Upgrade

📋 Recommended Actions ⚠️ Action Required Immediate patching required to address critical stability issues in Ambient Mode, Kubernetes Gateway API, and Multicluster deployments. 📝 Summary Istio 1.29.5 lands with crucial bug fixes that significantly bolster the stability of your mesh. This release tackles a critical issue in Ambient Mode where enrolled pods could drop from the host health-probe ipset, leading to broken health checks after node restarts. We’ve also resolved a major traffic outage scenario during Kubernetes Gateway API canary upgrades, ensuring smoother transitions when changing istio.io/rev labels. For multicluster users, a panic (close of closed channel) from rapid kubeconfig secret updates is now fixed, enhancing resilience. Additionally, a memory leak within the KRT controller framework has been patched, preventing gradual memory growth. These targeted fixes are essential for maintaining robust and predictable service mesh operations. Upgrade now to secure these vital stability improvements. ...

📋 Recommended Actions ✅ No Immediate Action Required No immediate action required. Review updates, especially for Ambient Mesh and Gateway API users, to better support your users and leverage new security features. 📝 Summary Istio 1.30.2 arrives with a bundle of important bug fixes and a powerful new security feature, significantly enhancing the mesh’s robustness and operational control. This release introduces AuthorizationPolicy trust domains, allowing granular security policies based on the peer certificate’s trust domain. This is a crucial addition for fine-grained access control, enabling users to match or exclude requests from specific trust boundaries.A significant stability improvement comes for Ambient Mesh users with a fix addressing pods that could lose host health-probe IPSet entries after node or kubelet restarts. This change prevents broken probes and ensures more reliable health checks. Gateway API users will benefit from a fix resolving brief traffic outages experienced during canary upgrades when changing istio.io/rev labels on Gateways, ensuring smoother, disruption-free transitions.For better resource management, a memory leak in the KRT controller framework has been patched, leading to more stable memory usage and preventing unnecessary recomputations. Telemetry also sees an update: pilot-agent now correctly handles Prometheus content types by excluding protobuf and offers a new environment variable to disable merging Envoy stats if desired. Improved warning messages for outdated Gateway API CRDs provide clearer guidance. These updates collectively strengthen Istio’s security, stability, and overall operational experience. ...

📋 Recommended Actions ⚠️ Action Required Immediate patching is highly recommended to address critical security vulnerabilities related to authorization bypasses. Operations engineers should review the updated Ambient Mesh configurations for AWS deployments and consider tuning HBONE window sizes for performance. Review istioctl analyze output for new JWKS URI security warnings. 📝 Summary Istio 1.29.3 lands with crucial security fixes, fortifying your mesh against potential bypasses. This release tackles an authorization policy regex vulnerability, ensuring principal and namespace matching behaves as intended. It also tightens XDS debug endpoint access, preventing cross-namespace information exposure for non-system callers. Plus, leaf certificates now respect CA validity, preventing expired cert usage. AWS EKS users with Security Groups for Pods get a critical fix for kubelet health probe failures in Ambient Mesh, ensuring smoother operations. We’ve also added configurable HTTP/2 window sizes for HBONE, offering fine-tuned performance. Tooling improves with a new istioctl analyze warning for JWKS URI security, better handling of Helm webhook failurePolicy during upgrades, and enhanced proxy resource injection for null values. Several core bug fixes, including a multicluster secret controller deadlock and robust Kubernetes secret rotation, contribute to overall stability. ...