Istio 1.30.0 Change Notes
Istio 1.30.0 release notes.
Traffic Management
Improved endpoint selection for multi-network environments to use the gateway for network-specific endpoints when the local proxy network is unset.
Improved sidecar proxy service namespace selection. When configuring sidecar proxies, if a hostname exists in multiple namespaces, Istio now prefers Kubernetes services and falls back to the oldest non-Kubernetes service (e.g.
ServiceEntry) by creation time. Previously, the first visible namespace alphabetically was chosen.Added opt-in synthesis of
x-forwarded-client-certat ambient waypoints. Setting the annotationambient.istio.io/xfcc-include-client-identity: "true"on a waypointGateway(or itsGatewayClass) causes the waypoint to overwrite XFCC on forwarded requests with an entry populated from the ztunnel-provided source workload SPIFFE identity, so upstream apps can see the originating client. Any inbound XFCC value is replaced. Waypoints without the annotation are unaffected. (Issue #54995)Added support for
TLSRoutetermination and mixed mode. (Issue #55728)Added
PILOT_GATEWAY_TRANSPORT_SOCKET_CONNECT_TIMEOUTenvironment variable to configure the transport socket connect timeout on gateway listeners. The default remains 15 seconds. Set to0sto disable the timeout for workloads that require longer TLS handshake times. (Issue #56320)Added HTTP compression capability (
gzip,zstd) to the HTTP server of pilot-agent. (Issue #58697)Added input validation for
traffic.sidecar.istio.io/excludeInterfacesannotation to ensure only valid Linux interface names are accepted, preventingiptablesparameter injection. (Issue #58781)Added support for loading multicluster remote secrets from a local filesystem path specified by
PILOT_MULTICLUSTER_KUBECONFIG_PATH. When set, Istiod watches the mounted directory (for.yamlor.ymlkeys) and dynamically updates remote cluster registrations. If bothPILOT_MULTICLUSTER_KUBECONFIG_PATHandLOCAL_CLUSTER_SECRET_WATCHERare set,PILOT_MULTICLUSTER_KUBECONFIG_PATHtakes precedence. (Issue #58927)Added experimental support for agentgateway in Istio. Agentgateway configuration can be enabled through the
PILOT_ENABLE_AGENTGATEWAYfeature flag. Istio supports agentgateway configuration via the Gateway API resources. (Issue #59209)Added CIDR address support for
ServiceEntryin ambient mode.ServiceEntrieswith CIDR addresses (e.g.,10.0.0.0/24) are now propagated to ztunnel, enabling longest-prefix-match routing for traffic destined to IP ranges. (Issue #59797)Added the ability to configure initial HTTP/2 stream and connection window sizes for HBONE CONNECT upstream clusters (generated for waypoints and east-west gateways) via feature flags
PILOT_HBONE_INITIAL_STREAM_WINDOW_SIZEandPILOT_HBONE_INITIAL_CONNECTION_WINDOW_SIZE. These may be used to reduce unwanted buffering. (Issue #59961)Added an
istio.io/connect-strategyannotation toServiceEntriesto allow different DNS connection semantics. Users can set this toRACE_FIRST_TCP_CONNECTwhen DNS servers return multiple A records and the client should test each endpoint and pick the first one that results in a successful TCP connection. (Issue #59083)Added failover priority support for DNS clusters. (Issue #58674)
Added configurable DNS upstream timeout via
DNS_FORWARD_TIMEOUTenvironment variable. The default timeout remains 5 seconds. Users can increase the timeout for high-latency DNS servers or decrease it to reduce user-impacting latency when DNS servers are unresponsive (fail faster to try next server sooner). Set viaDNS_FORWARD_TIMEOUT=10sin theistio-proxycontainer or mesh-wide viaproxyMetadata. (Issue #59813)Added support for TLS passthrough listeners on east-west gateways, allowing non-HBONE ports to be exposed via the Gateway API (e.g., to route traffic to the Kubernetes API server across network boundaries). This requires
AMBIENT_ENABLE_MULTI_NETWORKto be enabled. (Issue #59223)Added namespace-level traffic distribution annotation. Services inherit traffic distribution from the namespace annotation when not explicitly set on the service. (Issue #58701)
