What istio/istio shipped

Three releases this week: Istio 1.32.0-rc.2, 1.31.4 and 1.30.8. Security fixes for istiod crashes, ambient mTLS strictness and authz header matching are now forward-ported to master and backported to supported branches. istio-cni also warns when cniBinDir looks wrong.

This week Istio published 1.32.0-rc.2 along with patch releases 1.31.4 and 1.30.8. Fixes that were already in the patch releases, including binding the xds proxy cluster id to the authenticated cluster, preserving mesh-wide mTLS strictness in ambient mode, rejecting malformed debug resource names instead of crashing istiod, case-insensitive authorization authority and host header matching, and routing pure SYN packets to istio_tproxy, are now forward-ported to master and cherry-picked or directly picked across supported branches. istio-cni also gained a warning when cniBinDir looks like the wrong directory for the runtime, which previously caused failing sandboxes and leaked IP leases without a clear hint.

Istio 1.32.0-rc.0 and rc.1 are out. Also in: delta CDS waypoint outbound cluster fix, GetPublicKey no longer blocking, istiod honoring a custom taint.name, and krt skipping stale recomputes.

Istio 1.32.0-rc.0 and 1.32.0-rc.1 are available with artifacts for testing. This week also fixed a delta CDS regression where a waypoint received a new route but not the outbound cluster for its backend, made GetPublicKey never block when keys are queued, and made istiod tolerate the configured taint.name so it can schedule onto nodes with a custom taint. Other changes: sidecar AUTO_PASSTHROUGH traffic can be served from the ambient east-west gateway, the krt collection queue skips stale recomputes, a waypoint address collision panic is fixed on master and release-1.32, Gateway API moves to v1.7.0, and compatibility profiles for end-of-life releases are cleaned up.

Releases this week: Istio 1.31.3, 1.30.7, 1.29.10, and 1.32.0-beta.0. Also in: Gateway API v1.7 deps, custom selector labels in the gateway Helm chart, and a fix so istio-cni config changes via Helm apply properly.

This week the project published Istio 1.31.3, 1.30.7, and 1.29.10, along with the 1.32.0-beta.0 release and its artifacts. On the changes side, istio-cni configuration is now updated properly via Helm so config changes take effect, dependencies moved to Gateway API v1.7, and the gateway Helm chart gained support for custom selector labels via.Values.selectorLabels. The distroless chainguard digest was also bumped on release-1.30 and release-1.29 to address the emudhra distrust. Users on supported branches should review the release notes for their line before upgrading.

Istio 1.29.9, 1.30.6 and 1.31.2 are out. This week: golang.org/x/net updated to v0.60.0 for HTTP/2 CVEs, authz method matching is case-insensitive, ServiceEntry now respects send unhealthy endpoints, and istiod no longer panics on waypoint address collisions.

Istio 1.29.9, 1.30.6 and 1.31.2 are released this week. golang.org/x/net was bumped to v0.60.0 across release branches to fix HTTP/2 CVEs. Authorization policy method matching is now case-insensitive, and the ServiceEntry controller now respects the send unhealthy endpoints flags. In ambient mode, istiod no longer panics on a waypoint address collision. Custom SDS configuration can now use ClientTLSSettings.CaCertCredentialName to reference the CA trust bundle independently of ClientTLSSettings.CredentialName. Kind setup can also let Docker allocate the API server port to avoid races when clusters are created in parallel.

This week: xds debug endpoints now need an exact proxyID match; krt memory reduced with a typed index lookup; FetchSorted added; pod removal now keyed on UID; and backports for gateway merging, ListenerSet ports, delta CDS and CSR hardening across 1.29 through 1.32.

This week in the project: the xds debug endpoints now require an exact proxyID match, so a partial id no longer returns config for another proxy in the same namespace. KRT saw memory work, replacing per-Fetch indexFilter closures with a typed lookup struct and adding FetchSorted for deterministic ordering. Pods are now removed from hostAddrSet based on pod UID. Several backports landed across 1.29 through 1.32, including preventing cross-namespace gateway merging under managed gatewayapi, allowing overlapping ListenerSet and Gateway ports, keeping EnvoyFilter referenced-services clusters on delta CDS for filtered gateways, warning on catch-all ServiceEntry addresses, and hardening the k8s CSR path with opaque errors, context timeout and a TTL cap.

Istio ships AuthorizationPolicy targeting HTTPRoute, configurable sidecar injection revision precedence, and several performance optimizations for route generation and RDS caching.

This week Istio adds support for AuthorizationPolicy to target HTTPRoute resources for RBAC rules, introduces configurable revision label precedence for sidecar injection, and delivers performance improvements including RDS cache lookup optimization and reduced TypedConfig unmarshalling in EnvoyFilter patches. Several bug fixes address gateway dependency filtering and service entry failover issues.

This week: switched workload/service collections to pointers for better query efficiency, fixed EDS debounce concurrent initialization, added K8s client deadlines for reliability, and optimized KRT allocations and TCP config precomputation for large-scale deployments.

Istio's latest updates focus on performance and reliability at scale. Key improvements include converting workload and service collections to pointers for more efficient xDS queries in large meshes, optimizing memory allocations in KRT event handling, precomputing TCP configurations to reduce CPU spikes, and adding context deadlines to all Kubernetes client operations to handle networking failures gracefully. These changes particularly benefit operators managing large deployments.

Istio this week: fixed ambient mode gateway flipping, webhook cert staleness, InferencePool traffic weighting, and added workload identity socket timeouts. Release branch updates rolling out deterministic gateway selection.

Istio shipped critical stability fixes this week. Ambient mode now selects network gateways deterministically, preventing repeated pushes. Fixed webhook certificate staleness after istio-csr migration that broke sidecar injection. InferencePool traffic weighting now correctly evaluates per backend. Added configurable image hubs to reduce network costs. These changes improve reliability across sidecar and ambient deployments.