Change Notes

3 minute read

General

Added traffic.sidecar.istio.io/includeInboundPorts annotation to eliminate the need for service owner to declare containerPort in the deployment yaml file. This will become the default in a future release.
Added IPv6 experimental support for Kubernetes clusters.

Improved locality based routing in multicluster environments.
Improved outbound traffic policy in ALLOW_ANY mode. Traffic for unknown HTTP/HTTPS hosts on an existing port will be forwarded as is. Unknown traffic will be logged in Envoy access logs.
Added support for setting HTTP idle timeouts to upstream services.
Improved Sidecar support for NONE mode (without iptables) .
Added ability to configure the DNS refresh rate for sidecar Envoys, to reduce the load on the DNS servers.
Graduated Sidecar API from Alpha to Alpha API and Beta runtime.

Improved extend the default lifetime of self-signed Citadel root certificates to 10 years.
Added Kubernetes health check prober rewrite per deployment via sidecar.istio.io/rewriteAppHTTPProbers: "true" in the PodSpec annotation.
Added support for configuring the secret paths for Istio mutual TLS certificates. Refer here for more details.
Added support for PKCS 8 private keys for workloads, enabled by the flag pkcs8-keys on Citadel.
Improved JWT public key fetching logic to be more resilient to network failure.
Fixed SAN field in workload certificates is set as critical. This fixes the issue that some custom certificate verifiers cannot verify Istio certificates.
Fixed mutual TLS probe rewrite for HTTPS probes.
Graduated SNI with multiple certificates support at ingress gateway from Alpha to Stable.
Graduated certification management on Ingress Gateway from Alpha to Beta.

Added Full support for control over Envoy stats generation, based on stats prefixes, suffixes, and regular expressions through the use of annotations.
Changed Prometheus generated traffic is excluded from metrics.
Added support for sending traces to Datadog.
Graduated distributed tracing from Beta to Stable.

Updated default proxy memory limit size(global.proxy.resources.limits.memory) from 128Mi to 1024Mi to ensure proxy has sufficient memory.
Added pod anti-affinity and toleration support to all of our control plane components.
Added sidecarInjectorWebhook.neverInjectSelector and sidecarInjectorWebhook.alwaysInjectSelector to allow users to further refine whether workloads should have sidecar automatically injected or not, based on label selectors.
Added global.logging.level and global.proxy.logLevel to allow users to easily configure logs for control plane and data plane components globally.
Added support to configure the Datadog location via global.tracer.datadog.address.
Removed Previously deprecated Adapter and Template CRDs are disabled by default. Use mixer.templates.useTemplateCRDs=true and mixer.adapters.useAdapterCRDs=true install options to re-enable them.

Refer to the installation option change page to view the complete list of changes.

Graduated istioctl verify-install out of experimental.
Improved istioctl verify-install to validate if a given Kubernetes environment meets Istio’s prerequisites.
Added auto-completion support to istioctl.
Added istioctl experimental dashboard to allow users to easily open the web UI of any Istio addons.
Added istioctl x alias to conveniently run istioctl experimental command.
Improved istioctl version to report both Istio control plane and istioctl version info by default.
Improved istioctl validate to validate Mixer configuration and supports deep validation with referential integrity.

Added Istio CNI support to setup sidecar network redirection and remove the use of istio-init containers requiring NET_ADMIN capability.
Added a new experimental ‘a-la-carte’ Istio installer to enable users to install and upgrade Istio with desired isolation and security.
Added environment variable and configuration file support for configuring Galley, in addition to command-line flags.
Added ControlZ support to visualize the state of the MCP Server in Galley.
Added the enableServiceDiscovery command-line flag to control the service discovery module in Galley.
Added InitialWindowSize and InitialConnWindowSize parameters to Galley and Pilot to allow fine-tuning of MCP (gRPC) connection settings.
Graduated configuration processing with Galley from Alpha to Beta.