Istio
1.32.0Networking & Messaging2026年11月9日
Gateway API、トラフィック管理、セキュリティ、テレメトリー、運用面にわたる機能拡張と設定変更が含まれます。チャート設定の整理に加え、利用者が選択して有効化する設定も追加されています。
要対応 (1)
breakingチャートからの
GOMAXPROCS削除すべてのチャートから
GOMAXPROCSの設定が削除されました。GoがCPU制限に基づいて自動的に値を設定するためです。
その他の記録済み変更 18 件すべてadditions 13 · value changes 3 · constraints 2
additions (13)
- - AuthorizationPolicy targeting HTTPRoute . As an experimental feature, AuthorizationPolicy can now target Gateway API HTTPRoute resources via targetRefs , so ALLOW and DENY rules apply only to traffic matched by that route.
- - TLS tuning on gateways. TLS-terminating gateways can override the advertised ALPN protocols with alpnProtocols and configure ECDH curves with ecdhCurves .
- - Experimental XBackend support for describing how clients must connect to specific destinations.
- - One east-west gateway for mixed meshes. An istio-east-west gateway can now also serve sidecar multi-network traffic through an AUTO_PASSTHROUGH listener on port 15443, so a mesh with both ambient and sidecar workloads no longer needs a separate east-west gateway for sidecars in each cluster. This requires AMBIENT_ENABLE_MULTI_NETWORK .
- - Utilization-based load balancing. A new backendUtilization policy on DestinationRule uses backend-reported ORCA load reports to send fewer requests to busier endpoints.
- - Richer outlier detection. DestinationRule.OutlierDetection adds outlierDetectionHttpErrorCodes , to choose which HTTP status codes count as errors, and failurePercentageThreshold , to eject hosts based on failure rate.
- - Configurable inbound retries. The new defaultInboundHttpRetryPolicy mesh config field configures, or disables with {} , the default retry policy on sidecar inbound routes.
- - EnvoyFilter transport socket matching. Filter chain matches can now select by transportSocket , so patches precisely target chains that terminate TLS.
- - presence for JWT rules. RequestAuthentication jwtRules can be marked REQUIRED , rejecting requests that are missing that token even when other rules are satisfied.
- - PILOT_DISABLE_SELF_SIGNED_CA makes istiod fail to start its CA instead of generating or reusing a self-signed root.
- - Native Prometheus histograms. pilot-agent ’s metrics merger passes through the Prometheus protobuf format when scrapers request it, with a new istio_agent_scrape_format_total counter reporting the negotiated format.
- - IST0178 analyzer warning when an EnvoyFilter inserts an HTTP filter alongside an AuthorizationPolicy that targets an HTTPRoute
- - Kubernetes API client timeouts in Istio components, configurable via ISTIO_KUBE_HEADER_TIMEOUT and ISTIO_KUBE_REQUEST_TIMEOUT
value changes (3)
- - agentgateway now honors Gateway API frontend client certificate validation.
- - Native Prometheus histograms. pilot-agent ’s metrics merger passes through the Prometheus protobuf format when scrapers request it, with a new istio_agent_scrape_format_total counter reporting the negotiated format.
- - ServiceEntry validation warnings for catch-all and very broad addresses
constraints (2)
- - Mesh-wide ProxyConfig with selectors. ProxyConfig resources with workload selectors in the root namespace now apply to matching workloads in all namespaces.
- - Headless TCP services can opt in to a single wildcard listener instead of one listener per pod IP
Istioをスタックに追加
対応が必要なリリースが出たときに、週次メールでお知らせします。 今回の破壊的変更も、その一例です。