Added
DYNAMIC_DNSwildcardServiceEntrysupport for sidecar proxies for bothMESH_INTERNALandMESH_EXTERNALlocations. Enables L7 HTTP routing (via Host header) and L4 TLS routing (via SNI) with observability for wildcard hosts (e.g.,*.example.com) in traditional sidecar mode. Note that it is possible to spoof SNI for TLS connections that match the wildcard host. E.g. a client connecting tofoo.example.comcould connect viaServiceEntry*.example.comwhile having SNI set tobar.example.com. (Issue #58244)Added
TrafficExtensionAPI to the extensions package, enabling first-class support for Lua extensibility.Enabled
protocol: TLSGateway listeners by default. Gateway listeners withprotocol: TLS(used for TLS passthrough viaTLSRoute) are now accepted without requiringPILOT_ENABLE_ALPHA_GATEWAY_API=true, sinceTLSRoutegraduated to GA in Gateway APIv1.5.0.Fixed an issue preventing the usage of Kubernetes User Namespaces (
hostUsers: false) pods together with istio-cni. Support is limited to operating systems with thensenterbinary. (Issue #58750)Fixed Gateway API CORS handling: properly parse the
Originheader when wildcard origins are used, ignore unmatched preflights, and apply stricterOriginheader parsing overall. (Issue #59018, Issue #59026)Fixed an issue where waypoints failed to add the TLS inspector listener filter when only TLS ports existed, causing SNI-based routing to fail for wildcard
ServiceEntryresources withresolution: DYNAMIC_DNS. (Issue #59024)Fixed error wrapping in file-based config store to use
%wverb, enabling proper error chain propagation witherrors.Is()anderrors.As(). (Issue #59078)Fixed Gateway API
tls.Options[gateway.istio.io/tls-terminate-mode]to properly override TLS mode afterCACertificateRefsprocessing. (Issue #59098)Fixed a nil pointer dereference in
ServiceEntryvalidation forDYNAMIC_DNSresolution that could crash istiod. (Issue #59171)Fixed
cniagent behavior to respectexcludeNamespacesconfig so that behavior is consistent between the plugin and agent. (Issue #59295)Fixed istiod crashing when
PILOT_ENABLE_AMBIENT=truebutAMBIENT_ENABLE_MULTI_NETWORKis not set and aWorkloadEntryresource exists with a different network than the local cluster. (Issue #59321)Fixed an issue preventing multi-cluster waypoint routing with single network (no east-west gateway). (Issue #58133)
Fixed an issue where an
HTTPRoutewith nobackendRefsreturned an HTTP 500 status code instead of the expected 404. Per the Gateway API specification, routes without any backend references should return 404, while routes with backend references that all have zero weight should return 500. (Issue #59356)Fixed multi-cluster installations trying to validate the wrong trust domain when the control plane does not have an updated
istio-readerClusterRole, failing to read the trust domain from the remoteConfigMap. Now, istiod will fall back to using the trust domain specified in the local mesh config until it can read the remote one. (Issue #59474)Fixed applying multiple
VirtualServiceresources for the same hostname to waypoints. (Issue #59483)Fixed a bug where E/W gateway occasionally routed HBONE connections to a wrong service due to incorrect connection pooling in Envoy. (Issue #58630)
Fixed gateway deployment controller rejecting
DaemonSetkind during reconciliation. (Issue #59498)Fixed an issue where all
Gatewayswere restarted after istiod was restarted. (Issue #59709)Fixed kubelet health probe failures for ambient mesh pods on AWS EKS when using Security Groups for Pods (branch ENI). istio-cni now detects branch ENI pods and adds IP rules to route probe traffic via the veth pair instead of VPC fabric. Gated behind
AMBIENT_ENABLE_AWS_BRANCH_ENI_PROBE(enabled by default).Fixed istiod pushing unreachable IPv6 gateway endpoints to IPv4-only proxies (and vice versa) in multi-network meshes with dualstack east-west gateway load balancers.
