RATATOSKRATATOSK
Sign in

Istio

1.32.0Networking & Messaging
Nov 9, 2026

ACTION 1OTHER 18

A feature-rich release adds Gateway API, traffic-management, security, telemetry, and operational capabilities. It also removes the `GOMAXPROCS` chart setting and introduces several opt-in settings.

Action needed (1)

  • breakingThe GOMAXPROCS chart setting, removed

    GOMAXPROCS was removed from all charts because Go now sets it automatically from CPU limits.

All 18 other recorded changesadditions 13 · value changes 3 · constraints 2

additions (13)

  • - AuthorizationPolicy targeting HTTPRoute . As an experimental feature, AuthorizationPolicy can now target Gateway API HTTPRoute resources via targetRefs , so ALLOW and DENY rules apply only to traffic matched by that route.
  • - TLS tuning on gateways. TLS-terminating gateways can override the advertised ALPN protocols with alpnProtocols and configure ECDH curves with ecdhCurves .
  • - Experimental XBackend support for describing how clients must connect to specific destinations.
  • - One east-west gateway for mixed meshes. An istio-east-west gateway can now also serve sidecar multi-network traffic through an AUTO_PASSTHROUGH listener on port 15443, so a mesh with both ambient and sidecar workloads no longer needs a separate east-west gateway for sidecars in each cluster. This requires AMBIENT_ENABLE_MULTI_NETWORK .
  • - Utilization-based load balancing. A new backendUtilization policy on DestinationRule uses backend-reported ORCA load reports to send fewer requests to busier endpoints.
  • - Richer outlier detection. DestinationRule.OutlierDetection adds outlierDetectionHttpErrorCodes , to choose which HTTP status codes count as errors, and failurePercentageThreshold , to eject hosts based on failure rate.
  • - Configurable inbound retries. The new defaultInboundHttpRetryPolicy mesh config field configures, or disables with {} , the default retry policy on sidecar inbound routes.
  • - EnvoyFilter transport socket matching. Filter chain matches can now select by transportSocket , so patches precisely target chains that terminate TLS.
  • - presence for JWT rules. RequestAuthentication jwtRules can be marked REQUIRED , rejecting requests that are missing that token even when other rules are satisfied.
  • - PILOT_DISABLE_SELF_SIGNED_CA makes istiod fail to start its CA instead of generating or reusing a self-signed root.
  • - Native Prometheus histograms. pilot-agent ’s metrics merger passes through the Prometheus protobuf format when scrapers request it, with a new istio_agent_scrape_format_total counter reporting the negotiated format.
  • - IST0178 analyzer warning when an EnvoyFilter inserts an HTTP filter alongside an AuthorizationPolicy that targets an HTTPRoute
  • - Kubernetes API client timeouts in Istio components, configurable via ISTIO_KUBE_HEADER_TIMEOUT and ISTIO_KUBE_REQUEST_TIMEOUT

value changes (3)

  • - agentgateway now honors Gateway API frontend client certificate validation.
  • - Native Prometheus histograms. pilot-agent ’s metrics merger passes through the Prometheus protobuf format when scrapers request it, with a new istio_agent_scrape_format_total counter reporting the negotiated format.
  • - ServiceEntry validation warnings for catch-all and very broad addresses

constraints (2)

  • - Mesh-wide ProxyConfig with selectors. ProxyConfig resources with workload selectors in the root namespace now apply to matching workloads in all namespaces.
  • - Headless TCP services can opt in to a single wildcard listener instead of one listener per pod IP
Add Istio to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Official release note ↗All Istio releases →