security/model/authentication.go(91-100, 117-133)pilot/pkg/security/model/authentication_test.go(793-802)releasenotes/notes/external-sds-authority.yaml(1-7)c8df78d2e3(0-0)pilot/pkg/serviceregistry/serviceentry/controller.go(222-226, 232-234, 355-373)pilot/pkg/serviceregistry/serviceentry/controller_test.go(1679-1698, 1715-1748)releasenotes/notes/61157.yaml(1-11)releasenotes/notes/61043.yaml(1-11)pilot/pkg/model/endpointshards.go(230-244)pilot/pkg/serviceregistry/kube/controller/multicluster.go(53-57, 71-74, 96-104)pilot/pkg/serviceregistry/kube/controller/multicluster_test.go(190-276)docker/iptables.yaml(12-14)tools/build-base-images.sh(77-85)releasenotes/notes/58492.yaml(1-12)
Minor Updates & Housekeeping
This release includes miscellaneous dependency bumps, build tool image updates, and minor test suite adjustments to ensure stability and maintainability. Notable updates include github.com/KimMachineGun/automemlimit to v1.0.0, github.com/google/cel-go to v0.31.0, and google.golang.org/protobuf to v1.36.12, along with golang.org/x/net to v0.58.0.