Istio
1.27.6Networking & MessagingIstio 1.27.6 tightens validation and access controls around gateway resource creation, resource annotations, and debug endpoints. The release also includes a compatibility switch for the new debug endpoint authorization behavior.
Check if affected (3)
securityGateway deployment controller safeguards against arbitrary resource creation
Applies if you use the gateway deployment controller.
Istio 1.27.6 adds safeguards to the gateway deployment controller that validate object types, names, and namespaces before creating Kubernetes resources through template injection.
securityStricter resource annotation validation
Applies if resource annotations are used in template rendering.
Istio 1.27.6 updates resource annotation validation to reject newline and control characters that could inject containers into pod specifications through template rendering.
breakingNamespace-based authorization for debug endpoints
Applies if you use debug endpoints on port
15014from non-system namespaces.Istio 1.27.6 adds namespace-based authorization for debug endpoints on port
15014. Non-system namespaces are limited toconfig_dump,ndsz, andedsz, and to proxies in the same namespace. Compatibility behavior can be disabled withENABLE_DEBUG_ENDPOINT_AUTH=false.
All 2 other recorded changesadditions 1 · fixes 1
additions (1)
- - Added service.selectorLabels field to the gateway Helm chart for custom service selector labels during revision-based migrations.
fixes (1)
- - Fixed incorrect mapping of meshConfig.tlsDefaults.minProtocolVersion to tls_minimum_protocol_version in downstream TLS context.
A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.