This release note describes what’s different between Solo builds of Istio versions 1.28.2 and 1.28.3.

General Changes

Solo Flavor Changes

  • Improved istioctl multicluster check command by skipping the stale workload check unless flat-network is detected.

  • Added support to retry failed remote peer creation or updates when PEERING_AUTOMATIC_LOCAL_GATEWAY is enabled.

  • Fixed an issue where the remote peer did not have its address updated when PEERING_AUTOMATIC_LOCAL_GATEWAY was enabled.

  • Fixed an issue in NodePort peering where a node that entered a NotReady state was still used for multi-cluster traffic routing.

  • Fixed east-west gateway TLS listeners showing an incorrect UnsupportedProtocol status when PILOT_ENABLE_ALPHA_GATEWAY_API was disabled.

  • Fixed flat-network multi-cluster peering to properly peer user WorkloadEntry-based endpoints across clusters for multi-cluster traffic. This fixes VMs and external workloads being reachable for proxies configured by control planes in different clusters.

FIPS Flavor Changes

No changes in this section.