istio(1.30.4): Critical Security Patches, Ambient Mesh Hardening, and Performance Boosts
📋 Recommended Actions ⚠️ Action Required Immediate patching required to address multiple security vulnerabilities and benefit from critical bug fixes, especially for ambient mesh users. Review the details for specific impacts on your deployment. 📝 Summary Istio 1.30.4 is here, bringing crucial security patches, significant ambient mesh hardening, and key performance improvements. This release addresses multiple security vulnerabilities, including a critical fix for sidecar annotation injection, preventing potential spec manipulation. It also tightens EnvoyFilter proxyVersion validation against DoS attacks and strengthens JWKS URI fetching to prevent SSRF. Ambient mesh users will find enhanced stability with fixes for CNI kubeconfig deadlocks, improved network namespace ownership validation, and critical goroutine/memory leak remediations in multi-cluster environments. Gateway API operations are smoother: listener conflict resolution is more robust, and TLS ReferenceGrant authorization is corrected. Performance gets a boost with optimized AuthorizationPolicy/PeerAuthentication scanning and more efficient Workload Discovery Service updates. Upgrade now to secure your mesh and leverage these vital enhancements. ...