Cloud Service Mesh release notes

For the clusters using TRAFFIC_DIRECTOR implementation, IP auto-allocation with DNS Proxy is now supported in Rapid release channel.

The Envoy Compressor Filter is now GA in the stable release channel.

The Envoy Lua Filter is now available as a preview feature in the stable release channel.

1.29.5-asm.12 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.12 uses Envoy v1.35.13.

Patch 1.29.5-asm.12 contains fixes for the following platform CVEs:

1.28.10-asm.4 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.10-asm.4 uses Envoy v1.36.9.

Patch 1.28.10-asm.4 contains fixes for the following platform CVEs:

1.27.9-asm.15 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.15 uses Envoy v1.35.13v.

Patch 1.27.9-asm.15 contains fixes for the following platform CVEs:

The Envoy Compressor Filter is now GA in the regular release channel.

The Envoy Lua Filter is now available as a preview feature in the regular release channel.

1.29.5-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.5 uses Envoy v1.37.5.

1.28.9-asm.4 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.4 uses Envoy v1.36.9.

1.27.9-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.9 uses Envoy v1.35.13.

Proxy version csm_mesh_proxy.csm_mesh_proxy.20260624e_RC01 for Gateway API on GKE clusters is rolling out to all Managed Cloud Service Mesh release channels over the next week.

This patch release contains the fixes for the security vulnerabilities listed in GCP-2026-040.

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.38, is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.88 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.78 is rolling out to the stable release channel.

These patch releases contain the fix for the vulnerability listed in GCP-2026-040.

These rollouts will preempt those previously announced on June 12, 2026.

1.29.5-asm.3 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.3 uses Envoy v1.37.5-dev.

This patch release also contain the fixes for the following CVEs:

1.28.9-asm.2 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.2 uses Envoy v1.36.9-dev.

This patch release also contain the fixes for the following CVEs:

1.27.9-asm.8 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.8 uses Envoy v1.35.13-dev.

This patch release also contain the fixes for the following CVEs:

The Envoy Lua Filter is now available as a preview feature in the rapid release channel.

The Envoy Compressor Filter is now GA in the rapid release channel.

To ensure your EnvoyFilter compressor configuration is fully supported, see Modernize EnvoyFilter compressor configurations.

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.36, is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.86 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.76 is rolling out to the stable release channel.

These rollouts will preempt those previously announced on June 3, 2026.

These patch releases contain the fix for the vulnerability listed in GCP-2026-035

Proxy version csm_mesh_proxy.20260423_RC03 for Gateway API on GKE clusters is rolling out to all Managed Cloud Service Mesh release channels over the next week.

1.29.4-asm.0 is now available for in-cluster Cloud Service Mesh.

You can now download 1.29.4-asm.0 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.29.4 subject to the list of supported features.

The following environment variables, labels, and annotations are not supported:

• PILOT_IGNORE_RESOURCES and PILOT_INCLUDE_RESOURCES
• RetryIgnorePreviousHosts
• omit_empty_values
• PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY
• MAX_CONNECTIONS_PER_SOCKET_EVENT_LOOP with the value 1
• PILOT_DNS_JITTER_DURATION
• PILOT_DNS_JITTER_DURATION
• ENABLE_NATIVE_SIDECARS with the value true
• PILOT_IP_AUTOALLOCATE_IPV4_PREFIX and PILOT_IP_AUTOALLOCATE_IPV6_PREFIX
• PILOT_DNS_CARES_UDP_MAX_QUERIES
• ENABLE_WILDCARD_HOST_SERVICE_ENTRIES_FOR_TLS
• 'BLOCKED_CIDRS_IN_JWKS_URIS`
• ENABLE_DEBUG_ENDPOINT_AUTH
• DISABLE_TRACK_REMAINING_CB_METRICS
• gateway.istio.io/tls-cipher-suites
• fileFlushMinSizeKB and fileFlushInterval settings in ProxyConfig
• topology.istio.io/locality
• statsCompression ProxyConfig option
• proxy.istio.io/config annotation for metric compression overrides

Istio's experimental feature to enable lazy subset creation of envoy statistics is not supported.

The formatter option within the spec.tracing[].customTags field of the Telemetry custom resource (telemetry.istio.io) is unsupported.

The istiod_remote_cluster_sync_status Prometheus gauge metric, exposed on the Istiod control plane metrics endpoint (port 15014 /metrics), is not supported.

The following are unsupported for proxyless gRPC clients:

• Configuring the LEAST_REQUEST load balancing policy within the spec.trafficPolicy.loadBalancer.simple field of a DestinationRule custom resource (networking.istio.io)

• Configuring the http2MaxRequests circuit breaker within the spec.trafficPolicy.connectionPool.http.http2MaxRequests field of a DestinationRule custom resource (networking.istio.io)

The ENABLE_AUTO_SNI flag is still supported to keep aligned with the legacy behavior.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.29.4-asm.0 uses Envoy v1.37.4-dev.

In-cluster Cloud Service Mesh 1.26 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

The rollouts previously announced on June 3, 2026 have been stopped. The following release will supersede them and include those patches and the fix for the vulnerability listed in GCP-2026-035.

