For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Solo build of Istio version 1.31.0 minor release.

This release note describes what’s different between Solo builds of Istio versions 1.30.0 and 1.31.0.

Upgrade Notes

Waypoints in another network are now selectable endpoints of a merged waypoint service

Every cluster running an instance of the waypoint must be able to serve the destinations attached to it. A cluster whose waypoint is present but which does not host the destination service has no configuration for it, and requests that select that waypoint fail. Either deploy the destination in each cluster that runs the waypoint, or give those clusters distinct waypoint names.

Policies targeting a Service now apply to Global Service traffic

A policy whose targetRefs names a kind: Service now also applies to traffic reaching that service through its Global Service address. This affects AuthorizationPolicy, RequestAuthentication, Telemetry, TrafficExtension, WasmPlugin, and EnvoyFilter.

This can deny cross-cluster traffic that was previously allowed, because mesh.internal traffic was not subject to these policies before. Review the from and jwtRules blocks of policies that target a Service and confirm they cover remote-cluster callers.

To keep the previous behavior, set ENABLE_SERVICE_INHERITANCE=false on istiod, or set the solo.io/service-inheritance: "false" annotation on an individual policy.

ztunnel L7 access logs and distributed tracing are now disabled by default

The upgrade re-renders the ztunnel L7 ConfigMap from the chart defaults, so meshes that rely on ztunnel HTTP request logs or spans and never set these values explicitly must now opt in with --set values.ztunnel.l7Telemetry.accessLog.enabled=true and --set values.ztunnel.l7Telemetry.distributedTracing.enabled=true. No restart is required, because ztunnel reloads its L7 configuration.

General Changes

• Upstream Istio 1.31.0 release notes can be found here.
• Built against upstream Istio commit 304b98beb30986f45d137f32973a52ab0f331c57. Compare.

Solo Flavor Changes

• Improved istiod scalability in ambient mode by scoping XDS pushes from workload and service Address changes to only the affected waypoints, instead of pushing to all waypoints and proxies. Can be disabled with AMBIENT_SCOPED_ADDRESS_PUSHES=false.

• Improved istioctl multicluster link to support a --reconcile option. When enabled, any istio-remote gateway in a from context that is not in the to context is deleted.

• Updated ENABLE_SERVICE_INHERITANCE to be enabled by default, so policies that target a Service now also apply to traffic addressed to that service’s Global Service (<name>.<namespace>.mesh.internal).

• Added the istioctl license command, which reports the product, state, and expiration of the Solo license in use by each istiod instance.

• Added the ability to customize the east-west gateway name to the peering Helm chart. If creating the east-west gateway with the Helm chart, the eastwest.name field can be used to control the gateway name. In this case, or if using the chart to create istio-remote gateways for an existing east-west gateway with a non-default service account, the serviceAccountOverride field on the remote should be set to the corresponding east-west gateway’s service account. The service account is either the value of the gateway.istio.io/service-account annotation on the east-west gateway, or that gateway’s name if the annotation is unset.

• Added the AWS_POLLING_INTERVAL environment variable, which controls the polling interval for ECS and EC2 workload discovery. The default value is one minute.

• Added a duplicate cluster ID check to istioctl multicluster check, reporting clusters and remote gateways that share a CLUSTER_ID.

• Added support for weighted waypoint canaries on global services in a multi-cluster mesh. A canary waypoint and its weight now apply to clients in every cluster, not only the cluster where the canary is configured, so set the canary labels on each cluster’s copy of the Service. If the canary is unreachable, the primary waypoint keeps all of the traffic.

• Added an optional ecs.solo.io/domain tag on ECS clusters. When set, it overrides the account-level domain for that cluster and all of its services and tasks.

• Added an istioctl ecs add-service --transparent flag to onboard an EC2-backed Amazon ECS service to the mesh with transparent traffic interception.

• Added support for EnterpriseListenerSet (enterprise.solo.io/v1alpha1), a Solo equivalent of the Gateway API ListenerSet for platforms that pin Gateway API below 1.5. A Gateway API ListenerSet takes precedence over an EnterpriseListenerSet wherever the two collide. Cross-namespace references from an EnterpriseListenerSet are authorized by a ReferenceGrant naming kind ListenerSet in group gateway.networking.k8s.io, so grants keep working unchanged when migrating to ListenerSet; a grant naming EnterpriseListenerSet is not recognized.

