Overview

Learn about using -solo distributions of Istio, a hardened Istio enterprise image to maintain n-4 support.

About Solo distributions of Istio

The Solo distribution of Istio is a hardened Istio enterprise image, which maintains n-4 support for CVEs and other security fixes. The image support timeline is longer than the community Istio support timeline, which provides n-1 support with an additional 6 weeks of extended time to upgrade the n-2 version to n-1. Based on a cadence of 1 release every 3 months, Solo Enterprise for Istio’s n-4 support provides an extra 9 months to run the hardened Istio version of your choice, compared to an open source strategy that also lacks enterprise support. Note that all backported functionality is available in the upstream community Istio, as there are no forked capabilities from community Istio.

The following image provides an overview of how Solo engineers harden the base Istio image release.

To use a version of Istio that is no longer supported by the community with Solo Enterprise for Istio, you must install the Solo distribution of Istio. If the Istio version that you want to use is currently supported by the community, you can use either the community Istio or the Solo distribution of Istio. To review supported Solo distributions of Istio, see the versions table. To review supported community versions, see the Istio documentation.

Distributions

Solo provides two main distributions of Istio as follows.

Standard: A copy of the community Istio distribution. This distribution does not contain Solo.io’s enterprise features or extended Istio support. Example: 1.31.1
Solo: An enterprise distribution of the community Istio project with additional security patches, as well as certain Envoy filters to enable Solo Enterprise for Istio features, such as support for deploying Istio service meshes in ambient mode. You must use the solo image to use these features. Example: 1.31.1-solo

Both Solo’s standard and solo distributions of Istio come in the following optional varieties.

FIPS: An image that is tagged with fips complies with NIST FIPS, for use cases that require federal information processing capabilities. For more information, see About Solo FIPS distribution of Istio. Examples: 1.31.1-fips, 1.31.1-solo-fips
Distroless: An image that is tagged with distroless is a slimmed down distribution with the minimum set of binary dependencies to run the image, for enhanced performance and security. Note that if your app relies on package management, shell, or other operating system tools such as pip, apt, ls, grep, or bash, you must find another way to install these dependencies. Examples: 1.31.1-distroless, 1.31.1-solo-distroless

An image might be tagged to meet multiple use cases, such as 1.31.1-solo-fips-distroless.

About Solo FIPS distribution of Istio

For use cases that require federal information processing capabilities, install Solo distributions of Istio that are tagged with fips, which comply with National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS). Keep in mind that a Solo license key is required to use the Solo FIPS distribution of Istio.

Cryptographic modules

FIPS 140-3 validation applies to the cryptographic module that a component links, not to the component that links it. The Istio control plane, ztunnel, and Envoy are each written in a different language, so each one links a different module. An audit must account for all three modules separately.

Component	Binary	Cryptographic module
Istio control plane	`pilot-discovery`	Go Cryptographic Module, selected by the `GOFIPS140` build setting
ztunnel	`ztunnel`	AWS-LC FIPS, linked through the `aws-lc-rs` crate
Envoy	`envoy`	BoringSSL FIPS

Istio 1.30 replaced the BoringCrypto module that earlier versions used in the control plane and in ztunnel. If your compliance process records a module version, note that the version can change between Istio patch releases, so record it per patch release. To read the module version out of a specific image, see Installing and verifying FIPS-compliant Istio images.

Solo does not publish a Cryptographic Module Validation Program (CMVP) certificate number for a Solo distribution of Istio. To check the validation status of a module, search the NIST CMVP validated modules list. To request a compliance statement that maps a Solo distribution of Istio to a specific certificate, contact your Solo account representative.

Standard and Solo FIPS builds

Solo provides two main distributions of Istio, which both offer FIPS-compliant builds:

Standard: An enterprise distribution of the community Istio project with additional security patches.
Solo: An enterprise distribution of the community Istio project with additional security patches, as well as certain Envoy filters to enable Solo Enterprise for Istio features.

Depending on the distribution, the image tag for installation might look like 1.31.1-solo-fips.

Optional: Distroless FIPS builds

In addition, you can also choose a FIPS build that is distroless. A FIPS image that is tagged with distroless is a slimmed down distribution with the minimum set of binary dependencies to run the image, for enhanced performance and security. Keep in mind that there are some challenges around distroless builds. For example, if your app relies on package management, shell, or other operating system tools such as pip, apt, ls, grep, or bash, you must find another way to install these dependencies.

Depending on the distribution, the image tag for a distroless installation might look like 1.31.1-solo-fips-distroless.

Installing and verifying FIPS-compliant Istio images

Install Istio with FIPS-compliant images.