1.28.7-asm.4 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.7-asm.4 uses Envoy v1.36.8-dev.

1.27.9-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.5 uses Envoy v1.35.12-dev.

1.26.8-asm.11 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.11 uses Envoy v1.34.14.

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.32 is rolling out to the rapid release channel.
• The regular release channel is being upgraded from 1.20 to 1.21.6-asm.32.
• The stable release channel is being upgraded from 1.19 to 1.20.8-asm.80.

These patch releases contain the fixes for the following CVEs:

1.28.7-asm.3 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.7-asm.3 uses Envoy v1.36.7-dev.

Patch 1.28.7-asm.3 contains fixes for the following platform CVEs:

1.27.9-asm.4 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.4 uses Envoy v1.35.10-dev.

Patch 1.27.9-asm.4 contains fixes for the following platform CVEs:

1.26.8-asm.10 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.10 uses Envoy v1.34.14.

Patch 1.26.8-asm.10 contains fixes for the following platform CVEs:

Managed Cloud Service Mesh using the TRAFFIC_DIRECTOR implementation in the stable channel now supports a limited implementation of the EnvoyFilter API. To learn about the supported fields, extensions, and how to use EnvoyFilter for features like local rate limiting see Data plane extensibility with EnvoyFilter.

To troubleshoot any issue while configuring, see Resolving data plane extensibility issues.

Cloud Service Mesh can now report a status code to indicate whether an Istio API is accepted or rejected. You can view the status code on the resource and mesh state. For more information see MembershipState Error Codes.

Proxy version csm_mesh_proxy.20260423_RC03 is rolling out to all Managed Cloud Service Mesh release channels over the next week.

Managed Cloud Service Mesh using the TRAFFIC_DIRECTOR implementation in the regular channel now supports a limited implementation of the EnvoyFilter API. To learn about the supported fields, extensions, and how to use EnvoyFilter for features like local rate limiting see Data plane extensibility with EnvoyFilter.

To troubleshoot any issue while configuring, see Resolving data plane extensibility issues.

1.28.5-asm.12 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.5-asm.12 uses Envoy 1.36.5-dev.

1.27.8-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.8-asm.9 uses Envoy 1.35.10-dev.

1.26.8-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.5 uses Envoy 1.34.14-dev.

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.19 is rolling out to the rapid release channel.
• 1.20.8-asm.73 is rolling out to the regular release channel.
• 1.19.10-asm.66 is rolling out to the stable release channel.

These patch releases contain the fixes for the following CVEs:

Managed Cloud Service Mesh using the TRAFFIC_DIRECTOR implementation now supports a limited implementation of the EnvoyFilter API. To learn about the supported fields, extensions, and how to use EnvoyFilter for features like local rate limiting see Data plane extensibility with EnvoyFilter.

To troubleshoot any issue while configuring, see Resolving data plane extensibility issues.

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.16 is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.68 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.61 is rolling out to the stable release channel.
• CNI and managed data plane controller version 1.23.6-asm.31 is rolling out to all release channels.

These rollouts will preempt those previously announced on February 9, 2026.

Managed Cloud Service Mesh will start using proxy version csm_mesh_proxy.20260304_RC00 for Gateway API on GKE clusters for all channels. This proxy version maps closest to Envoy version 1.37.

These patch releases contain the fixes for the vulnerabilities listed in GCP-2026-013 as well as fixes for the following platform CVEs:

1.28.5-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2026-013 as well as fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.5-asm.9 uses Envoy 1.36.5.

1.27.8-asm.7 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2026-013 as well as fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.8-asm.7 uses Envoy 1.35.9.

1.26.8-asm.3 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2026-013 as well as fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.3 uses Envoy 1.34.13.

CNI and managed data plane controller version 1.23.6-asm.28 is rolling out to all release channels.

While the managed data plane automatically updates Envoy Proxies by restarting workloads, you must manually restart any StatefulSets and Jobs.

This patch includes the fix for the following CVEs:

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.10 is rolling out to the rapid release channel.
• 1.20.8-asm.63 is rolling out to the regular release channel.
• 1.19.10-asm.57 is rolling out to the stable release channel.

These patch releases contain the fixes for the following managed Cloud Service Mesh CVEs:

1.28.2-asm.4 is now available for in-cluster Cloud Service Mesh.

You can now download 1.28.2-asm.4 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.28.0 subject to the list of supported features.

The following environment variables, fields, and annotations are not supported:

• PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY
• Additional attributes for HTTPCookie in the DestinationRule API
• caCertCredentialName field in ServerTLSSettings API
• Optional NetworkPolicy for Istiod deployment
• Disable shadow host suffix
• MAX_CONNECTIONS_PER_SOCKET_EVENT_LOOP

Istio dual stack is not supported

Istio's experimental feature to enable lazy subset creation of envoy statistics is not supported.

The ENABLE_AUTO_SNI flag is still supported to stay aligned with legacy behavior.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.28.2-asm.4 uses Envoy v1.36.5-dev.

1.27.5-asm.0 is now available for in-cluster Cloud Service Mesh.

You can now download 1.27.5-asm.0 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.27.5 subject to the list of supported features. Cloud Service Mesh version 1.27.5-asm.0 uses envoy v1.35.9-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.26.8-asm.1 is now available for in-cluster Cloud Service Mesh.

You can now download 1.26.8-asm.1 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.26.8 subject to the list of supported features. Cloud Service Mesh version 1.26.8-asm.1 uses envoy v1.34.11.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

In-cluster Cloud Service Mesh 1.25 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.8 is rolling out to the rapid release channel.
• 1.20.8-asm.60 is rolling out to the regular release channel.
• 1.19.10-asm.55 is rolling out to the stable release channel.

These patch releases contain the fixes for the following managed Cloud Service Mesh CVEs:

Regional Cloud Service Mesh is now available as a public preview feature. See Regional Cloud Service Mesh for more information.

Managed Cloud Service Mesh will start using proxy version csm_mesh_proxy.20251121c_RC00 for Gateway API on GKE clusters. This proxy version maps closest to Envoy version 1.37. This change is rolling out to all release channels and contains the fix for the managed Cloud Service Mesh security vulnerability listed in GCP-2025-073.

1.25.6-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-073. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.25.6-asm.1 uses Envoy v1.33.13.

1.26.7-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-073. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.26.7-asm.1 uses Envoy v1.34.11.

1.27.4-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-073. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.27.4-asm.1 uses Envoy v1.35.7.

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.7 is rolling out to the rapid release channel.
• 1.20.8-asm.59 is rolling out to the regular release channel.
• 1.19.10-asm.54 is rolling out to the stable release channel.

These patch releases contain the fix for the managed Cloud Service Mesh security vulnerability listed in GCP-2025-073.

The following rollouts have completed for managed Cloud Service Mesh:

• 1.21.6-asm.4 has rolled out to the rapid release channel.
• 1.20.8-asm.56 has rolled out to the regular release channel.
• 1.19.10-asm.52 has rolled out to the stable release channel.
• CNI and MDPC version 1.20.8-asm.56 has rolled out to all release channels.

While the managed data plane automatically updates Envoy Proxies by restarting workloads, you must manually restart any StatefulSets and Jobs.

1.27.2-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-064. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.27.2-asm.1 uses Envoy v1.35.6.

1.26.5-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-064. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.26.5-asm.1 uses Envoy v1.34.10.

1.25.5-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2025-064. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.25.5-asm.9 uses Envoy v1.33.12.

These patches contain fixes for the following CVEs:

1.21.6-asm.4

1.20.8-asm.55

1.19.10-asm.52

CNI & MDPC

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.4 is rolling out to the rapid release channel.
• 1.20.8-asm.56 is rolling out to the regular release channel.
• 1.19.10-asm.52 is rolling out to the stable release channel.

CNI/managed data plane controller version 1.20.8-asm.56 is rolling out to all release channels.

The promotion of 1.21 to the Rapid release channel included upstream breaking changes to ExternalName and auto-sni when using the ISTIOD implementation. After considering the impact on customers, we have decided to restore the previous behavior from 1.20 and earlier for managed Cloud Service Mesh clusters using the ISTIOD implementation to match Rapid clusters using the TRAFFIC_DIRECTOR implementation. These changes are rolling out to the Rapid release channel in version 1.21.5-asm.55 or later.

• If you are using an ExternalName service in the Rapid channel without a port description, the ExternalName service will not be translated into Cluster in the Envoy configuration. If the ExternalName service is a destination of VirtualService or ExternalName service is used with REGISTRY_ONLY mode, you must specify the port in the service like in 1.20 and earlier.

• If you have an external service multiplexing traffic based on SNI but the corresponding DestinationRule doesn't have an explicit SNI, you must set SNI properly.

In-cluster Cloud Service Mesh 1.24 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

1.25.5-asm.7 is now available for in-cluster Cloud Service Mesh.

You can now download 1.25.5-asm.7 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.25.5 subject to the list of supported features. Cloud Service Mesh version 1.25.5-asm.7 uses envoy v1.33.10-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.26.4-asm.7 includes the fixes for the following CVEs:

1.27.1-asm.5 is now available for in-cluster Cloud Service Mesh.

You can now download 1.27.1-asm.5 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.27.1 subject to the list of supported features.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.27.1-asm.5 uses Envoy v1.35.4-dev.

1.27.1-asm.5 includes the fixes for the following CVEs:

1.25.5-asm.7 includes the fixes for the following CVEs:

1.26.4-asm.7 is now available for in-cluster Cloud Service Mesh.

You can now download 1.26.4-asm.7 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.26.4 subject to the list of supported features.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.26.4-asm.7 uses Envoy v1.34.8-dev.

Managed Cloud Service Mesh with a TD control plane in the Rapid release channel will start using proxy images with an internal envoy version.

All features supported by Managed (TD) control planes are supported by this proxy. To identify which proxy version is used in a cluster, see Identify the proxy versions used in the cluster.

This release uses the version csm_istio_proxy_20250611.00_p0. More details about the proxy version can be found on the Versions page.

You can now configure traffic routing using Cloud Service Mesh service routing APIs between Cloud Run and Cloud Run, Google Kubernetes Engine, and Google Compute Engine services. (GA).

