1.29.3

Solo build of Istio version 1.29.3 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.29.2 and 1.29.3.

General Changes

• Built against upstream Istio commit dfb1391407244d2642141cd24acad672a48e8e3e. Compare.

Solo Flavor Changes

• Improved istioctl multicluster check to detect missing local Segment resources that cause auto-generated ServiceEntry resources from a peered cluster to be silently dropped. The check now reports rejected peer Segment resources with an actionable message explaining how to resolve the misconfiguration.

• Improved istioctl multicluster check to also detect rejected peer Segment states caused by hostname mismatches and overlapping Segment domains.

• Added a service alias conflicts check to istioctl multicluster check that reports hostname conflicts by reading the controller’s conflict annotations on auto-generated ServiceEntry resources.

• Fixed an issue where ECS services with long cluster or service names could not join the mesh due to the ecs.solo.io/hostname label value exceeding the 63-character Kubernetes limit.

• Fixed an issue where ECS-discovered workloads failed to register as WorkloadEntry resources when no domain was specified for an AWS account. A default domain is now used so workloads are always reachable within the mesh.

• Fixed an issue where the global waypoint label value could exceed the Kubernetes 63-byte limit when the waypoint name, namespace, and domain were long, causing the label to be rejected.

• Fixed traffic routing failures for global services that use named targetPort values. Requests could be sent to the wrong port when routing across clusters or to local services exposed via named ports.

• Fixed Sidecar generation with service takeover enabled and no local service.

• Fixed an issue where updating a remote cluster’s Segment CRD domain or aliases fields would not regenerate peered ServiceEntry hostnames.

• Fixed cross-network traffic through a waypoint when a service that uses that waypoint is configured with a route that redirects to another service that does not use that waypoint.

FIPS Flavor Changes

No changes in this section.