Supported versions

Within each Gloo Mesh Enterprise version, different open source project versions are supported, including n-4 version support for Solo distributions of Istio.

The following versions of Gloo Mesh Enterprise are supported with the compatible open source project versions of Istio and Kubernetes. Later versions of the open source projects that are released after Gloo Mesh Enterprise might also work, but are not tested as part of the Gloo Mesh Enterprise release.

Gloo Mesh EnterpriseRelease dateSupported Solo distributions of Istio and related Kubernetes versions tested by Solo
2.615 Aug 2024
  • Istio 1.23 on Kubernetes 1.27 - 1.30
  • Istio 1.22 on Kubernetes 1.27 - 1.30
  • Istio 1.21 on Kubernetes 1.26 - 1.29 (see note below)
  • Istio 1.20 on Kubernetes 1.25 - 1.29
  • Istio 1.19 on Kubernetes 1.25 - 1.28
Note: A bug was identified when upgrading from Istio version 1.20 or lower to Istio version 1.21 and later while being on Gloo Mesh Enterprise version 2.6. This bug can lead to disabled JWT authentication and authorization policies that fail close, which means that the gateway rejects requests as unauthenticated on any route that is protected by a JWT policy. Note that this bug will be fixed in a future 2.6 patch release. Do not upgrade to Istio version 1.21 and later until this patch is available.
2.509 Jan 2024
  • Istio 1.20 on Kubernetes 1.25 - 1.29
  • Istio 1.19 on Kubernetes 1.25 - 1.28
  • Istio 1.18 on Kubernetes 1.24 - 1.27
  • Istio 1.17 on Kubernetes 1.23 - 1.26
  • Istio 1.16 on Kubernetes 1.22 - 1.25

Note: Istio 1.21 is not supported in Gloo Mesh Enterprise version 2.5. You must upgrade the Gloo management server and agents to version 2.6 prior to upgrading to Istio 1.21.
2.428 Aug 2023
  • Istio 1.18 on Kubernetes 1.24 - 1.27
  • Istio 1.17 on Kubernetes 1.23 - 1.26
  • Istio 1.16 on Kubernetes 1.22 - 1.25
  • Istio 1.15 on Kubernetes 1.22 - 1.25
  • Istio 1.14 on Kubernetes 1.21 - 1.24
2.317 Apr 2023
  • Istio 1.18 on Kubernetes 1.24 - 1.27
  • Istio 1.17 on Kubernetes 1.23 - 1.26
  • Istio 1.16 on Kubernetes 1.22 - 1.25
  • Istio 1.15 on Kubernetes 1.22 - 1.25
  • Istio 1.14 on Kubernetes 1.21 - 1.24

Keep in mind that Gloo Mesh Enterprise offers n-4 security patching support only with Solo distributions of Istio, not community Istio versions. Solo distributions of Istio support the same patch versions as community Istio. You can review community Istio patch versions in the Istio release documentation. You must run the latest Gloo Mesh Enterprise patch version to get the backported Istio support.

Supported Istio versions by Kubernetes or OpenShift version

The supported version of Istio, and Kubernetes or OpenShift are dependent on each other. For example, if you plan to use Gloo Mesh Enterprise with Istio 1.22, you must make sure that you use a Kubernetes or OpenShift version that is compatible with Istio 1.22. The same is true if you decided on a specific Kubernetes or OpenShift version, and you must find an Istio version that is compatible.

To find a list of supported Kubernetes versions in Istio, see the Istio docs. For supported OpenShift, go to the OpenShift knowledgebase (requires login).

Known Istio issues

  • Due to a lack of support for the Istio CNI and iptables for the Istio proxy, you cannot run Istio (and therefore Gloo Mesh Enterprise) on AWS Fargate. For more information, see the Amazon EKS issue.
  • Istio 1.22 is supported only as patch version 1.22.1-patch0 and later. Do not use patch versions 1.22.0 and 1.22.1, which contain bugs that impact several Gloo Mesh Enterprise routing features that rely on virtual destinations. Additionally, in Istio 1.22.0-1.22.3, the ISTIO_DELTA_XDS environment variable must be set to false. For more information, see this upstream Istio issue. Note that this issue is resolved in Istio 1.22.4.
  • If you plan to upgrade to Istio 1.21, you must upgrade the Gloo management server to version 2.6 first. For more information, see the 2.6 release notes.
  • Istio 1.20 is supported only as patch version 1.20.1-patch1 and later. Do not use patch versions 1.20.0 and 1.20.1, which contain bugs that impact several Gloo Mesh Enterprise features that rely on Istio ServiceEntries.
    • If you have multiple external services that use the same host and plan to use Istio 1.20, 1.21, or 1.22, you must use patch versions 1.20.7, 1.21.3, or 1.22.1-patch0 or later to ensure that the Istio service entry that is created for those external services is correct.
    • The WasmDeploymentPolicy Gloo CR is currently unsupported in Istio versions 1.18 and later.

    Download a specific image

    You can download a particular Solo distribution of Istio, such as for the following use cases.

    • To download and transfer these images if your environment does not have public network access or cannot pull public images, for an air-gapped installation.
    • To run an older Istio version that the community no longer supports while still receiving security patches.
    • To use a custom build that aligns with compliance standards such as Federal Information Processing Standards (FIPS).
    1. Open the Istio images built by Solo.io support article. When prompted, log in to the Support Center with your Solo account credentials.
    2. Find the repo key for the Istio version that you want to use in the support article, such as the repo key for # istio-1.22.
    3. Save the repo key that your account representative gave you as an environment variable.
        export REPO=<repo-key>
        
    4. Decide on the specific tag of Istio image, such as the solo-fips, solo-distroless, or solo-fips-distroless, that you want for your environment.
    5. Save the Istio version, including any specific tags, as an environment variable. The following example is for the latest patch version of the Solo FIPS distribution of Istio image.
        export ISTIO_IMAGE=1.22.4-solo-fips
        
    6. Pull the Istio images that you want to use with the repo key.
        docker pull $REPO/pilot:$ISTIO_IMAGE
      docker pull $REPO/proxyv2:$ISTIO_IMAGE
      docker pull $REPO/operator:$ISTIO_IMAGE
        
    7. Install Istio with these images.
      • To use Gloo Mesh Enterprise to deploy and manage the lifecycle of your Istio service meshes across clusters, see Deploy Gloo-managed service meshes. In the example files that you download in this guide, make sure to replace any images with the Solo distributions of Istio that you want to use.
      • To manually install Istio, you can use an installation method such as using istioctl, the Istio Operator, or Helm. When you install Istio, make sure to replace any images with the Solo distributions of Istio that you want to use. For more information, see the Istio documentation.
    8. After installing Istio, you can verify that the version is compatible with your Kubernetes environment by running istioctl x precheck.
        istioctl x precheck
      
      ✔ No issues found when checking the cluster. Istio is safe to install or upgrade!
        To get started, check out https://istio.io/latest/docs/setup/getting-started/