CNI/managed data plane controller version 1.23.6-asm.15 is rolling out to all release channels.

Support for the following features will end on March 17, 2027:

• GKE on AWS
• GKE on Azure
• EKS Attached Clusters on AWS
• Azure Attached Clusters with AKS

Note that there are no changes to the other features of GKE attached clusters or Google Distributed Cloud (software only or air-gapped),

You must migrate to an alternative service mesh solution or an alternative Istio-based solution using your existing CSM configuration files by March 17, 2027.

1.27.1-asm.2 is now available for in-cluster Cloud Service Mesh.

You can now download 1.27.1-asm.2 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.27.1 subject to the list of supported features.

The following environment variables and annotations are not supported:

• ENVOY_STATUS_PORT_ENABLE_PROXY_PROTOCOL
• PILOT_DNS_CARES_UDP_MAX_QUERIES
• PILOT_IP_AUTOALLOCATE_IPV4_PREFIX and PILOT_IP_AUTOALLOCATE_IPV6_PREFIX
• sidecar.istio.io/bootstrapOverride

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.27.1-asm.2 uses Envoy v 1.35.3-dev.

The following rollouts have completed for managed Cloud Service Mesh:

• 1.21.5-asm.55 has rolled out to the rapid release channel.
• 1.20.8-asm.48 has rolled out to the regular release channel.
• 1.19.10-asm.48 has rolled out to the stable release channel.

While the managed data plane automatically updates Envoy Proxies by restarting workloads, you must manually restart any StatefulSets and Jobs.

1.26.4-asm.1 in-cluster Cloud Service Mesh already includes the fixes for these CVEs.

These patches address the following CVEs:

1.24.6-asm.12 is now available for in-cluster Cloud Service Mesh.

You can now download 1.24.6-asm.12 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.24.6 subject to the list of supported features. Cloud Service Mesh version 1.24.6-asm.12 uses envoy v1.33.8-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.25.4-asm.0 is now available for in-cluster Cloud Service Mesh.

You can now download 1.25.4-asm.0 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.25.4 subject to the list of supported features. Cloud Service Mesh version 1.25.4-asm.0 uses envoy v1.33.8-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

The managed Cloud Service Mesh rollouts previously announced address the following vulnerabilities. While the managed data plane automatically updates Envoy Proxies by restarting workloads, you must manually restart any StatefulSets and Jobs.

1.21.5-asm.55

1.20.8-asm.48

1.19.10-asm.48

1.26.4-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains a fix for a use-after-free (UAF) vulnerability in the DNS cache. For more information, see the security bulletin.

Only clusters running in-cluster Cloud Service Mesh version 1.26 are affected. If you are running an earlier in-cluster version or managed Cloud Service Mesh, you are not affected and do not need to take any action.

For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh.

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.5-asm.55 is rolling out to the rapid release channel.
• 1.20.8-asm.48 is rolling out to the regular release channel.
• 1.19.10-asm.48 is rolling out to the stable release channel.

Advanced load balancing for managed Cloud Service Mesh (TD) now generally available (GA).

Managed Cloud Service Mesh will start using proxy version csm_mesh_proxy.20250623b_RC00 for Gateway API on GKE clusters. This proxy version maps closest to Envoy version 1.35. This change is rolling out to all release channels.

1.24.6-asm.9 is now available for in-cluster Cloud Service Mesh.

You can now download 1.24.6-asm.9 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.24.6 subject to the list of supported features. Cloud Service Mesh version 1.24.6-asm.9 uses envoy v1.32.7-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

In-cluster Cloud Service Mesh 1.23 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

1.26.0-asm.11 is now available for in-cluster Cloud Service Mesh.

You can now download 1.26.0-asm.11 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.26.0 subject to the list of supported features.

The following environment variables and annotations are not supported:

• ENABLE_GATEWAY_API_MANUAL_DEPLOYMENT
• RETRY_IGNORE_PREVIOUS_HOSTS
• ENABLE_CLUSTER_TRUST_BUNDLE_API
• OMIT_EMPTY_VALUES
• PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY
• MAX_CONNECTIONS_PER_SOCKET_EVENT_LOOP with the value 1
• Referencing ConfigMaps in a DestinationRule with TLS mode set to SIMPLE mode is not supported

The ENABLE_AUTO_SNI flag is still supported to stay aligned with the legacy behavior.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.26.0-asm.11 uses Envoy v1.34.2-dev.

1.25.3-asm.11 is now available for in-cluster Cloud Service Mesh.

You can now download 1.25.3-asm.11 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.25.3 subject to the list of supported features. Cloud Service Mesh version 1.25.3-asm.11 uses envoy v1.33.4-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.24.6-asm.4 is now available for in-cluster Cloud Service Mesh.

You can now download 1.24.6-asm.4 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.24.6 subject to the list of supported features. Cloud Service Mesh version 1.24.6-asm.4 uses envoy v1.32.7-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.25.3-asm.8 is now available for in-cluster Cloud Service Mesh.

