Kubernetes Gateway API

📋 Recommended Actions ⚠️ Action Required Immediate upgrade recommended to patch critical security vulnerabilities and ensure robust ambient mesh operation. 📝 Summary This release, Istio 1.29.7, delivers essential security fixes and significant stability enhancements across the mesh. We’ve tackled multiple vulnerabilities, including an EnvoyFilter regex denial-of-service vector and an SSRF vulnerability in JWKS URI fetching. Critical functional security fixes ensure BackendTLSPolicy now fails closed when CA references are unresolved and close a Gateway API TLS certificateRef existence oracle. For Ambient Mesh users, stability and performance are greatly improved. We’ve resolved issues where ingress gateways bypassed waypoints in multi-cluster setups and prevented hostNetwork pods from erroneous enrollment. Resource management gets a boost with fixes for istio-cni file descriptor leaks and optimized policy scanning. Furthermore, WDS reconnects are now version-aware, significantly reducing traffic during ztunnel reconnections. Core platform reliability also sees important updates, like a fix for istiod leader election goroutine leaks and improved Gateway API port name disambiguation. Upgrade today to fortify your mesh against potential exploits and benefit from a more resilient and efficient Istio experience. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching required to address critical stability issues in Ambient Mode, Kubernetes Gateway API, and Multicluster deployments. 📝 Summary Istio 1.29.5 lands with crucial bug fixes that significantly bolster the stability of your mesh. This release tackles a critical issue in Ambient Mode where enrolled pods could drop from the host health-probe ipset, leading to broken health checks after node restarts. We’ve also resolved a major traffic outage scenario during Kubernetes Gateway API canary upgrades, ensuring smoother transitions when changing istio.io/rev labels. For multicluster users, a panic (close of closed channel) from rapid kubeconfig secret updates is now fixed, enhancing resilience. Additionally, a memory leak within the KRT controller framework has been patched, preventing gradual memory growth. These targeted fixes are essential for maintaining robust and predictable service mesh operations. Upgrade now to secure these vital stability improvements. ...

📋 Recommended Actions ✅ No Immediate Action Required No immediate action required. Review updates, especially for Ambient Mesh and Gateway API users, to better support your users and leverage new security features. 📝 Summary Istio 1.30.2 arrives with a bundle of important bug fixes and a powerful new security feature, significantly enhancing the mesh’s robustness and operational control. This release introduces AuthorizationPolicy trust domains, allowing granular security policies based on the peer certificate’s trust domain. This is a crucial addition for fine-grained access control, enabling users to match or exclude requests from specific trust boundaries.A significant stability improvement comes for Ambient Mesh users with a fix addressing pods that could lose host health-probe IPSet entries after node or kubelet restarts. This change prevents broken probes and ensures more reliable health checks. Gateway API users will benefit from a fix resolving brief traffic outages experienced during canary upgrades when changing istio.io/rev labels on Gateways, ensuring smoother, disruption-free transitions.For better resource management, a memory leak in the KRT controller framework has been patched, leading to more stable memory usage and preventing unnecessary recomputations. Telemetry also sees an update: pilot-agent now correctly handles Prometheus content types by excluding protobuf and offers a new environment variable to disable merging Envoy stats if desired. Improved warning messages for outdated Gateway API CRDs provide clearer guidance. These updates collectively strengthen Istio’s security, stability, and overall operational experience. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade is recommended. Critical bugs affecting Ambient mesh traffic distribution and CNI stability have been fixed. Review Gateway API header validation changes and unmanaged Gateway SA behavior. 📝 Summary Istio 1.29.4 delivers crucial stability and correctness enhancements, particularly for Ambient mesh deployments and Gateway API users. This patch release resolves a critical bug where PreferSameZone or PreferSameNode traffic distribution, combined with publishNotReadyAddresses: true, could lead to traffic being routed to unready endpoints cluster-wide. Another significant fix addresses a concurrent map writes panic in the CNI agent, improving Ambient mesh robustness. Gateway API users benefit from new header validation logic, preventing silently dropped configurations and providing clearer feedback for invalid HTTPRoute and GRPCRoute header values. Multi-network Ambient ingress routing also sees improvements, ensuring correct waypoint traversal based on configuration. This release also streamlines HTTP/2 handling and includes numerous dependency updates, reinforcing overall platform reliability. Upgrade now to secure these vital fixes and bolster your Istio environment. ...

📋 Recommended Actions ⚠️ Action Required Immediate action is required for users deploying Istio with Helm v4 (server-side apply) or those with newer Gateway API CRDs. Review the section on Helm failurePolicy to configure base.validationFailurePolicy: Fail as needed. Also, be aware of the new Gateway API CRD maximum version filter, which may ignore newer TLSRoute versions (v1.5.0+). All users should upgrade to benefit from critical security hardening and stability fixes. ...

