What istio/istio shipped
Written by FoxPlug from public releases; not affiliated with Istio. An automatic summary of the public release, pull request and commit data of github.com/istio/istio. Istio did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 21, 2026
What shipped
- Workload and service collections now use pointers instead of values, providing more efficient queries for AddressInfo and WorkloadInfo in xDS generators, particularly for large meshes. Pull request #61622
- Fixed delayedClient.ShutdownHandler to remove only the specified handler instead of removing all handlers on the informer. Pull request #61828
- Fixed concurrent push context initialization when EDS debouncing is disabled via PILOT_ENABLE_EDS_DEBOUNCE=false. Pull request #61928
- Added context deadlines to all Kubernetes client operations to protect against networking and API server failures with blackholed responses. Pull request #61878
- Precomputed TCP configurations are now reused across all headless instances instead of being recalculated per pod, reducing CPU usage with large service configurations. Pull request #61896
- Optimized memory allocations in KRT event handling by eliminating unnecessary slice allocations and reusing key sets. Pull request #61879
- KRT now avoids unnecessary filter boxing during collection iteration when filters are not set, reducing allocations and performance overhead. Pull request #61532
- Added opt-in suppression of unchanged events in mapped KRT collections to eliminate redundant updates. Pull request #61880
- Ambient WASM tests on IPv6 clusters now work by allowlisting the test registry, fixing HTTPS downgrade restrictions. Pull request #61866
- Fixed remote JWKS cluster configuration for service targetRefs when using waypoints with remote JWKS fetching enabled. Pull request #61245
Why it matters
This week focused on performance improvements for large-scale deployments, memory allocation optimizations in KRT, and critical bug fixes for control plane reliability. The pointer conversion for collections and TCP config precomputation directly address scalability issues in large meshes, while deadline additions protect against networking failures.
Changelog entry
- Workload and service collections now use pointers instead of values for improved query efficiency Pull request #61622
- Fixed delayedClient.ShutdownHandler to remove only the specified handler Pull request #61828
- Fixed concurrent push context initialization when EDS debouncing is disabled Pull request #61928
- Added context deadlines to Kubernetes client operations Pull request #61878
- TCP configurations are now precomputed and reused across headless instances Pull request #61896
- Optimized memory allocations in KRT event handling Pull request #61879
- KRT avoids unnecessary filter boxing when filters are not set Pull request #61532
- Added opt-in suppression of unchanged events in mapped KRT collections Pull request #61880
- Ambient WASM tests on IPv6 clusters now work with test registry allowlisting Pull request #61866
- Fixed remote JWKS cluster configuration for service targetRefs with waypoints Pull request #61245
This week: switched workload/service collections to pointers for better query efficiency, fixed EDS debounce concurrent initialization, added K8s client deadlines for reliability, and optimized KRT allocations and TCP config precomputation for large-scale deployments.
Istio's latest updates focus on performance and reliability at scale. Key improvements include converting workload and service collections to pointers for more efficient xDS queries in large meshes, optimizing memory allocations in KRT event handling, precomputing TCP configurations to reduce CPU spikes, and adding context deadlines to all Kubernetes client operations to handle networking failures gracefully. These changes particularly benefit operators managing large deployments.
Week of September 14, 2026
What shipped
- Ambient mode now selects network gateways deterministically by sorting results, preventing repeated WDS pushes when multiple gateways exist per network. Pull request #61748
- Fixed istiod webhook caBundle becoming stale after istio-csr migration, which was causing sidecar injection failures until manual restart. Pull request #61779
- Resolved InferencePool endpoint pickers to be evaluated per backendRef instead of once per HTTPRoute rule, fixing traffic weighting across multiple pools. Pull request #61601
- Fixed DFP wildcard cluster panic when outlierDetection is applied by initializing CommonLbConfig. Pull request #61450
- Added optional timeout mechanism for pilot-agent to wait for the SDS provider's workload identity socket to become ready. Pull request #61524
- Restored skipped EDS check in partial push logic to prevent skippable configs from inadvertently triggering full pushes. Pull request #61811
- Route metadata from VirtualServices is now built once and reused across routes instead of being recreated. Pull request #61822
- Root namespace ProxyConfigs now support selectors for broader configuration applicability. Pull request #61632
- Telemetry image hubs are now configurable to allow pulling from VPC-local registries and reduce network egress costs. Pull request #61698
- Self-discovery cluster can now be resolved outside the sidecar's egress scope from the global service index. Pull request #61145
Why it matters
This week brought fixes for critical issues in ambient mode gateway selection, webhook certificate handling, and traffic routing that were causing production failures and unexpected behavior. Performance improvements in route metadata handling and push optimization reduce unnecessary configuration churn. New features for workload identity timeouts and configurable image hubs address operational needs.
Changelog entry
- ambient: network gateway selection now deterministic, sorted by resource order to prevent repeated WDS pushes Pull request #61748
- istiod: webhook caBundle now updates correctly when switching to external CA providers like istio-csr Pull request #61779
- gateway-api: InferencePool endpoint pickers resolved per backendRef for correct traffic weighting Pull request #61601
- xds: DFP wildcard cluster CommonLbConfig initialized to prevent panics with outlierDetection Pull request #61450
- pilot-agent: configurable timeout for workload identity socket readiness Pull request #61524
- xds: partial push optimization restores skipped EDS check to prevent unintended full pushes Pull request #61811
- routing: VirtualService route metadata now built once and reused across routes Pull request #61822
- config: ProxyConfig selectors now supported in root namespaces Pull request #61632
- telemetry: image hub sources now configurable for cost optimization Pull request #61698
- xds: self-discovery cluster resolution now respects egress scope boundaries Pull request #61145
Istio this week: fixed ambient mode gateway flipping, webhook cert staleness, InferencePool traffic weighting, and added workload identity socket timeouts. Release branch updates rolling out deterministic gateway selection.
Istio shipped critical stability fixes this week. Ambient mode now selects network gateways deterministically, preventing repeated pushes. Fixed webhook certificate staleness after istio-csr migration that broke sidecar injection. InferencePool traffic weighting now correctly evaluates per backend. Added configurable image hubs to reduce network costs. These changes improve reliability across sidecar and ambient deployments.