WasmPlugin

📋 Recommended Actions ✅ No Immediate Action Required No immediate action required. Review updates, especially for Ambient Mesh and Gateway API users, to better support your users and leverage new security features. 📝 Summary Istio 1.30.2 arrives with a bundle of important bug fixes and a powerful new security feature, significantly enhancing the mesh’s robustness and operational control. This release introduces AuthorizationPolicy trust domains, allowing granular security policies based on the peer certificate’s trust domain. This is a crucial addition for fine-grained access control, enabling users to match or exclude requests from specific trust boundaries.A significant stability improvement comes for Ambient Mesh users with a fix addressing pods that could lose host health-probe IPSet entries after node or kubelet restarts. This change prevents broken probes and ensures more reliable health checks. Gateway API users will benefit from a fix resolving brief traffic outages experienced during canary upgrades when changing istio.io/rev labels on Gateways, ensuring smoother, disruption-free transitions.For better resource management, a memory leak in the KRT controller framework has been patched, leading to more stable memory usage and preventing unnecessary recomputations. Telemetry also sees an update: pilot-agent now correctly handles Prometheus content types by excluding protobuf and offers a new environment variable to disable merging Envoy stats if desired. Improved warning messages for outdated Gateway API CRDs provide clearer guidance. These updates collectively strengthen Istio’s security, stability, and overall operational experience. ...

📋 Recommended Actions ⚠️ Action Required Immediate upgrade to Istio 1.28.5 is strongly recommended for all users due to critical security patches addressing JWT forgery, XDS debug endpoint authentication bypasses, and WasmPlugin SSRF vulnerabilities. Review changes to XDS debug endpoints if you rely on unauthenticated plaintext access, as this behavior now requires explicit configuration or authentication. 📝 Summary Istio 1.28.5 lands with crucial security updates and significant enhancements across the mesh. This release patches a critical vulnerability where Istio’s JWT authentication fallback mechanism could leak a private key, enabling attackers to forge tokens. A high-severity fix now secures XDS debug endpoints (like syncz and config_dump), preventing unauthenticated access on plaintext ports. Additionally, WasmPlugin image fetching is fortified with SSRF protection, closing another potential attack vector. Beyond security, the Gateway API sees improvements, specifically addressing issues where InferencePool configurations were lost during VirtualService merges. Ambient Mesh deployments get smarter port discovery for native sidecars, ensuring correct inbound listener configuration, and gain new flexibility with a ZtunnelNamespace flag. These updates combine critical fixes with valuable operational improvements, making 1.28.5 a vital upgrade for a more secure and robust service mesh. ...