You can now download 1.25.3-asm.8 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.25.3 subject to the list of supported features. Cloud Service Mesh version 1.25.3-asm.8 uses envoy v1.33.4-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.23.6-asm.11 is now available for in-cluster Cloud Service Mesh.

You can now download 1.23.6-asm.11 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.23.6 subject to the list of supported features. Cloud Service Mesh version 1.23.6-asm.11 uses envoy v1.31.9-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

You can now enforce cluster-local traffic for an individual service, all services in a particular namespace, or globally for all services in the mesh. For more information, see Keeping traffic in-cluster.

Isolation support to prevent cross-region overflow is now available as a preview feature for TRAFFIC_DIRECTOR implementations of Cloud Service Mesh. For more information, see Isolation for Cloud Service Mesh.

This change affects clusters using both the TRAFFIC_DIRECTOR and ISTIOD control plane implementations.

When using Cloud Service Mesh with Istio APIs, configuring an unsupported field or value in an Istio Custom Resources will be reflected as an error in the Mesh status API.

In some cases, the validation webhook will also reject unsupported API usage with an error message indicating the specific unsupported API. For more information, see Common webhook error messages. You can mitigate these issues by amending the Istio Custom Resource to remove the specified unsupported API configuration.

DNS Proxy feature is now available in the Rapid release channel. This feature requires sidecar version 1.21.5-asm.39 or later.

1.24.5-asm.3 is now available for in-cluster Cloud Service Mesh.

You can now download 1.24.5-asm.3 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.24.5 subject to the list of supported features. Cloud Service Mesh version 1.24.5-asm.3 uses envoy v1.32.6-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.23.6-asm.3 is now available for in-cluster Cloud Service Mesh.

You can now download 1.23.6-asm.3 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.23.6 subject to the list of supported features. Cloud Service Mesh version 1.23.6-asm.3 uses envoy v1.31.6.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.25.2-asm.3 is now available for in-cluster Cloud Service Mesh.

You can now download 1.25.2-asm.3 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.25.2 subject to the list of supported features. Cloud Service Mesh version 1.25.2-asm.3 uses envoy v1.33.1-dev..

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

In-cluster Cloud Service Mesh 1.22 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

A behavioral change regarding user-provided credentials (private key and certificate) for TLS termination at ingress is now rolling out to the Rapid release channel. Subsequent announcements will appear for additional release channels.

The Kubernetes Secrets denoted by Gateway.servers.port.tls.credentialName will be read by each ingress gateway pod directly instead of the Control Plane. This change enhances security because the user-provided secret is read directly by the workloads instead of passing any managed component.

This change is compatible with previous behavior aside from the propagation speed of the updated secrets. Previously, updated secrets would propagate immediately. Now, updated secrets will propagate within 60 minutes. If you need immediate secret rotation, restart the gateway pods.

Each gateway pod reads Kubernetes secrets, so the number of the gateway pods becomes a scalability factor. We recommend the following maximum number of gateway pods:

• If the GKE cluster is regional, 1500 or fewer pods
• If the GKE cluster is zonal or using autopilot, 500 or fewer pods

If this change in behavior doesn't work for you, consider using the deployment with mounted credentials.

This change only affects clusters using Traffic Director and version 1.21.5-asm.42 or later.

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.5-asm.42 is rolling out to the rapid release channel.
• 1.20.8-asm.33 is rolling out to the regular release channel.
• 1.19.10-asm.33 is rolling out to the stable release channel.

New troubleshooting tools for your service mesh are now available. You can get detailed error codes for your Istio resources and check the state of your mesh to identify and resolve configuration problems. Learn more about Resolving configuration issues and Understanding Feature State Conditions.

In-cluster Cloud Service Mesh 1.21 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

There is a known issue where all gateway CRs will see a downtime for status updates when upgrading from 1.24.3 to 1.25.x .

1.25.0-asm.8 is now available for in-cluster Cloud Service Mesh.

You can now download 1.25.0-asm.8 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.25.0 subject to the list of supported features.

The following environment variables are not supported:

• PILOT_MX_ADDITIONAL_LABELS
• PILOT_DNS_CARES_UDP_MAX_QUERIES
• PILOT_DNS_JITTER_DURATION
• PILOT_SEND_UNHEALTHY_ENDPOINTS

The following annotations are not supported:

• networking.istio.io/traffic-distribution
• istio.io/reroute-virtual-interfaces

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.25.0-asm.8 uses Envoy v1.33.1-dev.

1.23.5-asm.3 is now available for in-cluster Cloud Service Mesh.

You can now download 1.23.5-asm.3 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.23.5 subject to the list of supported features. Cloud Service Mesh version 1.23.5-asm.3 uses envoy v1.31.6-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.24.3-asm.6 is now available for in-cluster Cloud Service Mesh.

You can now download 1.24.3-asm.6 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.24.3 subject to the list of supported features. Cloud Service Mesh version 1.24.3-asm.6 uses envoy v1.32.4-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.21.5-asm.34 is now available for in-cluster Cloud Service Mesh.

You can now download 1.21.5-asm.34 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.21.5 subject to the list of supported features. Cloud Service Mesh version 1.21.5-asm.34 uses envoy v1.29.12-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.22.8-asm.5 is now available for in-cluster Cloud Service Mesh.

