RATATOSKRATATOSK
Sign in

Istio

1.30.3Networking & Messaging
Jul 16, 2026

Istio 1.30.3 is a routine patch focused on bug fixes and scalability improvements for ambient mode. No CVEs. One operator-visible change: auto-registered workloads in ambient mode fall back to plaintext HBONE until re-registered or explicitly labeled; deployments relying on HBONE encryption for such workloads may need to take action.

  • breakingPlaintext HBONE fallback for pre-registered workloads in ambient mode

    Workloads auto-registered with Istio before upgrading to 1.30.3 continue to be reached over plaintext HBONE until they either re-register or the operator adds the networking.istio.io/tunnel=http label to their existing WorkloadEntry resource. This applies in ambient mode when workloads were registered prior to this release.

Key changes (8)

  • Behavior change: auto-registered workloads in ambient mode fall back to plaintext HBONE until re-registered or labeled with networking.istio.io/tunnel=http
  • Performance: XDS pushes for workload/service address changes scoped to affected waypoints only (can disable via AMBIENT_SCOPED_ADDRESS_PUSHES=false)
  • Fix: metadata-only VirtualService changes no longer trigger unnecessary XDS pushes to all proxies
  • Fix: pilot-agent now reloads certificates on Kubernetes secret rotations after the first rotation
  • Fix: remote cluster secrets picked up by istiod without restart, preventing cluster registry deadlock
  • Fix: waypoint proxies exit gracefully on ambient ingress gateways (EXIT_ON_ZERO_ACTIVE_CONNECTIONS now fires correctly)
  • Enhancement: custom taint name support for pilot node untaint controller via PILOT_NODE_UNTAINT_CONTROLLERS_TAINT_NAME
  • Plus ~6 additional fixes: ambient CNI deadlock, istiod memory leak, WasmPlugin cross-namespace crash-loop, cross-network RBAC blocking, Telemetry namespace scope, default HTTP retries for waypoint inbound routes
Source ↗All Istio releases →