Announcing Istio 1.8.6

Patch Release

This release fixes the security vulnerabilities described in our May 11th posts, ISTIO-SECURITY-2021-005 and ISTIO-SECURITY-2021-006.

Security update


  • Added security best practice for authorization policies

  • Fixed istiod so it will no longer generate listeners for privileged gateway ports (<1024) if the gateway Pod does not have sufficient permissions. Issue 27566

  • Fixed an issue where transport socket parameters are now taken into account when configured in EnvoyFilter. Issue 28996

  • Fixed PeerAuthentication to not turn off mTLS while using multi-network, non-mTLS endpoints from the cross-network load-balancing endpoints to prevent 500 errors. Issue 28798

  • Fixed a bug causing runaway logs in istiod after disabling the default ingress controller. Issue 31336

  • Fixed the Kubernetes API server so it is now considered to be cluster-local by default . This means that any pod attempting to reach kubernetes.default.svc will always be directed to the in-cluster server. Issue 31340

  • Fixed Istio operator to prune resources that do not belong to the specific Istio operator CR. Issue 30833

Was this information useful?
Do you have any suggestions for improvement?

Thanks for your feedback!