• Added docs for the ISTIO_GPRC_* environment variables, documenting that they contain a known typo (GPRC instead of GRPC) and must be set using the misspelled name to take effect.

• Added support for binding a NAMESPACE-visibility ServiceEntry (meshConfig.serviceEntryVisibility) to a solo-ztunnel-egress gateway in another namespace, when the gateway’s allowedRoutes admit the ServiceEntry namespace. The ServiceEntry remains invisible outside its own namespace; other waypoint classes still refuse cross-namespace binding.

• Fixed which services get a peered ServiceEntry. Any service with a scope of global or segment now has a peered ServiceEntry created for it.

• Fixed cross-network traffic through a waypoint when a service that uses that waypoint is configured with a route that redirects to another service that does not use that waypoint.

• Fixed waypoint selection so that a waypoint in a peered cluster on another network is now a selectable endpoint of the merged waypoint service. In a mesh that peers flat-network and cross-network clusters, a service whose flat-network waypoints had no endpoints was unreachable with unknown waypoint, even though a healthy waypoint served it in the cross-network cluster.

• Fixed traffic routing for global services that use a waypoint and have both in-network and cross-network backing services. Traffic now always goes through the waypoint instead of bypassing it inconsistently.

• Fixed the extra-long shutdown window of 60 seconds. Shutdown now takes about 5 seconds.

• Fixed duplicate target port mappings, which caused ServiceEntry validation failures.

• Fixed ServiceEntry resources not being removed after their associated Service was removed.

• Fixed an issue where modifying the solo.io/service-inheritance annotation did not always affect the underlying resource.

• Fixed an issue where changing the solo.io/sidecar-skip-waypoint annotation did not trigger a change to the sidecar configuration.

• Fixed an issue where a sidecar workload would not send traffic to a destination through its waypoint when the waypoint was added after the workload had already started, causing those requests to fail until the workload was restarted.

• Fixed a bug where a ServiceEntry could contain extra hostnames that were previously specified but are no longer in use.

• Fixed the incorrect network set on peered node workload entries for NodePort peering.

• Fixed peered ServiceEntry resources to set the networking.istio.io/traffic-distribution annotation correctly, based on its precedence order.

• Fixed sidecar and waypoint interoperability to reduce control plane memory consumption.

• Fixed generated east-west gateway regeneration when PEERING_AUTOMATIC_LOCAL_GATEWAY is enabled and a generated istio-remote gateway is manually modified or deleted.

• Fixed istioctl multicluster check reporting a remote gateway as connected when it is not peered because another remote gateway already uses its CLUSTER_ID.

• Fixed ztunnel to report the correct egress policies.

• Fixed the ztunnel chart examples for egressPolicies.

• Fixed ztunnel when running as an ECS task on EC2, so that it uses the EC2 instance ID as its node name.

• Fixed ECS discovery to wait until an ECS task is running before including it in the mesh.

• Fixed istioctl ecs add-service to handle empty Docker labels when specifying ecs-ec2.

• Fixed istioctl ecs add-service to associate the ServiceAccount with the task execution role when specifying ecs-ec2.

• Fixed an issue where, after a pod restart, its sidecar was missing the inbound routes for the ServiceEntry hostnames that select it. In multicluster peering, calls to that pod’s global <service>.<namespace>.mesh.internal hostname from another cluster failed with 503 UC, and the only recovery was to restart istiod.

• Fixed the documentation link in istioctl multicluster check --help to point to docs.solo.io/istio/ instead of the outdated docs.solo.io/gloo-mesh/ path.

• Fixed order-dependent behavior when more than one istio-remote Gateway maps to the same cluster. A second istio-remote Gateway for an already-peered cluster could, depending on the order in which Gateways were created or deleted, displace or tear down that cluster’s control plane peering and never rebuild it. The peering controller now deterministically designates a single control plane peer per cluster.

• Fixed ztunnel L7 access logs and distributed tracing, which are now disabled by default. Tracing previously exported to a fixed http://opentelemetry-collector.istio-system:4317 endpoint that is not part of the install, and the resulting export failures were only logged at debug level.

FIPS Flavor Changes

No changes in this section.