RATATOSKRATATOSK
로그인

Istio

1.32.0Networking & Messaging
2026년 11월 9일

ACTION 1OTHER 18

Gateway API, 트래픽 관리, 보안, 텔레메트리, 운영 기능이 확장된 릴리스입니다. 차트 설정이 하나 제거되고 선택적으로 사용할 수 있는 설정도 새로 추가됐습니다.

조치 필요 (1)

  • breaking차트의 GOMAXPROCS 설정 제거

    모든 차트에서 GOMAXPROCS 설정을 제거했습니다. 이제 Go가 CPU 제한을 기준으로 값을 자동 설정합니다.

그 외 기록된 변경 18건 전체additions 13 · value changes 3 · constraints 2

additions (13)

  • - AuthorizationPolicy targeting HTTPRoute . As an experimental feature, AuthorizationPolicy can now target Gateway API HTTPRoute resources via targetRefs , so ALLOW and DENY rules apply only to traffic matched by that route.
  • - TLS tuning on gateways. TLS-terminating gateways can override the advertised ALPN protocols with alpnProtocols and configure ECDH curves with ecdhCurves .
  • - Experimental XBackend support for describing how clients must connect to specific destinations.
  • - One east-west gateway for mixed meshes. An istio-east-west gateway can now also serve sidecar multi-network traffic through an AUTO_PASSTHROUGH listener on port 15443, so a mesh with both ambient and sidecar workloads no longer needs a separate east-west gateway for sidecars in each cluster. This requires AMBIENT_ENABLE_MULTI_NETWORK .
  • - Utilization-based load balancing. A new backendUtilization policy on DestinationRule uses backend-reported ORCA load reports to send fewer requests to busier endpoints.
  • - Richer outlier detection. DestinationRule.OutlierDetection adds outlierDetectionHttpErrorCodes , to choose which HTTP status codes count as errors, and failurePercentageThreshold , to eject hosts based on failure rate.
  • - Configurable inbound retries. The new defaultInboundHttpRetryPolicy mesh config field configures, or disables with {} , the default retry policy on sidecar inbound routes.
  • - EnvoyFilter transport socket matching. Filter chain matches can now select by transportSocket , so patches precisely target chains that terminate TLS.
  • - presence for JWT rules. RequestAuthentication jwtRules can be marked REQUIRED , rejecting requests that are missing that token even when other rules are satisfied.
  • - PILOT_DISABLE_SELF_SIGNED_CA makes istiod fail to start its CA instead of generating or reusing a self-signed root.
  • - Native Prometheus histograms. pilot-agent ’s metrics merger passes through the Prometheus protobuf format when scrapers request it, with a new istio_agent_scrape_format_total counter reporting the negotiated format.
  • - IST0178 analyzer warning when an EnvoyFilter inserts an HTTP filter alongside an AuthorizationPolicy that targets an HTTPRoute
  • - Kubernetes API client timeouts in Istio components, configurable via ISTIO_KUBE_HEADER_TIMEOUT and ISTIO_KUBE_REQUEST_TIMEOUT

value changes (3)

  • - agentgateway now honors Gateway API frontend client certificate validation.
  • - Native Prometheus histograms. pilot-agent ’s metrics merger passes through the Prometheus protobuf format when scrapers request it, with a new istio_agent_scrape_format_total counter reporting the negotiated format.
  • - ServiceEntry validation warnings for catch-all and very broad addresses

constraints (2)

  • - Mesh-wide ProxyConfig with selectors. ProxyConfig resources with workload selectors in the root namespace now apply to matching workloads in all namespaces.
  • - Headless TCP services can opt in to a single wildcard listener instead of one listener per pod IP
Istio 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗Istio 릴리스 전체 →