istio(1.30.6): Critical Security Patches, API Robustness, and Gateway Enhancements
📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended due to multiple critical and high-severity security fixes. Review the new PILOT_ENABLE_STRICT_GATEWAY_MERGING flag to understand its implications for your Gateway API deployments. 📝 Summary Istio 1.30.6 delivers essential security updates and significant stability improvements. This release addresses multiple critical vulnerabilities, including shell injection in istioctl manifest translate and potential MITM attacks on istioctl XDS connections. It also resolves Denial-of-Service issues related to ambient waypoint address collisions and malformed OIDC/JWT sub claims, along with a WASM image fetcher vulnerability. Beyond security, you’ll find enhanced Gateway API reliability, particularly for InferencePool backendRefs and ListenerSets. Kubernetes API requests now benefit from client-side timeouts, preventing indefinite hangs and boosting control plane resilience. OpenShift users will see more accurate proxy UID/GID assignments. Upgrade swiftly to secure your mesh and leverage these robustness gains. ...