Fixed a race condition that caused a panic when
HTTPRouteswere added then immediately removed. This could occur when a user applied anHTTPRoute, then deleted it before the controller had a chance to process it.Fixed an issue preventing
HTTPRouteandGRPCRoutefrom coexisting on the same gateway hostname without conflicts. (Issue #59222)Fixed
GetAllAddressesForProxyreturning unreachable service addresses to proxies when theDefaultAddressIP family does not match the proxy’s supported IP family.Fixed
ReferenceGranttofield to handle multiple entries; previously only the last entry was effective, causing incorrectRefNotPermittedfor references that matched an earlier entry.Fixed status reporting for
GatewayandListenerSetresources to comply with the Gateway API specificationv1.5.0. It changesGatewaystatus reporting to include the number ofListenerSetsin theAttachedListenerSetsfield of theGatewayresource, instead of the number of Listeners. It also changes status reporting forListenerSetsto report the number of routes attached to each listener in theListenerSet.Fixed a bug where the default
percentforretryBudgetinDestinationRulewas incorrectly set to 0.2% instead of the intended 20%. (Issue #59504)Fixed a bug where
retryBudgetset in aDestinationRule’s top-leveltrafficPolicywas silently dropped when the destination also had a subset with its owntrafficPolicy. Additionally, theretryBudgetdefined at the subset level was also ignored. (Issue #59667)Fixed stale
status.addressesnot being cleared when aServiceEntryis updated such that it no longer qualifies for IP auto-allocation. (Issue #58974)Fixed a race condition that caused intermittent “proxy::h2 ping error: broken pipe” error logs. (Issue #59192),(Issue #1346)
Security
Added support for multiple CUSTOM authorization providers per workload, enabling different authentication schemes (OAuth, LDAP, API keys) for different API paths. (Issue #57933),(Issue #55142),(Issue #34041)
Added the ability to specify authorized namespaces for debug endpoints when
ENABLE_DEBUG_ENDPOINT_AUTH=true. Enable by settingDEBUG_ENDPOINT_AUTH_ALLOWED_NAMESPACESto a comma-separated list of authorized namespaces. The system namespace (typicallyistio-system) is always authorized.Fixed incorrect mapping of
meshConfig.tlsDefaults.minProtocolVersiontotls_minimum_protocol_versionin the downstream TLS context. (Issue #58912)Fixed
serviceAccountmatcher regex inAuthorizationPolicyto properly quote the service account name, allowing for correct matching of service accounts with special characters in their names. (CVE-2026-39350) (Issue #59700)Credit: This vulnerability was discovered and reported by Wernerina (https://github.com/Wernerina).
Fixed an issue where Istiod could issue leaf certificates with a
NotAftertime beyond the signing certificate’s expiration. (Issue #59768)Fixed an authorization bypass in
AuthorizationPolicymatching for SPIFFE identities and namespaces. Regex metacharacters in fields likesource.principals(suffix matching) andsource.namespaceswere not properly escaped in the generated Envoy configuration, potentially allowing unintended identities to match policy rules. (Issue #59992)Credit: This vulnerability was discovered and reported by Alex (https://github.com/Alex0Young).
Fixed a bug where CA bundle rotation would not occur when certificates appeared in different orders. Only standard
CERTIFICATEPEM blocks are considered during comparison; other block types (e.g.,TRUSTED CERTIFICATE) are ignored, consistent with existing CA bundle handling in Istio. (Issue #59909)Fixed a critical security vulnerability where Istio’s JWKS fallback mechanism leaked an RSA private key, allowing attackers to forge JWT tokens and bypass authentication when JWKS fetch fails. See CVE-2026-31837 for details. (Advisory GHSA-v75c-crr9-733c)
Credit: This vulnerability was discovered and reported by 1seal (https://github.com/1seal).
Fixed JWKS URI CIDR blocking by using a custom control function in a custom
DialContext. The control function filters connections after DNS resolution but before dialing, allowing the block to follow redirects and the issuer discovery path. This also preserves features in the defaultDialContextlike happy eyeballs anddialSerial(trying each resolved IP in order). (CVE-2026-41413)Credit: This vulnerability was discovered and reported by KoreaSecurity (https://github.com/KoreaSecurity), 1seal (https://github.com/1seal), and AKiileX (https://github.com/AKiileX).