To find the FIPS build that you want, see Download a specific image.
Use the -fips image when you install Istio, such as 1.31.1-solo-fips. You can choose from the following installation methods:
- To use the Gloo Operator to deploy and manage the lifecycle of your Istio service meshes, see the Gloo Operator ambient mesh guide.
- To manually install Istio, you can use Helm. For example, you can follow the steps in the Helm ambient mesh guide. In the example files that you download in this guide, make sure to replace any images with a Solo FIPS distribution of Istio-tagged image.
Verify that the Istio control plane runs a FIPS build. The Version and GitTag fields report the image tag, which confirms the distribution but not the cryptographic module.
```
kubectl exec -it -n istio-system $(kubectl get pod -n istio-system -l app=istiod -o jsonpath="{.items[0].metadata.name}") -- /usr/local/bin/pilot-discovery version
```
Example output: Note the -fips suffix in the Version and GitTag fields.
```
client version: version.BuildInfo{
  Version:"1.31.1-solo-fips",
  GitRevision:"e5ace34007bff13f4ed049521d9411a51639b029",
  GolangVersion:"go1.26.7",
  BuildStatus:"Clean",
  GitTag:"1.31.1-solo-fips"
  }
```
Because the Go Cryptographic Module replaced BoringCrypto in Istio 1.30, the GolangVersion field no longer carries an X:boringcrypto suffix. A plain Go version in this field does not mean that the image lacks FIPS support. Use the build settings in the next step as the evidence of FIPS mode.
Verify the cryptographic module that the control plane links. Copy the pilot-discovery binary to your local machine, then read its build settings. This step requires a local installation of Go.
```
kubectl cp -n istio-system $(kubectl get pod -n istio-system -l app=istiod -o jsonpath="{.items[0].metadata.name}"):/usr/local/bin/pilot-discovery ./pilot-discovery
go version -m ./pilot-discovery | grep -E "GOFIPS140|fips140"
```
Example output: GOFIPS140 records the module version that the build selected, and fips140=on records that the module starts in FIPS mode.
```
build	DefaultGODEBUG=fips140=on
build	GOFIPS140=latest
```
Verify the cryptographic module that ztunnel links. Copy the ztunnel binary to your local machine, then search it for the module identifier.
```
kubectl cp -n istio-system $(kubectl get pod -n istio-system -l app=ztunnel -o jsonpath="{.items[0].metadata.name}"):/usr/local/bin/ztunnel ./ztunnel
strings ./ztunnel | grep "AWS-LC FIPS"
```
Example output: The module version depends on the Istio patch release, so record the version that your own image reports.
```
AWS-LC FIPS 4.2.0
```
Verify the cryptographic module that Envoy links. Copy the envoy binary from a pod that runs an Envoy proxy, such as a gateway or waypoint proxy, then search it for the module identifier. Replace $ENVOY_POD and $ENVOY_NAMESPACE with the pod and namespace that you want to check.
```
kubectl cp -n $ENVOY_NAMESPACE $ENVOY_POD:/usr/local/bin/envoy ./envoy
strings ./envoy | grep -o "BoringSSL-FIPS" | head -n 1
```
Example output:
```
BoringSSL-FIPS
```

Features by license level

The Solo distribution of Istio includes numerous features that you can unlock with three levels of Solo licenses. If you provide a -solo tagged image of Istio version 1.25 or later and your Solo license in your Istio installation values, your Istio installation is automatically enabled with the features provided by your license.

Basic features are unlocked with a Basic license. These standard features provide you with long-term and FIPS support for Istio on top of the open source offerings of Istio.
Premium features are unlocked with a Premium license. In addition to all Basic features, a Premium license unlocks increased Solo support.
Enterprise features are unlocked with an Enterprise license. In addition to all Basic and Premium features, a Premium license unlocks the most comprehensive enterprise-level features to help you build out your ideal, customized mesh setup.

If you do not already have a Basic, Premium, or Enterprise license, you can contact an account representative to obtain one. Note that if you use a Premium or Enterprise license to install a Solo distribution of Istio, you can also use the same license to install the Solo UI for better visibility into your environment.

To review the features that each license level supports, see the Istio support plans comparison on Solo.io. To learn more about select features that are enabled by an Enterprise license, see Enterprise features.

Providing image tag and license installation values

When you install Istio, you can provide your Solo distribution of Istio details by following one of the Istio installation guides in this documentation set. These guides include steps for how to provide your image tag and license installation values, depending on the method of installation.

Ambient mesh

Gloo Operator - single cluster
Gloo Operator - multicluster (requires an Enterprise license)
Helm - single cluster
Helm - multicluster (requires an Enterprise license)

Sidecar mesh

Gloo Operator - single cluster
Gloo Operator - multicluster (requires an Enterprise license)
Helm - single cluster
Helm - multicluster (requires an Enterprise license)

Solo UI

Note that if you also install the Solo UI for better visibility and insights into your environment, you specify your same license in the UI installation too.

Solo UI installation

Supported versions