Skip to content
You are viewing the documentation for Solo Enterprise for Istio, formerly known as Gloo Mesh (OSS APIs).

Supported versions

Page as Markdown
View supported Solo distributions of Istio and their release cycle.
Supported versions

Within each Solo Enterprise for Istio version, different open source project versions are supported, including n-4 version support for -solo distributions of Istio.
The following versions of Solo Enterprise for Istio are tested and compatible with the versions of Istio and Kubernetes at the time of release. Across all Solo Enterprise for Istio versions, supported versions of Istio under Solo’s N-4 support policy are based on the most recently released and supported version of Istio.
Solo Enterprise for IstioRelease dateSupported Solo distributions of Istio and related Kubernetes versions tested by Solo
2.1329 May 2026Currently supported versions:
  • Istio 1.30 on Kubernetes 1.32 - 1.36 with Gloo Operator 0.5.0+
  • Istio 1.29 on Kubernetes 1.30 - 1.35 with Gloo Operator 0.5.0+
  • Istio 1.28 on Kubernetes 1.30 - 1.34 with Gloo Operator 0.4.1+
  • Istio 1.27 on Kubernetes 1.30 - 1.33 with Gloo Operator 0.3.0+
  • Istio 1.26 on Kubernetes 1.29 - 1.32 with Gloo Operator 0.2.5+
2.1224 Feb 2026Currently supported versions:
  • Istio 1.29 on Kubernetes 1.30 - 1.35 with Gloo Operator 0.5.0+
  • Istio 1.28 on Kubernetes 1.30 - 1.34 with Gloo Operator 0.4.1+
  • Istio 1.27 on Kubernetes 1.30 - 1.33 with Gloo Operator 0.3.0+
  • Istio 1.26 on Kubernetes 1.29 - 1.32 with Gloo Operator 0.2.5+
Tested and compatible versions at the time of release:
  • Istio 1.25 on Kubernetes 1.29 - 1.32 with Gloo Operator 0.2.0+
2.1113 Nov 2025Currently supported versions:
  • Istio 1.28 on Kubernetes 1.30 - 1.34 with Gloo Operator 0.4.1+
  • Istio 1.27 on Kubernetes 1.30 - 1.33 with Gloo Operator 0.3.0+
  • Istio 1.26 on Kubernetes 1.29 - 1.32 with Gloo Operator 0.2.5+
Tested and compatible versions at the time of release:
  • Istio 1.25 on Kubernetes 1.29 - 1.32 with Gloo Operator 0.2.0+
  • Istio 1.24 on Kubernetes 1.28 - 1.31 with Gloo Operator 0.1.0+†
2.1019 Aug 2025Currently supported versions:
  • Istio 1.27 on Kubernetes 1.30 - 1.33 with Gloo Operator 0.3.0+
  • Istio 1.26 on Kubernetes 1.29 - 1.32 with Gloo Operator 0.2.5+
Tested and compatible versions at the time of release:
  • Istio 1.25 on Kubernetes 1.29 - 1.32 with Gloo Operator 0.2.0+
  • Istio 1.24 on Kubernetes 1.28 - 1.31 with Gloo Operator 0.1.0+†
  • Istio 1.23 on Kubernetes 1.27 - 1.30†
† Due to a breaking change in Helm, you must use Helm version 3.18.4 or lower to install Istio. For more information, see this Istio issue.
Keep in mind that Solo Enterprise for Istio offers n-4 security patching support only with a -solo distribution of Istio, not community Istio versions. Solo distributions of Istio support the same patch versions as community Istio. You can review community Istio patch versions in the Istio release documentation. You must run the latest Solo Enterprise for Istio patch version to get the backported Istio support.
Supported Istio versions by Kubernetes or OpenShift version

The supported version of Istio, and Kubernetes or OpenShift are dependent on each other. For example, if you plan to use Solo Enterprise for Istio with Istio 1.29, you must make sure that you use a Kubernetes or OpenShift version that is compatible with Istio 1.29. The same is true if you decided on a specific Kubernetes or OpenShift version, and you must find an Istio version that is compatible.
To find a list of supported Kubernetes versions in Istio, see the Istio docs. For supported OpenShift, go to the OpenShift knowledgebase (requires login).
Patch versions

To find the available patch versions for each minor version of the Solo distribution of Istio, you can get the minor version repo URL from the Istio images built by Solo.io support article, and check the patch version builds in that repo.
Known Istio issues and version restrictions