You can now download 1.22.8-asm.5 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.22.8 subject to the list of supported features. Cloud Service Mesh version 1.22.8-asm.5 uses envoy v1.30.10-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

You can now use custom constraints with Organization Policy to provide more granular control over specific fields for some networksecurity and networkservices resources.

If you use the managed Cloud Service Mesh with the ISTIOD control plane implementation, important changes have been made to how and when you'll receive notifications of upcoming modernization. For details, see Managed control plane modernization.

Cloud Service Mesh now supports dual-stack, extending IPv6 capability to both proxy-based Envoy and proxyless gRPC. For more information, see Configure IPv6 dual-stack for Cloud Service Mesh.

The rollout of managed Cloud Service Mesh version 1.20 to the rapid channel has completed.

Managed Cloud Service Mesh with the Traffic Director control plane now supports configuring the network topology to use X-Forwarded-For and X-Forwarded-Client-Cert headers by MeshConfig or annotations of workloads.

If you're a user of managed Cloud Service Mesh with the ISTIOD control plane implementation, you can now fine-tune your control plane modernization. See the Managed control plane modernization page for details.

Managed Cloud Service Mesh 1.20 is rolling out to the rapid channel.

A new version of the data plane for Gateway API is now generally available (GA) as a part of managed Cloud Service Mesh for clusters on GKE Rapid channel. The managed data plane helps you to trigger upgrades for data plane proxies. For more information see Data plan management considerations .

Managed Cloud Service Mesh starts using Envoy.1.33 for Gateway API on GKE clusters with rapid channel.

1.24.2-asm.1 is now available for in-cluster Cloud Service Mesh.

You can now download 1.24.2-asm.1 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.24.2 subject to the list of supported features.

• Istio's dual-stack is not supported
• Istio's experimental feature to enable lazy subset creation of envoy statistics is not supported.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.24.2-asm.1 uses Envoy v1.32.3.

1.21.5-asm.21 is now available for in-cluster Cloud Service Mesh.

This patch release contains a fix for a bug where mixed case hosts in Gateway and TLS redirect results in stale RDS.

This patch release also contains the fix for a security vulnerability where an attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.

For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.21.5-asm.21 uses Envoy v1.29.12.

1.22.7-asm.4 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for a security vulnerability where an attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.Cloud Service Mesh version 1.22.7-asm.4 uses envoy v1.30.9.

1.23.4-asm.7 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for a bug in envoy config where opencensus.proto.trace.v1.TraceConfig has been disabled by default and an issue causing VirtualService header name validation to reject valid header names.

This patch release also contains the fix for a security vulnerability where an attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.

For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.23.4-asm.7 uses Envoy v1.31.5.

The CVE fix for GCP-2024-065 has rolled out to all channels.

Advanced load balancing for managed Cloud Service Mesh (TD) is now available in preview.

1.21.5-asm.17 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2024-065. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.21.5-asm.17 uses Envoy v1.29.12.

1.23.4-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2024-065. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.23.4-asm.1 uses Envoy v1.31.5.

Upgrading the gRPC client may cause excessive streams to Traffic Director. Be cautious and do a gradual upgrade when upgrading to the following versions:

• gRPC Java 1.67.1
• gPRC Go 1.66
• gRPC C++ 1.63

1.22.7-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2024-065. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.22.7-asm.1 uses Envoy v1.30.9.

Single Cluster Gateway for Mesh is now generally available. For more information, see Prepare to setup the Gateway API for Cloud Service Mesh.

Routing traffic between Cloud Service Mesh workloads and Cloud Run Services is now available in preview. For more information, see the following pages:

• Route traffic from Cloud Service Mesh workloads to Cloud Run Services
• Route traffic from Cloud Run Services to Cloud Service Mesh workloads on GKE
• Migrate Istio ServiceEntry to GCPBackend for Cloud Run

As part of the Per-cluster entitlement to GKE Enterprise, a GKE cluster needs to have its cluster_tier set to ENTERPRISE in order for that cluster to be considered GKE Enterprise.

Existing clusters and new clusters can follow Update an existing cluster's tier and Enroll a new cluster respectively to make a cluster enterprise.

Clusters created or registered before November 2024 that use GKE Enterprise as part of their fleet membership are automatically enterprise-tier clusters. This is a billing announcement only, Cloud Service Mesh features don't change.

The rollout of managed Cloud Service Mesh version 1.19 to all channels has completed.

In-cluster Cloud Service Mesh 1.20 is no longer supported. For more information, see Supported versions.

1.21.5-asm.12 is now available for in-cluster Cloud Service Mesh.

You can now download 1.21.5-asm.12 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.21.5 subject to the list of supported features. Cloud Service Mesh version 1.21.5-asm.12 uses envoy v1.29.8.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

This release fixes a bug in the distroless proxy container. Before this fix, the distroless proxy produced errors similar to the following when deployed in a Kubernetes cluster with in-cluster control plane that did not have Container Network Interface (CNI) installed.

xtables resource problem: can't open lock file /run/xtables.lock: No such file or directory

This fix applies to the following new versions:

• 1.20.8-asm.10
• 1.21.5-asm.12
• 1.22.6-asm.2
• 1.23.3-asm.2

1.20.8-asm.10 is now available for in-cluster Cloud Service Mesh.