Fixed XDS debug endpoints (
syncz,config_dump) to require authentication. Previously accessible without authentication on plaintext XDS port 15010. Controlled byENABLE_DEBUG_ENDPOINT_AUTH(same flag as HTTP debug endpoints). (CVE-2026-31838)Credit: This vulnerability was discovered and reported by 1seal (https://github.com/1seal).
Fixed XDS debug endpoints (
istio.io/debug/syncz,istio.io/debug/config_dump) served byStatusGento enforce same-namespace authorization for non-system callers. Previously an authenticated workload from any namespace could enumerate proxies and retrieve config dumps for workloads in other namespaces.Credit: This vulnerability was discovered and reported by 1seal (https://github.com/1seal).
Fixed potential SSRF in
WasmPluginimage fetching by validating bearer token realm URLs.Credit: This vulnerability was discovered and reported by Sergey Kanibor at Luntry (https://github.com/r0binak).
Fixed missing
ReadHeaderTimeoutandIdleTimeouton the istiod webhook HTTPS server (port 15017), aligning it with the existing timeouts on the HTTP server (port 8080).Fixed XDS debug endpoint to pass caller namespace for proper authorization checks.
Telemetry
Added support for
app.kubernetes.io/nameandservice.istio.io/canonical-namelabels when populatingsource_appanddestination_appmetric labels. The priority order is:app(for backward compatibility), thenapp.kubernetes.io/name, thenservice.istio.io/canonical-name. This allows users who only haveapp.kubernetes.io/namelabels to have their metrics properly populated. (Issue #58436)Added
disableContextPropagationfield to the Telemetry Tracing API, allowing users to disable trace context header propagation (e.g.,X-B3-*,traceparent) independently from span reporting. This is useful for preventing trace context leakage at egress gateways while maintaining internal observability. (Issue #58871)Added support for OpenTelemetry semantic convention-aligned service attribute enrichment for trace spans. When
serviceAttributeEnrichment: OTEL_SEMANTIC_CONVENTIONSis set on theOpenTelemetryTracingProviderinMeshConfig,service.nameis computed following the OTel K8s service attributes specification fallback chain. Additionally,service.namespace,service.version, andservice.instance.idare injected asOTEL_RESOURCE_ATTRIBUTESon the sidecar at injection time, and the Environment resource detector is auto-enabled so Envoy picks up these attributes at startup. (Issue #55026)Added a Resource Usage panel to the Ztunnel Grafana dashboard overlaying active TCP connections, open file descriptors, and open sockets per instance.
Fixed an issue where baggage-based peer metadata discovery interfered with TLS or PROXY traffic policies. As a short-term fix we disable baggage-based metadata discovery for routes with TLS or PROXY traffic policies configured, which may result in incomplete telemetry in multicluster deployments. We are working on addressing this limitation in future releases. (Issue #59117)
Extensibility
Added support for configuring the Wasm binary size limit via the
ISTIO_WASM_MAX_BINARY_SIZE_BYTESenvironment variable. (Issue #59322)Fixed missing size limit on gzip-decompressed WASM binaries fetched over HTTP, consistent with the limits already applied to other fetch paths.
