Istioctl

📋 Recommended Actions ⚠️ Action Required Immediate patching required to address critical security updates and enhance Istiod stability. 📝 Summary Istio 1.30.7 delivers essential security enhancements and crucial bug fixes for improved reliability. A critical update addresses the emSign ECC Root CA - G3 distrust by refreshing distroless base images, bolstering the trust chain for Istio components. This release also resolves a significant Istiod startup issue where expired self-signed CA certificates now automatically renew, preventing service interruptions after prolonged scale-to-zero periods. For authorization, :method header matching in policies is now case-insensitive, aligning with expected behavior. Ambient mesh users can opt-in to a new feature (PILOT_NODE_UNTAINT_CHECK_ZTUNNEL=true) that ensures ztunnel readiness before scheduling pods to untainted nodes, preventing workloads from landing on unready proxies. Furthermore, istioctl bug-report --duration now filters logs correctly, even without an --end-time specified, streamlining diagnostics. Multiple dependency updates round out this release, reinforcing the mesh’s security posture and overall operational stability. Upgrade promptly to benefit from these vital improvements. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended due to multiple critical and high-severity security fixes. Review the new PILOT_ENABLE_STRICT_GATEWAY_MERGING flag to understand its implications for your Gateway API deployments. 📝 Summary Istio 1.30.6 delivers essential security updates and significant stability improvements. This release addresses multiple critical vulnerabilities, including shell injection in istioctl manifest translate and potential MITM attacks on istioctl XDS connections. It also resolves Denial-of-Service issues related to ambient waypoint address collisions and malformed OIDC/JWT sub claims, along with a WASM image fetcher vulnerability. Beyond security, you’ll find enhanced Gateway API reliability, particularly for InferencePool backendRefs and ListenerSets. Kubernetes API requests now benefit from client-side timeouts, preventing indefinite hangs and boosting control plane resilience. OpenShift users will see more accurate proxy UID/GID assignments. Upgrade swiftly to secure your mesh and leverage these robustness gains. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching required, especially for users of BackendTLSPolicy and istioctl analyze. Review other fixes to ensure stability and better support for your mesh. 📝 Summary Istio 1.30.5 brings vital security enhancements and critical stability improvements. Two significant security fixes address a BackendTLSPolicy vulnerability (GHSA-qm8v-g4f9-qhjx) that could lead to plaintext traffic, now safely failing closed. Additionally, istioctl analyze now sanitizes multi-cluster kubeconfig secrets, preventing arbitrary command execution.For Ambient Mesh users, this release delivers more predictable behavior with deterministic network gateway selection, eliminating unnecessary Workload Discovery Service (WDS) pushes. The CNI component benefits from a stable iptables backend detection, resolving flip-flopping issues across restarts. Workload Discovery Service (WDS) performance also sees a boost with pre-marshaled data and improved incremental update handling.Key fixes include ServiceEntries with empty selectors no longer matching all workloads, ensuring precise traffic control. JWKS resolution is more robust with default HTTP/2, and Envoy stats intervals now properly support sub-second and minute-plus configurations. The Gateway API’s ListenerSet status reporting is more accurate, providing clearer insights into resource health. Upgrade promptly to benefit from these crucial updates. ...

