JWKS

📋 Recommended Actions ⚠️ Action Required Immediate patching required, especially for users of BackendTLSPolicy and istioctl analyze. Review other fixes to ensure stability and better support for your mesh. 📝 Summary Istio 1.30.5 brings vital security enhancements and critical stability improvements. Two significant security fixes address a BackendTLSPolicy vulnerability (GHSA-qm8v-g4f9-qhjx) that could lead to plaintext traffic, now safely failing closed. Additionally, istioctl analyze now sanitizes multi-cluster kubeconfig secrets, preventing arbitrary command execution.For Ambient Mesh users, this release delivers more predictable behavior with deterministic network gateway selection, eliminating unnecessary Workload Discovery Service (WDS) pushes. The CNI component benefits from a stable iptables backend detection, resolving flip-flopping issues across restarts. Workload Discovery Service (WDS) performance also sees a boost with pre-marshaled data and improved incremental update handling.Key fixes include ServiceEntries with empty selectors no longer matching all workloads, ensuring precise traffic control. JWKS resolution is more robust with default HTTP/2, and Envoy stats intervals now properly support sub-second and minute-plus configurations. The Gateway API’s ListenerSet status reporting is more accurate, providing clearer insights into resource health. Upgrade promptly to benefit from these crucial updates. ...

📋 Recommended Actions ⚠️ Action Required Immediate action is required for existing auto-registered WorkloadEntries to ensure HBONE capability. Review updates to better support your users. 📝 Summary Istio 1.30.3 delivers crucial stability and performance boosts, especially for ambient mesh environments. This release resolves a deadlock in the CNI node agent, fixing a critical issue that could block the ZDS server. A significant performance enhancement comes from suppressing unnecessary XDS pushes for metadata-only VirtualService changes, reducing control plane load. For ambient users, HBONE auto-registration is now more reliable, ensuring non-Kubernetes workloads correctly advertise HBONE, though existing WorkloadEntries may need a manual label update. Operations engineers will appreciate the fix for file-mounted certificate reloads, resolving issues with Kubernetes secret rotations. Additionally, the node untaint controller is now configurable, offering greater flexibility. Upgrade to benefit from these vital bug fixes and improved mesh reliability. ...

📋 Recommended Actions ⚠️ Action Required Immediate review and upgrade are recommended to benefit from critical security hardening, traffic management improvements, and enhanced multi-cluster reliability. If using Helm with server-side apply, explicitly configure ‘base.validationFailurePolicy: Fail’ during initial installations or when templating for SSA to avoid potential webhook conflicts. During upgrades, the webhook’s ‘failurePolicy’ will be omitted from the template, preserving the runtime value. 📝 Summary Istio 1.29.2 fortifies your service mesh with significant stability, security, and multi-cluster resilience enhancements. This patch release addresses several critical bugs, including a fix for AuthorizationPolicy regex metacharacter handling and a robust improvement to JWKS URI CIDR blocking, preventing potential bypasses. Operations engineers will appreciate the improved Helm upgrade experience with server-side apply, which resolves a webhook ‘failurePolicy’ conflict and ensures smoother installations. A new CRD filter safeguards against issues with unsupported Gateway API versions, enhancing upgrade predictability. Traffic management sees key improvements: waypoints now support multiple VirtualServices for a single host, and DestinationRule ‘retryBudget’ configurations are more consistently applied. Multi-cluster deployments gain a crucial fallback mechanism for mesh configuration, ensuring continued operation even if remote mesh config is temporarily unreadable. Upgrade promptly to secure your mesh and leverage these vital operational improvements. ...