Cloud Service Mesh release notes

For the clusters using TRAFFIC_DIRECTOR implementation, IP auto-allocation with DNS Proxy is now supported in Rapid release channel.

The Envoy Compressor Filter is now GA in the stable release channel.

The Envoy Lua Filter is now available as a preview feature in the stable release channel.

1.29.5-asm.12 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.12 uses Envoy v1.35.13.

Patch 1.29.5-asm.12 contains fixes for the following platform CVEs:

1.28.10-asm.4 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.10-asm.4 uses Envoy v1.36.9.

Patch 1.28.10-asm.4 contains fixes for the following platform CVEs:

1.27.9-asm.15 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.15 uses Envoy v1.35.13v.

Patch 1.27.9-asm.15 contains fixes for the following platform CVEs:

The Envoy Compressor Filter is now GA in the regular release channel.

The Envoy Lua Filter is now available as a preview feature in the regular release channel.

1.29.5-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.5 uses Envoy v1.37.5.

1.28.9-asm.4 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.4 uses Envoy v1.36.9.

1.27.9-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.9 uses Envoy v1.35.13.

Proxy version csm_mesh_proxy.csm_mesh_proxy.20260624e_RC01 for Gateway API on GKE clusters is rolling out to all Managed Cloud Service Mesh release channels over the next week.

This patch release contains the fixes for the security vulnerabilities listed in GCP-2026-040.

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.38, is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.88 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.78 is rolling out to the stable release channel.

These patch releases contain the fix for the vulnerability listed in GCP-2026-040.

These rollouts will preempt those previously announced on June 12, 2026.

1.29.5-asm.3 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.3 uses Envoy v1.37.5-dev.

This patch release also contain the fixes for the following CVEs:

1.28.9-asm.2 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.2 uses Envoy v1.36.9-dev.

This patch release also contain the fixes for the following CVEs:

1.27.9-asm.8 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.8 uses Envoy v1.35.13-dev.

This patch release also contain the fixes for the following CVEs:

The Envoy Lua Filter is now available as a preview feature in the rapid release channel.

The Envoy Compressor Filter is now GA in the rapid release channel.

To ensure your EnvoyFilter compressor configuration is fully supported, see Modernize EnvoyFilter compressor configurations.

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.36, is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.86 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.76 is rolling out to the stable release channel.

These rollouts will preempt those previously announced on June 3, 2026.

These patch releases contain the fix for the vulnerability listed in GCP-2026-035

Proxy version csm_mesh_proxy.20260423_RC03 for Gateway API on GKE clusters is rolling out to all Managed Cloud Service Mesh release channels over the next week.

1.29.4-asm.0 is now available for in-cluster Cloud Service Mesh.

You can now download 1.29.4-asm.0 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.29.4 subject to the list of supported features.

The following environment variables, labels, and annotations are not supported:

• PILOT_IGNORE_RESOURCES and PILOT_INCLUDE_RESOURCES
• RetryIgnorePreviousHosts
• omit_empty_values
• PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY
• MAX_CONNECTIONS_PER_SOCKET_EVENT_LOOP with the value 1
• PILOT_DNS_JITTER_DURATION
• PILOT_DNS_JITTER_DURATION
• ENABLE_NATIVE_SIDECARS with the value true
• PILOT_IP_AUTOALLOCATE_IPV4_PREFIX and PILOT_IP_AUTOALLOCATE_IPV6_PREFIX
• PILOT_DNS_CARES_UDP_MAX_QUERIES
• ENABLE_WILDCARD_HOST_SERVICE_ENTRIES_FOR_TLS
• 'BLOCKED_CIDRS_IN_JWKS_URIS`
• ENABLE_DEBUG_ENDPOINT_AUTH
• DISABLE_TRACK_REMAINING_CB_METRICS
• gateway.istio.io/tls-cipher-suites
• fileFlushMinSizeKB and fileFlushInterval settings in ProxyConfig
• topology.istio.io/locality
• statsCompression ProxyConfig option
• proxy.istio.io/config annotation for metric compression overrides

Istio's experimental feature to enable lazy subset creation of envoy statistics is not supported.

The formatter option within the spec.tracing[].customTags field of the Telemetry custom resource (telemetry.istio.io) is unsupported.

The istiod_remote_cluster_sync_status Prometheus gauge metric, exposed on the Istiod control plane metrics endpoint (port 15014 /metrics), is not supported.

The following are unsupported for proxyless gRPC clients:

• Configuring the LEAST_REQUEST load balancing policy within the spec.trafficPolicy.loadBalancer.simple field of a DestinationRule custom resource (networking.istio.io)

• Configuring the http2MaxRequests circuit breaker within the spec.trafficPolicy.connectionPool.http.http2MaxRequests field of a DestinationRule custom resource (networking.istio.io)

The ENABLE_AUTO_SNI flag is still supported to keep aligned with the legacy behavior.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.29.4-asm.0 uses Envoy v1.37.4-dev.

In-cluster Cloud Service Mesh 1.26 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

The rollouts previously announced on June 3, 2026 have been stopped. The following release will supersede them and include those patches and the fix for the vulnerability listed in GCP-2026-035.

1.28.7-asm.4 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.7-asm.4 uses Envoy v1.36.8-dev.

1.27.9-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.5 uses Envoy v1.35.12-dev.

1.26.8-asm.11 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.11 uses Envoy v1.34.14.

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.32 is rolling out to the rapid release channel.
• The regular release channel is being upgraded from 1.20 to 1.21.6-asm.32.
• The stable release channel is being upgraded from 1.19 to 1.20.8-asm.80.

These patch releases contain the fixes for the following CVEs:

1.28.7-asm.3 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.7-asm.3 uses Envoy v1.36.7-dev.

Patch 1.28.7-asm.3 contains fixes for the following platform CVEs: