RATATOSKRATATOSK
Sign in

Istio

1.29.0Networking & Messaging
Feb 16, 2026

ACTION 1CHECK 4OTHER 18

Istio 1.29.0 changes several operator-visible defaults across ambient networking, endpoint authorization, metrics, and control-plane memory management. Ambient users and operators relying on debug endpoints, compressed metrics, or circuit breaker metrics should review these defaults.

Action needed (1)

  • breakingAutomatic GOMEMLIMIT setting in istiod

    In Istio 1.29.0, istiod automatically sets GOMEMLIMIT to 90% of its memory limit through the automemlimit library. The setting reduces the risk of OOM kills while maintaining performance.

Check if affected (4)

  • breakingDefault iptables reconciliation

    Applies if you use the ambient mesh with the istio-cni DaemonSet.

    iptables reconciliation is enabled by default in Istio 1.29.0. It automatically updates network rules when the istio-cni DaemonSet is upgraded.

  • breakingDefault authorization for debug endpoints

    Applies if you use debug endpoints on port 15014.

    Debug endpoint authorization is enabled by default in Istio 1.29.0. It applies namespace-based access controls to debug endpoints on port 15014.

  • breakingDefault HTTP compression for Envoy metrics

    Applies if you use the Prometheus stats endpoint for Envoy metrics.

    HTTP compression for Envoy metrics is enabled by default in Istio 1.29.0. The Prometheus stats endpoint selects brotli, gzip, or zstd compression from the client's Accept header.

  • breakingDefault-disabled circuit breaker metrics tracking

    Applies if you rely on circuit breaker metrics tracking.

    Circuit breaker metrics tracking is disabled by default in Istio 1.29.0. Legacy behavior remains available as an option.

All 18 other recorded changesadditions 6 · value changes 6 · constraints 5 · fixes 1

additions (6)

  • Certificate Revocation List (CRL) support is now available in ztunnel, allowing validation and rejection of revoked certificates when using plugged in certificate authorities.
  • Optional NetworkPolicy deployment is now available for istiod, istio-cni, and ztunnel components, enabling users to deploy default NetworkPolicies with global.networkPolicy.enabled=true for enhanced network security.
  • Baggage based telemetry support has been added in alpha for ambient mesh, particularly benefiting multinetwork deployments.
  • Istio 1.29 introduces pilot resource filtering capabilities through the PILOT_IGNORE_RESOURCES environment variable, enabling administrators to deploy Istio as a Gateway API only controller or with specific resource subsets.
  • New --wait flag for istioctl waypoint status
  • support for --all-namespaces flag

value changes (6)

  • Support for the Gateway API Inference Extension has been promoted to beta in Istio 1.29.
  • improved proxy admin port specification
  • safeguards for gateway deployment controller
  • improved ambient multicluster ingress routing
  • Source and destination workload identification in waypoint proxy traces
  • Multi-network multicluster ambient goes Beta

constraints (5)

  • Istio 1.29 introduces alpha support for wildcard hosts in ServiceEntry resources with DYNAMIC_DNS resolution specifically for TLS traffic.
  • Configurable terminationGracePeriodSeconds for istio-cni pods
  • support for custom envoy file flush intervals
  • Support for LEAST_REQUEST load balancing and circuit breaking in gRPC proxyless clients
  • timeout and headers support for Zipkin tracing provider

fixes (1)

  • The main area of focus for this transition was telemetry, where important gaps were addressed, including the implementation of more advanced peer metadata exchange in the ambient data-plane.
Add Istio to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Official release note ↗All Istio releases →