1 Release published by 1 person

• 1.21.6 Istio 1.21.6

  published Sep 23, 2024

49 Pull requests merged by 15 people

• Fix description of TestGetAllAddresses tests

  #53338 merged Sep 29, 2024

• Ambient: fix incorrect dualstack EDS with tunnelling

  #52984 merged Sep 29, 2024

• convert httpbin to go-based

  #53315 merged Sep 28, 2024

• Automator: update proxy@master in istio/istio@master

  #53340 merged Sep 28, 2024

• Automator: update proxy@master in istio/istio@master

  #53330 merged Sep 27, 2024

• Automator: update proxy@release-1.23 in istio/istio@release-1.23

  #53334 merged Sep 27, 2024

• Automator: update proxy@master in istio/istio@master

  #53328 merged Sep 27, 2024

• Automator: update proxy@release-1.23 in istio/istio@release-1.23

  #53327 merged Sep 27, 2024

• Automator: update istio/client-go@master dependency in istio/istio@master

  #53317 merged Sep 26, 2024

• [release-1.22] cherry-pick 1.22 patch commit

  #53255 merged Sep 26, 2024

• [release-1.23] cherry-pick 1.23 patch commits

  #53254 merged Sep 26, 2024

• Reduce ambient flakes in TestServiceDynamicEnroll 2

  #53314 merged Sep 26, 2024

• Automator: update proxy@master in istio/istio@master

  #53312 merged Sep 26, 2024

• Reduce ambient flakes in TestServiceDynamicEnroll

  #53310 merged Sep 26, 2024

• Automator: update ztunnel@release-1.21 in istio/istio@release-1.21

  #53311 merged Sep 26, 2024

• minor optimization in route patch matching

  #53309 merged Sep 26, 2024

• Donot set statusQueue when disabled

  #53303 merged Sep 26, 2024

• enable dns server on gateways

  #53286 merged Sep 26, 2024

• [release-1.23] Fix httpbin sample's command

  #53299 merged Sep 26, 2024

• inject log with labels

  #53283 merged Sep 26, 2024

• minor optimize: reduce growth and gc

  #53282 merged Sep 26, 2024

• Automator: update istio/client-go@release-1.21 dependency in istio/istio@release-1.21