📋 Recommended Actions ⚠️ Action Required Immediate review is required due to security enhancements for Gateway API TLS secret access. Operations engineers should update to ensure gateways continue to function correctly, especially if relying on previous implicit permissions. Also, review the new ENABLE_PROXY_FIND_POD_BY_IP flag for potential future impacts. 📝 Summary Istio 1.26.5 delivers crucial security and stability enhancements. This release significantly hardens Kubernetes Gateway API TLS secret access, now requiring both namespace and service account matching for referenced secrets—a vital update for secure operations. You’ll also find improved installation flexibility as the Istio CNI no longer depends directly on Pilot, streamlining deployments. For ambient mode users, ServiceEntry named port mapping logic is now correctly aligned with sidecar behavior, resolving previous inconsistencies. Additionally, a new feature flag, ENABLE_PROXY_FIND_POD_BY_IP, grants more control over pod-proxy association, with future versions defaulting it to ‘off’. Critical bug fixes address issues like XDS cache corruption during SDS config dumps and Gateway API meshconfig reconciliation, ensuring a more robust and predictable service mesh. Review these updates promptly to maintain a secure and efficient Istio environment. ...

📋 Recommended Actions ⚠️ Action Required Immediate review required for Gateway API users managing TLS secrets. Verify existing ReferenceGrants or ServiceAccount configurations to avoid disruptions. For other users, review CNI and Ambient updates for improved reliability and multicluster stability. 📝 Summary Istio 1.27.2 hardens security for Kubernetes Gateway API users by tightening TLS secret access. Gateway API deployments now require service account matching or ReferenceGrant for TLS secrets, preventing unauthorized access to sensitive credentials. This update significantly improves CNI and Ambient mesh resilience during upgrades and reboots, with graceful handling of missing IPv6 support and decoupled CNI installation from Pilot. Critical goroutine leaks in multicluster KRT collections are also resolved, boosting stability and resource efficiency. Developers and operators will appreciate the fixed header validation allowing underscores and streamlined ServiceEntry resolution in ztunnel. This release delivers essential stability, security, and operational improvements for your Istio deployments. ...

📋 Recommended Actions ✅ No Immediate Action Required Upgrade recommended for improved stability and corrected behavior, especially for users of Istio Gateway API and mixed IPv4/IPv6 environments. 📝 Summary Istio 1.26.4 is here, delivering essential bug fixes and stability enhancements for your service mesh deployments. This patch release addresses a critical istio-iptables issue that previously ignored IPv4 state in mixed environments, ensuring more robust traffic interception for all users. We’ve also resolved a significant bug in the tag watcher, which now correctly handles defaultRevision logic, leading to more reliable Kubernetes Gateway programming. This means your gateways will function as expected without unexpected configuration discrepancies. For HTTP/1.x traffic, a subtle but important fix prevents PreserveHttp1HeaderCase from overriding other vital protocol options, maintaining precise control over your traffic. Additionally, we’ve updated the Gateway Helm chart schema to ensure full compatibility with Helm v3.18.5 and beyond, smoothing out installation processes. Numerous dependency updates, including Kubernetes client libraries, further bolster the mesh’s foundational stability. This release focuses on refining existing functionality and ensuring a more predictable and stable Istio experience. ...

📋 Recommended Actions ✅ No Immediate Action Required No immediate action required. Review updates to better support your users, especially if you’re leveraging Kubernetes Gateway API or istioctl proxy-status. 📝 Summary Istio 1.27.1 delivers crucial bug fixes and valuable enhancements, bolstering operational stability and testing capabilities. This release notably improves Kubernetes Gateway API adoption by fixing a tag watcher issue that caused programming failures with revisioned installs. Users of istioctl proxy-status will find a more robust experience as its behavior when no proxies are found has been fixed to prevent breaking external tooling. We’ve also added comprehensive mTLS support to the Echo server, allowing for more detailed and accurate security testing. Core component reliability sees significant boosts with fixes for traffic policy validation (especially retry_budget) and improved istio-iptables logic that correctly handles IPv4/IPv6 states. Dependency updates ensure compatibility and security. These changes collectively enhance Istio’s stability and flexibility, making it even more dependable for your cloud-native deployments. ...

📋 Recommended Actions ✅ No Immediate Action Required No immediate action required. Review these updates to better support your users, especially regarding Gateway API status improvements and Ambient mesh enhancements. 📝 Summary Istio 1.26.3 rolls out important stability and compatibility enhancements across the mesh. This patch release brings significant improvements to Gateway API status reporting, ensuring more reliable and deterministic updates for HTTPRoute resources, even in multi-controller environments. Operations engineers will appreciate the increased clarity and robustness here, simplifying Gateway API management. For Ambient mesh users, this release is critical. It fixes an edge case in CNI pod deletion, preventing orphaned entries in ztunnel and boosts multi-revision deployments with revision-aware configuration filtering for Ambient waypoints. This ensures policies like AuthorizationPolicy are correctly applied based on the Istio revision. Additionally, OpenShift users gain better TProxy compatibility through automated privileged SCC assignment for test environments, addressing a key platform-specific challenge. Internal fixes in Pilot’s telemetry reinitialization and status worker pools further enhance control plane stability. These targeted updates ensure a more resilient and predictable Istio experience for both traditional and Ambient mesh deployments. ...