What istio/istio shipped
Generated by FoxPlug from public activity — not affiliated with Istio.
Week of September 14, 2026
What shipped
- Ambient mode now selects network gateways deterministically by sorting results, preventing repeated WDS pushes when multiple gateways exist per network. Pull request #61748
- Fixed istiod webhook caBundle becoming stale after istio-csr migration, which was causing sidecar injection failures until manual restart. Pull request #61779
- Resolved InferencePool endpoint pickers to be evaluated per backendRef instead of once per HTTPRoute rule, fixing traffic weighting across multiple pools. Pull request #61601
- Fixed DFP wildcard cluster panic when outlierDetection is applied by initializing CommonLbConfig. Pull request #61450
- Added optional timeout mechanism for pilot-agent to wait for the SDS provider's workload identity socket to become ready. Pull request #61524
- Restored skipped EDS check in partial push logic to prevent skippable configs from inadvertently triggering full pushes. Pull request #61811
- Route metadata from VirtualServices is now built once and reused across routes instead of being recreated. Pull request #61822
- Root namespace ProxyConfigs now support selectors for broader configuration applicability. Pull request #61632
- Telemetry image hubs are now configurable to allow pulling from VPC-local registries and reduce network egress costs. Pull request #61698
- Self-discovery cluster can now be resolved outside the sidecar's egress scope from the global service index. Pull request #61145
Why it matters
This week brought fixes for critical issues in ambient mode gateway selection, webhook certificate handling, and traffic routing that were causing production failures and unexpected behavior. Performance improvements in route metadata handling and push optimization reduce unnecessary configuration churn. New features for workload identity timeouts and configurable image hubs address operational needs.
Changelog entry
- ambient: network gateway selection now deterministic, sorted by resource order to prevent repeated WDS pushes Pull request #61748
- istiod: webhook caBundle now updates correctly when switching to external CA providers like istio-csr Pull request #61779
- gateway-api: InferencePool endpoint pickers resolved per backendRef for correct traffic weighting Pull request #61601
- xds: DFP wildcard cluster CommonLbConfig initialized to prevent panics with outlierDetection Pull request #61450
- pilot-agent: configurable timeout for workload identity socket readiness Pull request #61524
- xds: partial push optimization restores skipped EDS check to prevent unintended full pushes Pull request #61811
- routing: VirtualService route metadata now built once and reused across routes Pull request #61822
- config: ProxyConfig selectors now supported in root namespaces Pull request #61632
- telemetry: image hub sources now configurable for cost optimization Pull request #61698
- xds: self-discovery cluster resolution now respects egress scope boundaries Pull request #61145
Istio this week: fixed ambient mode gateway flipping, webhook cert staleness, InferencePool traffic weighting, and added workload identity socket timeouts. Release branch updates rolling out deterministic gateway selection.
Istio shipped critical stability fixes this week. Ambient mode now selects network gateways deterministically, preventing repeated pushes. Fixed webhook certificate staleness after istio-csr migration that broke sidecar injection. InferencePool traffic weighting now correctly evaluates per backend. Added configurable image hubs to reduce network costs. These changes improve reliability across sidecar and ambient deployments.