1.20 is no longer supported. While the fix for the bug in the distroless proxy container has been backported to 1.20, you should upgrade to 1.21 or later.

You can now download 1.20.8-asm.10 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.20.8 subject to the list of supported features. Cloud Service Mesh version 1.20.8-asm.10 uses envoy v1.28.6.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.22.6-asm.2 is now available for in-cluster Cloud Service Mesh.

You can now download 1.22.6-asm.2 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.22.6 subject to the list of supported features. Cloud Service Mesh version 1.22.6-asm.2 uses envoy v1.30.6.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.23.3-asm.2 is now available for in-cluster Cloud Service Mesh.

You can now download 1.23.3-asm.2 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.23.3 subject to the list of supported features. Cloud Service Mesh version 1.23.3-asm.2 uses envoy v1.31.2.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

The following images are now rolling out for managed Cloud Service Mesh:

• 1.19.10-asm.21 is rolling out to the rapid release channel.
• 1.19.10-asm.21 is rolling out to the regular release channel.
• 1.19.10-asm.21 is rolling out to the stable release channel.

1.22.6-asm.1 is now available for in-cluster Cloud Service Mesh.

You can now download 1.22.6-asm.1 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.22.6 subject to the list of supported features. Cloud Service Mesh version 1.22.6-asm.1 uses envoy v1.30.6.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.20.8-asm.9 is now available for in-cluster Cloud Service Mesh.

You can now download 1.20.8-asm.9 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.20.8 subject to the list of supported features. Cloud Service Mesh version 1.20.8-asm.9 uses envoy v1.28.6.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

This release fixes a bug in the following versions where the default user for distroless proxy was changed to root; As a result of this fix, the default user is now back to non-root

• 1.20.8-asm.6
• 1.20.8-asm.7
• 1.21.5-asm.5
• 1.21.5-asm.7
• 1.22.3-asm.1
• 1.22.4-asm.0
• 1.22.5-asm.1

This change may affect some gateway deployments which rely on the root user to expose a privileged port for ingress or egress. To ensure your gateways continue to work correctly, you may need to apply additional security contexts to your deployments. For details, see the troubleshooting guide.

1.21.5-asm.10 is now available for in-cluster Cloud Service Mesh.

You can now download 1.21.5-asm.10 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.21.5 subject to the list of supported features. Cloud Service Mesh version 1.21.5-asm.10 uses envoy v1.29.8.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

Patches fixing a bug where the default user for distroless proxy was changed to root will be rolling out to all release channels. As a result of this fix, the default user is changing back to non-root. When you see the release note notifying that this rollout is complete, you must restart each affected workload to make the change effective.

1.23.3-asm.1 is now available for in-cluster Cloud Service Mesh.

You can now download 1.23.3-asm.1 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.23.3 subject to the list of supported features. Cloud Service Mesh version 1.23.3-asm.1 uses envoy v1.31.2.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

In future releases, managed Cloud Service Mesh will use the GKE release channel to determine the data plane component and Istio API versions. For more information, see Provision managed Cloud Service Mesh Requirements.

The rollout of managed Cloud Service Mesh version 1.19 to the stable channel has completed.

A known issue with asmcli for 1.23 is now fixed. Customers might have seen the following error when attempting to install in-cluster Cloud Service Mesh 1.23:

asmcli: Downloading ASM..
gzip: stdin: not in gzip format
tar: Child returned status 1
tar: Error is not recoverable: exiting now

A new version of asmcli with the fix has released.

The following images are now rolling out for managed Cloud Service Mesh:

• 1.19.10-asm.19 is rolling out to the rapid release channel.
• 1.19.10-asm.19 is rolling out to the regular release channel.
• 1.19.10-asm.19 is rolling out to the stable release channel.

1.19.10-asm.19 contains the fixes for the security vulnerabilities listed in GCP-2024-052 and uses Envoy v1.27.7.

1.22.5-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2024-052. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.22.5-asm.1 uses Envoy v1.30.5.

1.23.2-asm.2 is now available for in-cluster Cloud Service Mesh.

You can now download 1.23.2-asm.2 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.23.2 subject to the list of supported features.

• Istio's deferred cluster creation is not supported.

• Istio's outlier log path configuration in mesh proxy config is not supported.

• Istio's credentialName field in the DestinationRule API is not supported.

Cloud Service Mesh 1.23.2-asm.2 uses Envoy v1.31.1.

This release contains the fix for the security vulnerability listed in GCP-2024-052.

Managed Cloud Service Mesh 1.23 isn't rolling out to the rapid release channel at this time. You can periodically check this page for announcements regarding rapid channel rollout.

1.20.8-asm.7 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2024-052. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.20.8-asm.7 uses Envoy v1.28.6.

1.21.5-asm.7 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the security vulnerabilities listed in GCP-2024-052. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.21.5-asm.7 uses Envoy v1.29.8.

Cloud Service Mesh with a Traffic Director control plane implementation is still incompatible with Envoy version v1.31.0.