📋 Recommended Actions ⚠️ Action Required Upgrade to Istio 1.30.1 as soon as possible to benefit from critical stability fixes and improved Gateway API diagnostics. Review the sections on ambient mode, multicluster, and Gateway API headers for specific impacts. 📝 Summary Istio 1.30.1 delivers crucial stability enhancements and significant Gateway API improvements. This release addresses critical issues like a concurrent map writes panic in the CNI agent and a deadlock in the multicluster ClusterStore, bolstering overall mesh reliability. Traffic management sees a vital fix for consistentHash load balancing, ensuring new endpoints receive traffic reliably, resolving an Envoy regression. Ambient mode users will find better traffic distribution with a fix for mutating shared load balancer presets, preventing misconfigurations where traffic was routed to not-ready endpoints. The Gateway API ecosystem gains an important istioctl analyze check (IST0176) that warns about outdated CRD versions, preventing silent failures. External SDS provider logic is refined for more flexible credential management, and invalid HTTP/GRPCRoute header values are now properly reported, enhancing configuration validation. Kiali also receives an update to version 2.26.0. Upgrade promptly to secure these stability and diagnostic benefits. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address critical security vulnerabilities related to authorization bypasses. Operations engineers should review the updated Ambient Mesh configurations for AWS deployments and consider tuning HBONE window sizes for performance. Review istioctl analyze output for new JWKS URI security warnings. 📝 Summary Istio 1.29.3 lands with crucial security fixes, fortifying your mesh against potential bypasses. This release tackles an authorization policy regex vulnerability, ensuring principal and namespace matching behaves as intended. It also tightens XDS debug endpoint access, preventing cross-namespace information exposure for non-system callers. Plus, leaf certificates now respect CA validity, preventing expired cert usage. AWS EKS users with Security Groups for Pods get a critical fix for kubelet health probe failures in Ambient Mesh, ensuring smoother operations. We’ve also added configurable HTTP/2 window sizes for HBONE, offering fine-tuned performance. Tooling improves with a new istioctl analyze warning for JWKS URI security, better handling of Helm webhook failurePolicy during upgrades, and enhanced proxy resource injection for null values. Several core bug fixes, including a multicluster secret controller deadlock and robust Kubernetes secret rotation, contribute to overall stability. ...

📋 Recommended Actions ⚠️ Action Required Upgrade to Istio 1.28.2 after carefully reviewing the new minimum Kubernetes version requirement (1.30). Existing Ambient mode users planning nftables migration should be aware of the new safe fallback mechanism. 📝 Summary Istio 1.28.2 delivers crucial updates, enhancing stability and streamlining operations. Critically, the minimum required Kubernetes version has been bumped to 1.30, a change requiring pre-upgrade validation. For Ambient mode, a new intelligent fallback ensures smoother migrations from iptables to nftables, preventing network disruptions by detecting existing artifacts and temporarily sticking to iptables until node reboot. DNS resolution for headless services sees significant improvement, now correctly handling pods with multiple IPs and prioritizing local cluster endpoints for multi-cluster setups. Additionally, a long-standing bug preventing proxy startup when sidecar.istio.io/statsEvictionInterval was 60 seconds or more has been resolved. Updates to the KRT library also improve internal data processing, setting the stage for more robust configurations. Review these changes to ensure a seamless upgrade and optimized mesh. ...

📋 Recommended Actions ✅ No Immediate Action Required No immediate action required. Review updates to better support your users, especially if you’re leveraging Kubernetes Gateway API or istioctl proxy-status. 📝 Summary Istio 1.27.1 delivers crucial bug fixes and valuable enhancements, bolstering operational stability and testing capabilities. This release notably improves Kubernetes Gateway API adoption by fixing a tag watcher issue that caused programming failures with revisioned installs. Users of istioctl proxy-status will find a more robust experience as its behavior when no proxies are found has been fixed to prevent breaking external tooling. We’ve also added comprehensive mTLS support to the Echo server, allowing for more detailed and accurate security testing. Core component reliability sees significant boosts with fixes for traffic policy validation (especially retry_budget) and improved istio-iptables logic that correctly handles IPv4/IPv6 states. Dependency updates ensure compatibility and security. These changes collectively enhance Istio’s stability and flexibility, making it even more dependable for your cloud-native deployments. ...

📋 Recommended Actions ⚠️ Action Required Review your Gateway API configurations, particularly AllowedRoutes.namespaces.from settings, as None is no longer supported and will cause validation errors. For pluginca users, ensure your cacerts bundle is complete to avoid istiod startup failures due to new, stricter validation. Upgrading is recommended for improved stability and security hardening. 📝 Summary Istio 1.26.1 lands with crucial updates, primarily focusing on robust Gateway API integration and enhanced security. This release promotes Gateway API to v1.3.0, alongside a critical fix that resolves istiod panics when processing complex Gateway API hostnames. Notably, a breaking change from upstream Gateway API means AllowedRoutes.namespaces.from: None is no longer valid, requiring configuration updates. ...