  #53301 merged Sep 26, 2024

• Automator: update proxy@release-1.21 in istio/istio@release-1.21

  #53257 merged Sep 26, 2024

• simplify DeepCopy implementation

  #53285 merged Sep 26, 2024

• Automator: update common-files@release-1.21 in istio/istio@release-1.21

  #53300 merged Sep 26, 2024

• Automator: update proxy@master in istio/istio@master

  #53272 merged Sep 26, 2024

• [release-1.21] Fix httpbin sample's command

  #53297 merged Sep 25, 2024

• iptables: always use restore format

  #53066 merged Sep 25, 2024

• Fix httpbin sample's command

  #53287 merged Sep 25, 2024

• optimize service with listener port

  #53281 merged Sep 25, 2024

• Move some things out of base that are just istiod bits

  #53016 merged Sep 25, 2024

• Fix the missing kind error

  #53275 merged Sep 25, 2024

• update proxy

  #53274 merged Sep 25, 2024

• Add test cases for ParseIdentity function

  #53261 merged Sep 25, 2024

• Automator: update proxy@release-1.22 in istio/istio@release-1.22

  #53276 merged Sep 25, 2024

• Automator: update ztunnel@master in istio/istio@master

  #53273 merged Sep 25, 2024

• Automator: update istio/client-go@master dependency in istio/istio@master

  #53267 merged Sep 24, 2024

• helm: make defaults user proof

  #53067 merged Sep 24, 2024

• istioctl: Optimize the json format output of envoy-stats command

  #53242 merged Sep 24, 2024

• Automator: update proxy@master in istio/istio@master

  #53268 merged Sep 24, 2024

• Automator: update common-files@master in istio/istio@master

  #53266 merged Sep 24, 2024

• addon: modify kiali version

  #53265 merged Sep 24, 2024

• enable dualstack on services created by Gateway API

  #53245 merged Sep 24, 2024

• Automator: update proxy@master in istio/istio@master

  #53264 merged Sep 24, 2024

• Automator: update proxy@release-1.23 in istio/istio@release-1.23

  #53263 merged Sep 24, 2024

• Automator: update ztunnel@master in istio/istio@master

  #53256 merged Sep 24, 2024

• feat(helm): custom annotations for sidecarInjectorWebhook

  #53215 merged Sep 23, 2024

• Bump Kiali to 1.89.3

  #53251 merged Sep 23, 2024

• Automator: update proxy@master in istio/istio@master

  #53250 merged Sep 23, 2024

18 Pull requests opened by 11 people

• Fix gateway injection when using SPIRE

  #53252 opened Sep 23, 2024

• control service and policy tracing tags via a feature flag

  #53259 opened Sep 24, 2024

• [release-1.22] monitoring: move to OTEL sync gauge

  #53293 opened Sep 25, 2024

• [WIP] Remove `istiod-remote` chart in favor of a `remote` profile for `istio-discovery`

  #53294 opened Sep 25, 2024

• ambient status: add leader election

  #53296 opened Sep 25, 2024

• [release-1.22] Fix httpbin sample's command

  #53298 opened Sep 25, 2024

• Added support for bytes buffer pool

  #53305 opened Sep 26, 2024

• Default to always templating CRDs in the `base` chart.

  #53318 opened Sep 26, 2024

• fix `istioctl analyze` attempts to retrieve unnecessary resources during multi-cluster detection

  #53321 opened Sep 27, 2024

• Add retry with timeout for TestGatewayAPIRequestAuthentication

  #53322 opened Sep 27, 2024

• fix `istio install` output incorrect version

  #53324 opened Sep 27, 2024

• Bump gateway to rc2

  #53329 opened Sep 27, 2024

• Automator: update proxy@release-1.22 in istio/istio@release-1.22

  #53336 opened Sep 28, 2024

• add cert to xfcc header for sidecar

  #53337 opened Sep 28, 2024

• istioctl: add revision shortcode for analyze

  #53339 opened Sep 28, 2024

• Automator: update proxy@master in istio/istio@master

  #53343 opened Sep 29, 2024

• Update func TestNamespaceControllerWithDiscoverySelectors

  #53347 opened Sep 30, 2024

• minor optimize: use efficient string split func

  #53348 opened Sep 30, 2024

27 Issues closed by 11 people

• Create architecture doc for Istio CA

  #46852 closed Sep 30, 2024

• Dual stack mode does not support SE selecting Pod with dual stack IP

  #53333 closed Sep 29, 2024

• Service defined on port 80 causes VS cannot capture traffic with specific host

  #49673 closed Sep 29, 2024

• two threads, one thread has few 401 errors until becomes 200 when a new kid is added to the jwks file for the first time

  #51581 closed Sep 28, 2024

• opentelemetry tracing bug: status code not set for gRPC

  #53025 closed Sep 27, 2024

• Istio annotation networking.istio.io/service-type is not recognized

  #51575 closed Sep 27, 2024

• Gateway API: no validation of RegularExpression in HTTPRoute

  #49993 closed Sep 27, 2024

• Support `ISTIO_META_POD_PORTS` in `ServiceEntry` service registry controller

  #49926 closed Sep 27, 2024

• Request for Configurable Timeout Parameters in Istio Resources

  #49247 closed Sep 27, 2024

• [Ambient] ztunnel, istio-cni-node - Readiness probe failed: HTTP probe failed with statuscode: 503

  #52487 closed Sep 26, 2024

• Forward destination_service from source proxy

  #33940 closed Sep 26, 2024

• [release-1.23] monitoring: move to OTEL sync gauge

  #53292 closed Sep 25, 2024

• Bring Istio Operator EOL policy to the Operator readme

  #53244 closed Sep 25, 2024

• Ubuntu 24.04 + Vanilla k8s + Calico + 1.23 Ambient - istio-cni failing to start on 2/3 nodes

