istio(1.30.7): Critical Security Updates, Robust CA Renewal, and Ambient Readiness Fixes
📋 Recommended Actions ⚠️ Action Required Immediate patching required to address critical security updates and enhance Istiod stability. 📝 Summary Istio 1.30.7 delivers essential security enhancements and crucial bug fixes for improved reliability. A critical update addresses the emSign ECC Root CA - G3 distrust by refreshing distroless base images, bolstering the trust chain for Istio components. This release also resolves a significant Istiod startup issue where expired self-signed CA certificates now automatically renew, preventing service interruptions after prolonged scale-to-zero periods. For authorization, :method header matching in policies is now case-insensitive, aligning with expected behavior. Ambient mesh users can opt-in to a new feature (PILOT_NODE_UNTAINT_CHECK_ZTUNNEL=true) that ensures ztunnel readiness before scheduling pods to untainted nodes, preventing workloads from landing on unready proxies. Furthermore, istioctl bug-report --duration now filters logs correctly, even without an --end-time specified, streamlining diagnostics. Multiple dependency updates round out this release, reinforcing the mesh’s security posture and overall operational stability. Upgrade promptly to benefit from these vital improvements. ...