Version-specific restrictions:
  • If you use Istio versions 1.27.7, 1.28.4, 1.29.0 or later, and you install the Solo Enterprise for Istio management plane (Gloo UI) into a namespace other than gloo-mesh, you must allow that namespace by listing it in the DEBUG_ENDPOINT_AUTH_ALLOWED_NAMESPACES environment variable of your istiod installation. For more information, see the release notes.
  • Patch versions 1.26.0 and 1.26.1 of the Solo distribution of Istio lack support for FIPS-tagged images and ztunnel outlier detection. When upgrading or installing 1.26, be sure to use patch version 1.26.1-patch0 and later only.
  • In the Solo distribution of Istio 1.25 and later, you can access enterprise-level features by passing your Solo license in the license.value or license.secretRef field of the Solo distribution of the istiod Helm chart. The Solo istiod Helm chart is strongly recommended due to the included safeguards, default settings, and upgrade handling to ensure a reliable and secure Istio deployment. Though it is not recommended, you can pass your license key in the open source istiod Helm chart by using the --set pilot.env.SOLO_LICENSE_KEY field.
Other known Istio limitations:
  • In-pod enrollment severs established connections (upstream issue istio/istio#52218): When the Istio CNI plugin enrolls a running pod into the ambient mesh, it inserts iptables rules into the pod’s network namespace while the pod is already serving traffic. Any TCP connections that were established before the rules were inserted are severed because the rules redirect existing sockets through ztunnel, which the remote side is not expecting. The following mitigations reduce the impact:
    • Enable detection retries in the CNI plugin so that it retries the ambient-membership lookup and holds the pod back before it begins serving, rather than letting it through un-enrolled: set ambient.enableAmbientDetectionRetry: true in your istiod Helm values.
    • Stagger pod startups and avoid burst-scaling a Deployment into an ambient-enabled namespace, so enrollment occurs before the pod begins serving.
    • Add istio.io/dataplane-mode: none to pods that cannot tolerate mid-life enrollment, and enroll them during a planned maintenance window.
    • Configure app-level retries so that clients automatically reconnect after a dropped connection.
  • Multi-subnet cluster connection failures (upstream issue ztunnel#1456): When a workload in an ambient mesh connects to a multi-subnet cluster (such as an SQL Server Multi-Subnet Cluster), ztunnel’s TCP proxy optimistically completes the TCP handshake for all connection attempts before verifying the upstream connection. Depending on race conditions, the client can complete a TCP handshake with an inactive server instance. When the client then sends data, the connection fails because the upstream connection cannot be established. As a workaround, opt the affected workloads out of the mesh by adding the istio.io/dataplane-mode: none label to the pod or namespace. A fix is available in upstream Istio and will be included in a future Solo release. The fix introduces an ambient.istio.io/connect-strategy: FIRST_HEALTHY_RACE annotation on a ServiceEntry that instructs istiod to use a healthy-first connection strategy for the affected external service. See istio#59083 for details.
Download a specific image

You can download a particular Solo distribution of Istio, such as for the following use cases.
  • To download and transfer these images if your environment does not have public network access or cannot pull public images, for an air-gapped installation.
  • To run an older Istio version that the community no longer supports while still receiving security patches.
  • To use a custom build that aligns with compliance standards such as Federal Information Processing Standards (FIPS).
  1. Save the repo URL for the Solo distribution of Istio images.
    export REPO=us-docker.pkg.dev/soloio-img/istio
  2. Decide on the specific tag of Istio image, such as the solo-fips, solo-distroless, or solo-fips-distroless, that you want for your environment.
  3. Save the Istio version, including any specific tags, as an environment variable. The following example is for the latest patch version of the Solo FIPS distribution of Istio image.
    export ISTIO_IMAGE=1.29.5-solo-fips
  4. Pull the Istio images that you want to use with the repo key.
    docker pull $REPO/pilot:$ISTIO_IMAGE
docker pull $REPO/proxyv2:$ISTIO_IMAGE
docker pull $REPO/operator:$ISTIO_IMAGE
docker pull $REPO/install-cni:$ISTIO_IMAGE
docker pull $REPO/ztunnel:$ISTIO_IMAGE
  5. Install Istio with these images.
    • To use the Gloo Operator to deploy and manage the lifecycle of your Istio service meshes, see the Gloo Operator ambient mesh guide.
    • To manually install Istio, you can use an installation method such as using Helm. For example, you can follow the steps in the Helm ambient mesh guide.
  6. After installing Istio, you can verify that the version is compatible with your Kubernetes environment by running istioctl x precheck.
    istioctl x precheck

✔ No issues found when checking the cluster. Istio is safe to install or upgrade!
  To get started, check out https://istio.io/latest/docs/setup/getting-started/
To download Solo distributions of Istio, you must be a registered user and log in to the Solo Support Center.
  1. Open the Istio images built by Solo.io support article. When prompted, log in to the Support Center with your Solo account credentials.
  2. Find the repo key for the Istio version that you want to use in the support article, such as the repo key for # istio-1.29.
  3. Save the repo key that your account representative gave you as an environment variable.
    export REPO=<repo-key>
  4. Decide on the specific tag of Istio image, such as the solo-fips, solo-distroless, or solo-fips-distroless, that you want for your environment.
  5. Save the Istio version, including any specific tags, as an environment variable. The following example is for the latest patch version of the Solo FIPS distribution of Istio image.
    export ISTIO_IMAGE=1.29.5-solo-fips
  6. Pull the Istio images that you want to use with the repo key.
    docker pull $REPO/pilot:$ISTIO_IMAGE
docker pull $REPO/proxyv2:$ISTIO_IMAGE
docker pull $REPO/operator:$ISTIO_IMAGE
docker pull $REPO/install-cni:$ISTIO_IMAGE
docker pull $REPO/ztunnel:$ISTIO_IMAGE
  7. Install Istio with these images.
    • To use the Gloo Operator to deploy and manage the lifecycle of your Istio service meshes, see the Gloo Operator ambient mesh guide.
    • To manually install Istio, you can use an installation method such as using Helm. For example, you can follow the steps in the Helm ambient mesh guide.
  8. After installing Istio, you can verify that the version is compatible with your Kubernetes environment by running istioctl x precheck.
    istioctl x precheck

✔ No issues found when checking the cluster. Istio is safe to install or upgrade!
  To get started, check out https://istio.io/latest/docs/setup/getting-started/
Enterprise features