Istio 1.19 Upgrade Notes

When you upgrade from Istio 1.18.x to Istio 1.19.x, you need to consider the changes on this page. These notes detail the changes which purposefully break backwards compatibility with Istio 1.18.x. The notes also mention changes which preserve backwards compatibility while introducing new behavior. Changes are only included if the new behavior would be unexpected to a user of Istio 1.18.x.

Use the canonical filter names for EnvoyFilter

If you are using EnvoyFilter API, please use canonical filter names. The use of deprecated filter name is not supported. See the Envoy documentation for further details.

base Helm Chart removals

A number of configurations previously present in the the base Helm chart were copied to the istiod chart in a previous releases.

In this release, the duplicated configurations are fully removed from the base chart.

Below shows a mapping of old configuration to new configuration:

Note: most resources have a suffix automatically added in addition. In the old chart, this was -{{ .Values.global.istioNamespace }}. In the new chart it is {{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }} for namespace scoped resources, and {{- if not (eq .Values.revision "")}}-{{ .Values.revision }}{{- end }}-{{ .Release.Namespace }} for cluster scoped resources.

EnvoyFilter must specify the type URL for an Envoy extension injection

Previously, Istio permitted a lookup of the extension in EnvoyFilter by its internal Envoy name alone. To see if you are affected, run istioctl analyze and check for a deprecation warning using deprecated types by name without typed_config. Additionally, make sure any nested extension lists inside EnvoyFilter include both name: and typed_config: fields.

Gateway API: Service-attached parentRefs must specify empty group

As a result of updates to the Gateway API conformance tests, Istio will no longer accept the default group of gateway.networking.k8s.io for a Service parentRef in a Gateway API route (e.g. HTTPRoute, TCPRoute, etc). Instead, you must explicitly set group: "" like so:

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: productpage
spec:
  parentRefs:
  - group: ""
    kind: Service
    name: productpage
    port: 9080