Installation
Added value
useAppArmorAnnotationto istio-cni Helm chart. Defaults totrue. When it istrue, appArmor profile is set withcontainer.apparmor.security.beta.kubernetes.ioannotation (deprecated in Kubernetes 1.30). Otherwise,appArmorProfilefield insecurityContextis used. (Issue #54721)Added
values.global.enableReaderRBAC(default:true) to control installation ofistio-reader-service-accountand its relatedistio-readerClusterRole/ClusterRoleBindingfor multicluster remote-secret workflows. Set it tofalseto disable installing these resources. When installing with Helm, setglobal.enableReaderRBAC=falseon both the base and istiod charts, since theServiceAccountis rendered by the base chart while the relatedClusterRole/ClusterRoleBindingare rendered by theistiodchart. (Issue #56326)Added Helm v4 (server-side apply) support. Fixed a webhook
failurePolicyfield ownership conflict that causedhelm upgradewith SSA to fail. (Issue #58302),(Issue #59367)Added configurable port overrides for the network gateway service via
networkGatewayPortsvalues. (Issue #59072)Added template validation to fail early when
service.portsis empty andnetworkGatewayis not set. (Issue #59072)Added logging of configuration analysis warnings and errors in istiod logs for all Istio resource types (
DestinationRule,EnvoyFilter,Sidecar, etc.), so operators no longer need to inspect individual resource status fields to discover misconfigurations. (Issue #59105)Added
WaypointBoundstatus condition toWorkloadEntryresources, reporting whether the workload is successfully attached to its waypoint proxy or if there was an error binding. (Issue #59993)Added
--tls-min-versionflag topilot-discoveryto configure the minimum TLS version for the istiod server and webhook. Supported values are1.2(default) and1.3. (Issue #58789)Added
registry.istio.ioas the default registry for Istio images.Added
dnsPolicyanddnsConfigfields to the ztunnel Helm chart for custom DNS configuration in environments with non-standard DNS requirements.Fixed CNI config file permissions to default to 0600 instead of 0644 for CIS Kubernetes benchmark
v1.12compliance. Group read access can be enabled by settingvalues.cni.env.CNI_CONF_GROUP_READ=trueenvironment variable on the istio-cni-nodeDaemonSet, which sets permissions to 0640. (Issue #59071)Fixed a nil pointer dereference that occurred during the upgrade process in a multi-primary deployment. (Issue #59153)
Fixed an issue where setting resource limits or requests to
nullwould cause validation errors (cpu request must be less than or equal to cpu limit of 0). This affected proxy injection, gateway generation, and Helm chart deployments. (Issue #58805)Fixed missing
PILOT_ENABLE_NODE_UNTAINT_CONTROLLERSenvironment variable inistioddeployment when enabling the untaint controller. (Issue #52050)Fixed unnecessary Helm reconciliations caused by
from: []inNetworkPolicyingress rules.Fixed a field manager conflict on
ValidatingWebhookConfigurationduringhelm upgradewith server-side apply in tools that respect.Release.IsUpgrade(Helm 4, Flux). ThefailurePolicyfield is now omitted from the webhook template on upgrade, preserving the value set at runtime by the webhook controller. For tools that usehelm templatewith SSA, setbase.validationFailurePolicy: Failto avoid the conflict.
istioctl
Improved the
istioctl bug-reportcommand’s performance.Added
--skip-cluster-dump,--skip-analyze,--skip-proxy-debug,--skip-netstat, and--skip-coredumpsflags to theistioctl bug-reportcommand to allow skipping expensive sections of the report.Fixed log fetching with support for include and exclude filtering for pod selection.
Added
--tailflag to set the maximum number of log lines to fetch per container. The default is still unlimited.Updated minimum supported Kubernetes version to
1.32.x.Added port validation to
istioctlcommands to prevent invalid values outside the 1-65535 range. (Issue #58584)Added support for
istioctl proxy-status -oyaml/jsonto list proxy status of a single namespace. (Issue #59377)Added an
istioctl analyzewarning (IST0175) whenRequestAuthenticationresources exist butBLOCKED_CIDRS_IN_JWKS_URISis not configured on istiod. (Issue #59523)Added JSON and YAML output options to the
istioctl proxy-statussubcommand. (Issue #56880)Added support for filtering
istioctl ztunnel-config workloadandistioctl ztunnel-config connectionsoutput by workload pod name.Fixed an issue where
istioctlfalsely reported an error onEnvoyFilterwithREPLACEoperation onVIRTUAL_HOST. (Issue #59495)Fixed a sorting bug in
istioctl ztunnel-config connectionswhich caused the output sorting to be non-deterministic. (Issue #59775)Fixed an issue where
istioctl ztunnel-config serviceJSON and YAML output did not include thecanonicalfield from the ztunnel config dump. (Issue #59962)Fixed an issue where
istioctl ztunnel-config serviceJSON and YAML output did not includecidrVipsfrom the ztunnel config dump. (Issue #59962)Fixed an issue where the distroless
istioctlcontainers were being built with the wrong base image.
Documentation changes
- Updated the location of the Gateway API Inference Extension documentation; it is now in the architecture section. (Issue #56948)