If you manually control your Envoy version, do not upgrade to v1.31.0 as there is an existing issue with connecting to the Traffic Director API. Instead, upgrade to Envoy version 1.31.1 where this issue is fixed, or set GRPC_DNS_RESOLVER=native for v1.31.0 as a workaround.

If you do not manually control your Envoy version, you don't have to do anything. Google's data plane management will not select an incompatible version for you.

1.21.5-asm.5 is now available for in-cluster Cloud Service Mesh.

You can now download 1.21.5-asm.5 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.21.5 subject to the list of supported features. Cloud Service Mesh 1.21.5-asm.5 uses Envoy v1.29.7.

1.20.8-asm.6 is now available for in-cluster Cloud Service Mesh.

You can now download 1.20.8-asm.6 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.20.8 subject to the list of supported features. Cloud Service Mesh 1.20.8-asm.6 uses Envoy v1.28.5.

1.22.4-asm.0 is now available for in-cluster Cloud Service Mesh.

You can now download 1.22.4-asm.0 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.22.4 subject to the list of supported features. Cloud Service Mesh 1.22.4-asm.0 uses Envoy v1.30.4.

The onboarding path for Managed Cloud Service Mesh with asmcli is deprecated as of August 22, 2024, and support will end in February 2025. This change affects only Google Cloud clusters. Any off-Google Cloud clusters will continue to use asmcli.

To ensure this transition is as smooth as possible, use the gcloud or Cloud Console onboarding paths when creating new clusters before February 2025.

For clusters with existing Cloud Service Mesh deployments, no immediate action is required from you and those deployments remain fully supported.

Configuring Cloud Service Mesh for either proxyless gRPC or Envoy proxy deployments with the Kubernetes Gateway API is now available as a preview feature. For more information see, the Overview page.

Updated August 8, 2024

Cloud Service Mesh with a Traffic Director control plane implementation is incompatible with Envoy version v1.31.0.

If you manually control your Envoy version, do not upgrade to this version as there is an existing issue with connecting to Traffic Director. If you run into issues with v1.31.0, set GRPC_DNS_RESOLVER=native.

If you do not manually control your Envoy version, you don't have to do anything. Google's data plane management will not select this version for you.

1.22.3-asm.1 is now available for in-cluster Cloud Service Mesh.

You can now download 1.22.3-asm.1 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.22.3 subject to the list of supported features.

• Path templating in Authorization Policy is not supported.
• Istio's Ambient mode is not supported.
• Kubernetes Gateway API for mesh is not supported. Gateway API for ingress continues to be supported in public preview. For more information, see Kubernetes Gateway API (preview) supported features.

Cloud Service Mesh 1.22.3-asm.1 uses Envoy v1.30.3.

1.22 isn't rolling out to the rapid release channel at this time. You can periodically check this page for announcements regarding rapid channel rollout.

1.19.10-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for an Envoy bug where the additional cookie attributes are not properly sent to clients. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.19.10-asm.9 uses Envoy v1.27.7.

1.21.4-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for an Envoy bug where the additional cookie attributes are not properly sent to clients. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.21.4-asm.5 uses Envoy v1.29.7.

1.20.8-asm.1 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for an Envoy bug where the additional cookie attributes are not properly sent to clients. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.20.8-asm.1 uses Envoy v1.28.5.

New fleets that provision managed Cloud Service Mesh in organizations that have existing fleets with the managed istiod control plane implementation will receive the Traffic Director control plane implementation by default.

If you received a Service Announcement, or requested an exception from your account team, then your organization's default control plane implementation for new fleets continues to be istiod.

1.21.4-asm.0 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for a security vulnerability where the Datadog tracer does not handle trace headers with unicode characters. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.21.4-asm.0 uses Envoy v1.29.6.

The following 3 changes break backwards compatibility in 1.21.

1. The default value of the feature flag ENABLE_AUTO_SNI has changed from false to true. To opt out, set the environment variable to ENABLE_AUTO_SNI=false.

2. The default value of the feature flag VERIFY_CERT_AT_CLIENT changed from false to true. To opt out, set the environment variable to VERIFY_CERT_AT_CLIENT=false.

3. There are additional changes in external name support. To opt out, set the environment variable ENABLE_EXTERNAL_NAME_ALIAS=false.

Note that opting out is only possible for in-cluster installations. If you do opt out, you must restore the default values before upgrading to 1.22.

1.19.10-asm.6 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2024-032. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.19.10-asm.6 uses Envoy v1.27.6.

1.18.7-asm.26 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2024-032. For details on upgrading Cloud Service Mesh, refer to Upgrade Cloud Service Mesh. Cloud Service Mesh v1.18.7-asm.26 uses Envoy v1.26.8.

1.21.3-asm.3 is now available for in-cluster Cloud Service Mesh.

You can now download 1.21.3-asm.3 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.21.3 subject to the list of supported features. Cloud Service Mesh 1.21.3-asm.3 uses Envoy v1.29.5.

This release contains the fixes for the security vulnerabilities listed in GCP-2024-032.

1.21 isn't rolling out to the rapid release channel at this time. You can periodically check this page for announcements regarding rapid channel rollout.