Istio
1.29.6Networking & MessagingIstio v1.29.6 is a routine patch addressing ambient mesh bugs in pilot-agent drain counting, ztunnel CNI deadlock, Istiod memory accumulation, and east-west gateway RBAC filtering. Auto-registered WorkloadEntry resources gain HBONE capability, though existing entries require the networking.istio.io/tunnel=http label to activate encrypted tunneling.
breakingAuto-registered WorkloadEntry resources require label addition for HBONE tunneling
WorkloadEntry resources created through auto-registration before upgrading to v1.29.6 continue to use plaintext tunneling until they re-register or the networking.istio.io/tunnel=http label is manually added to their existing WorkloadEntry. This is a transitional state affecting ambient mesh deployments that do not rebuild their auto-registered workload entries.
Key changes (5)
- Fixed pilot-agent drain logic on ambient ingress gateways and waypoints to correctly count HBONE connections, eliminating unnecessary waits on graceful termination
- Fixed ambient CNI agent deadlock where concurrent pod deletions and ztunnel reconnections could block the ZDS server
- Fixed Istiod memory leak where failed pod IP entries were not cleaned up from resync state
- Fixed east-west gateway RBAC filtering incorrectly blocking cross-network traffic when L7 AuthorizationPolicies are present
- Auto-registered WorkloadEntry resources now support HBONE tunneling, with label-based opt-in for existing entries