  #52804 closed Sep 25, 2024

• Help request: HTTP2 Ingress

  #53235 closed Sep 25, 2024

• Patch version Istio 1.23.x not support K8s 1.31

  #53231 closed Sep 25, 2024

• Helm profiles confusing users to put their own config under `defaults`

  #51458 closed Sep 24, 2024

• defaults.global.hub does not affect ztunnel

  #53018 closed Sep 24, 2024

• FIPS Compliance with COMPLIANCE_POLICY ENV variable

  #53262 closed Sep 24, 2024

• Installed istio cni mode service failed to start

  #53169 closed Sep 24, 2024

• Setting ENABLE_AUTO_SNI to "false" dosen't work as expected

  #53186 closed Sep 24, 2024

• Dynamic routing based on an header injected by external authorization

  #53246 closed Sep 24, 2024

• Istio Sidecar goes to CrashLoopBackOff state, if a jwk entry has no valid public keys

  #51489 closed Sep 24, 2024

• Multiple ServiceEntries with the same host cause traffic to be blackholed

  #51466 closed Sep 24, 2024

• ambient mesh timeout on EKS for sample application (bookinfo)

  #51342 closed Sep 24, 2024

• ExportTo "*" is not working when we have multiple virtualservices with a same host

  #51253 closed Sep 24, 2024

• Pilot-agent can create invalid WorkloadEntry names

  #49797 closed Sep 24, 2024

25 Issues opened by 23 people

• The egress gateway does not capture outbound traffic

  #53350 opened Sep 30, 2024

• Traffic not shown in Kiali

  #53346 opened Sep 29, 2024

• [HELP] [Ambient] modify the HTTP request body before it is sent to the upstream service.

  #53344 opened Sep 29, 2024

• [release-1.23] convert httpbin to go-based

  #53342 opened Sep 28, 2024

• [release-1.22] convert httpbin to go-based

  #53341 opened Sep 28, 2024

• `istioctl ztunnel-config certificates` (and other `ztunnel-config` subcommands) randomly picking an instance is confusing

  #53335 opened Sep 27, 2024

• Enabling meshConfig.defaultProviders in Helm chart for istiod disables Telemetry V2

  #53332 opened Sep 27, 2024

• Ambient Status: ObservedGeneration for status conditions

  #53331 opened Sep 27, 2024

• Hardening TLS certificate key size

  #53326 opened Sep 27, 2024

• istioctl install output installed version inconrrect

  #53323 opened Sep 27, 2024

• Add more DNS configuration fields to ServiceEntry when resolution: DNS

  #53319 opened Sep 27, 2024

• Istio Ambient - Ztunnel XDS client connection error: gRPC connection error:status: Unknown, message: "client error (Connect)", source: tcp connect error: deadline has elapsed

  #53308 opened Sep 26, 2024

• `error="no healthy upstream"` when communicating with Kubenetes API (ambient)

  #53306 opened Sep 26, 2024

• Fequently `Expired nonce received` seen

  #53302 opened Sep 26, 2024

• K8s Gateway doesn't get programmed resulting in missing service and deployment in Istio v1.22.5

  #53295 opened Sep 25, 2024

• Image Pull Error Workaround with Istio Gateway Deployment via Argo CD

  #53290 opened Sep 25, 2024

• multicluster: crash on concurrent map read and map write

  #53289 opened Sep 25, 2024

• Move all resources that are effectively only ever templated for `istio-remote` into `istio-remote` and out of `istio-discovery`

  #53288 opened Sep 25, 2024

• envoy_server_state not giving a value of 1 in draining state

  #53284 opened Sep 25, 2024

• WasmPlugin causes pod to fail to start when failStrategy = FAIL_OPEN

  #53279 opened Sep 25, 2024

• allow ztunnel timeout to be configurable and have init containers tolerate request failures with a retry and an exponential backoff

  #53271 opened Sep 24, 2024

• Split dwp symbols do not seem to work with `symbol` build

  #53269 opened Sep 24, 2024

• jwks Error-IstiodFailedToFetchJwksUri

  #53260 opened Sep 24, 2024

• Multicluster , PrimaryRemote Deploy model, Istiod keep scanning eastwest-gateway port

