JWKS

📋 Recommended Actions ⚠️ Action Required Immediate action is required for existing auto-registered WorkloadEntries to ensure HBONE capability. Review updates to better support your users. 📝 Summary Istio 1.30.3 delivers crucial stability and performance boosts, especially for ambient mesh environments. This release resolves a deadlock in the CNI node agent, fixing a critical issue that could block the ZDS server. A significant performance enhancement comes from suppressing unnecessary XDS pushes for metadata-only VirtualService changes, reducing control plane load. For ambient users, HBONE auto-registration is now more reliable, ensuring non-Kubernetes workloads correctly advertise HBONE, though existing WorkloadEntries may need a manual label update. Operations engineers will appreciate the fix for file-mounted certificate reloads, resolving issues with Kubernetes secret rotations. Additionally, the node untaint controller is now configurable, offering greater flexibility. Upgrade to benefit from these vital bug fixes and improved mesh reliability. ...

📋 Recommended Actions ⚠️ Action Required Immediate review and upgrade are recommended to benefit from critical security hardening, traffic management improvements, and enhanced multi-cluster reliability. If using Helm with server-side apply, explicitly configure ‘base.validationFailurePolicy: Fail’ during initial installations or when templating for SSA to avoid potential webhook conflicts. During upgrades, the webhook’s ‘failurePolicy’ will be omitted from the template, preserving the runtime value. 📝 Summary Istio 1.29.2 fortifies your service mesh with significant stability, security, and multi-cluster resilience enhancements. This patch release addresses several critical bugs, including a fix for AuthorizationPolicy regex metacharacter handling and a robust improvement to JWKS URI CIDR blocking, preventing potential bypasses. Operations engineers will appreciate the improved Helm upgrade experience with server-side apply, which resolves a webhook ‘failurePolicy’ conflict and ensures smoother installations. A new CRD filter safeguards against issues with unsupported Gateway API versions, enhancing upgrade predictability. Traffic management sees key improvements: waypoints now support multiple VirtualServices for a single host, and DestinationRule ‘retryBudget’ configurations are more consistently applied. Multi-cluster deployments gain a crucial fallback mechanism for mesh configuration, ensuring continued operation even if remote mesh config is temporarily unreadable. Upgrade promptly to secure your mesh and leverage these vital operational improvements. ...