This release note describes what’s different between Solo builds of Istio versions 1.25.5-patch2 and 1.25.5-patch3.

Security Notice

When using peered global services in sidecar environments, the generated Envoy cluster configuration was missing the tlsMode: istio transport socket match causing local sidecar-to-sidecar traffic to be sent as plaintext. In environments where strict mTLS was used, connectivity would break.

Solo Flavor Changes

  • Fixed east-west gateway TLS listeners showing an incorrect UnsupportedProtocol status when PILOT_ENABLE_ALPHA_GATEWAY_API was disabled.

  • Fixed an issue causing envoy clusters for peered global services to not have the tlsMode-istio transport socket configured.

FIPS Flavor Changes

No changes in this section.