  #53278 opened Sep 24, 2024

• Release Notes missing for #51987

  #53249 opened Sep 23, 2024

63 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• Support sending from ingress -> service waypoint

  #52985 commented on Sep 29, 2024 • 20 new comments

• waypoint: disable protocol sniffing when possible

  #53194 commented on Sep 29, 2024 • 4 new comments

• helm: dynamic naming of ztunnel chart

  #52978 commented on Sep 25, 2024 • 3 new comments

• Sporadic 504 timeouts since 1.22 upgrade

  #51660 commented on Sep 30, 2024 • 0 new comments

• Add analyzer for missing validation webhook

  #51651 commented on Sep 30, 2024 • 0 new comments

• Better handling of multiple hosts in VirtualService

  #51645 commented on Sep 30, 2024 • 0 new comments

• Istioctl help and documentation not updated with Istio 1.21 changes [IstioOperator CRD removed]

  #51628 commented on Sep 30, 2024 • 0 new comments

• 503 UC upstream_reset_before_response_started{connection_termination} on incomming call after two minutes

  #51619 commented on Sep 30, 2024 • 0 new comments

• Ambient tests misleading due to filtering

  #51501 commented on Sep 30, 2024 • 0 new comments

• 503 UC not being recorded in traces

  #50875 commented on Sep 30, 2024 • 0 new comments

• Consider skipping EDS response instead of sending empty CLA in some cases

  #50189 commented on Sep 30, 2024 • 0 new comments

• Regarding the cluster generated for the ServiceEntry

  #50119 commented on Sep 30, 2024 • 0 new comments

• More improvements for istioctl analyze to help diagnose TLS certificate issues (or other doc/logging fixes)

  #50070 commented on Sep 30, 2024 • 0 new comments

• Istiod helm chart should support mounting the cacerts volume with the Kubernetes CSI Secrets store driver

  #50036 commented on Sep 30, 2024 • 0 new comments

• support stats compression for merged metrics

  #49987 commented on Sep 30, 2024 • 0 new comments

• ambient: make waypoint Delta XDS optimized

  #49918 commented on Sep 30, 2024 • 0 new comments

• Build survey for usage of `--set compatibilityVersion`

  #49885 commented on Sep 30, 2024 • 0 new comments

• Istio-base helm chart does not apply CRDs with correct app, chart, and release labels

  #43204 commented on Sep 23, 2024 • 0 new comments

• `verify-install` broken since IstioOperator writing was removed

  #51666 commented on Sep 30, 2024 • 0 new comments

• Already install self-signed root CA on OS, DestinationRule still unable to get local issuer certificate

  #51679 commented on Sep 30, 2024 • 0 new comments

• [multiple gateways] not able to use multiple gateways

  #51733 commented on Sep 30, 2024 • 0 new comments

• gateways chart deployment selector does not account for revision

  #51736 commented on Sep 30, 2024 • 0 new comments

• Allow users to explicitly disable trust configmap creation

  #51951 commented on Sep 30, 2024 • 0 new comments

• Add manifest translate command

  #52281 commented on Sep 30, 2024 • 0 new comments

• resolve race

  #52443 commented on Sep 30, 2024 • 0 new comments

• Only apply metadata exchange filter to mesh internal services' cluster

  #52507 commented on Sep 30, 2024 • 0 new comments

• [release-1.23] allow sni hosts with outbound_ in vs, when bound to gw

  #52564 commented on Sep 30, 2024 • 0 new comments

• authz support string contains match

  #52583 commented on Sep 30, 2024 • 0 new comments

• Add support for resource request/limit annotations on k8s Gateways

  #52694 commented on Sep 30, 2024 • 0 new comments

• WIP: making proxy resource override mutually exclusive

  #52700 commented on Sep 30, 2024 • 0 new comments

• AuthorizationPolicy status for waypoint attachment

  #53091 commented on Sep 27, 2024 • 0 new comments

• [WIP] Idempotency and reconciliation for cni iptables

  #53153 commented on Sep 26, 2024 • 0 new comments

• Internal listener access logging in Envoy

  #50321 commented on Sep 23, 2024 • 0 new comments

• Ambient mode waypoint intermittent 503 issues

  #53108 commented on Sep 24, 2024 • 0 new comments

• ValidationWebhook 'failurePolicy' is changed to 'Fail' after deployment

  #52785 commented on Sep 24, 2024 • 0 new comments

• Gateway does not bind to wildcarded hosts when a VirtualService has "hosts" defined with a FQDN

  #53117 commented on Sep 24, 2024 • 0 new comments

• Ambient L4 ztunnel Stability Solution

  #48949 commented on Sep 24, 2024 • 0 new comments

• Tracking issue for sidecar -> waypoint interop

  #51445 commented on Sep 24, 2024 • 0 new comments

• `ENABLE_ORIG_SRC=false` does not work with inpod mode in ztunnel

  #51374 commented on Sep 24, 2024 • 0 new comments

• krt: support istio.io/rev filtering

  #51462 commented on Sep 24, 2024 • 0 new comments

• Sampling needs to be configurable for tracing, even if using custom sampler. Current code results in massive log spam

  #53012 commented on Sep 24, 2024 • 0 new comments

• ZTunnel Safe Upgrade

  #51126 commented on Sep 24, 2024 • 0 new comments

• Performance updates and tests

  #52977 commented on Sep 24, 2024 • 0 new comments

• tlss passthrough requires sectionName in parentRef instead of choosing correct listener by hostname

  #51502 commented on Sep 24, 2024 • 0 new comments

• [RequestAuthentication] - ClaimToHeader overrides already existing header even if the header is not present in JWT

  #53212 commented on Sep 24, 2024 • 0 new comments

• Istio reader ServiceAccount doesn't need to be global across all revisions

  #53225 commented on Sep 24, 2024 • 0 new comments

• [Openshift] ProxyUID/ProxyGID not overridable

  #53220 commented on Sep 24, 2024 • 0 new comments

• Helm templates should be used to force consistency among charts

  #52034 commented on Sep 24, 2024 • 0 new comments

• Ambient status reporting

  #52699 commented on Sep 25, 2024 • 0 new comments

• [Ambient mode]Application failedhealthness checks(liveness, readiness, startup), no NetworkPolicy configured

  #53105 commented on Sep 25, 2024 • 0 new comments

• [Mix] [Ambient] [Sidecar] Init container has been failed when the jenkins's pod enable sidecar mode in ambient mesh

  #53150 commented on Sep 26, 2024 • 0 new comments

• Istio Kubernetes Gateway API cannot find route entry

  #53216 commented on Sep 26, 2024 • 0 new comments

• Issue with ConfigMap "istio-ca-root-cert" Creation Delays After Upgrading istiod to v1.20

  #52344 commented on Sep 26, 2024 • 0 new comments

• Set priorities when using distribute localityLbSetting (distribute + failover mode?)

  #22669 commented on Sep 26, 2024 • 0 new comments

• 403 response and Connection: close when "upgrade: TLS/1.2"

  #53239 commented on Sep 26, 2024 • 0 new comments

• istio egress connection on port 22 for ssh traffic

  #53095 commented on Sep 27, 2024 • 0 new comments

• Ambient: make sourceLabels never match instead of always matching

  #51565 commented on Sep 27, 2024 • 0 new comments

• Support HTTP upgrades in MeshConfig.ProxyConfig

  #52651 commented on Sep 27, 2024 • 0 new comments

• AuthorizationPolicy TCP traffic (namespaces and principals don't worked)

  #53048 commented on Sep 27, 2024 • 0 new comments

• Problems with istioctl analyze with multicluster

  #52951 commented on Sep 27, 2024 • 0 new comments

• EnvoyFilter not matching on other EnvoyFilter with lower priority

  #41536 commented on Sep 30, 2024 • 0 new comments

• WasmPlugin to scope to specific listener

  #46885 commented on Sep 30, 2024 • 0 new comments

• Delegate VirtualService support for rewrite in root VirtualService

  #49692 commented on Sep 30, 2024 • 0 new comments