Announcement

1.30.4-asm.14 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.30.4-asm.14 uses Envoy v1.38.5-dev.

Fixed

Patch 1.30.4-asm.14 contains the fix for the following platform CVEs:

Announcement

1.29.7-asm.18 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.7-asm.18 uses Envoy v1.37.6.

Fixed

Patch 1.29.7-asm.18 contains the fix for the following platform CVEs:

Announcement

1.28.10-asm.40 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.10-asm.40 uses Envoy v1.36.10-dev.

Fixed

Patch 1.28.10-asm.40 contains the fix for the following platform CVEs:

Security

Managed Cloud Service Mesh will start using proxy version csm_mesh_proxy.20260819_RC00 for Gateway API on GKE clusters. This proxy version maps closest to Envoy version 1.37. This change is rolling out to all release channels and contains the fix for the managed Cloud Service Mesh security vulnerabilities listed in GCP-2026-057.

Announcement

1.30.4-asm.1 is now available for in-cluster Cloud Service Mesh.

You can now download 1.30.4-asm.1 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.30.4 subject to the list of supported features.

Fixed an issue that caused incomplete telemetry in multicluster deployments for routes configured with TLS or PROXY traffic policies. Refer Istio 1.30 Telemetry Release Notes (last bullet) for more details on the issue.

The following are not supported:

• Failover Priority support for DNS clusters
• ENABLE_WILDCARD_HOST_SERVICE_ENTRIES_FOR_TLS
• Multiple CUSTOM external authorization providers per workload
• The DEBUG_ENDPOINT_AUTH_ALLOWED_NAMESPACES flag

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.30.4-asm.1 uses Envoy v1.38.4-dev.

Announcement

In-cluster Cloud Service Mesh 1.27 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

Security

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.71 is rolling out to the rapid release channel.
• 1.20.8-asm.119 is rolling out to the regular release channel.
• 1.19.10-asm.109 is rolling out to the stable release channel.

These versions resolve the security vulnerabilities listed in Security Bulletin GCP-2026-057.

Announcement

1.29.7-asm.2 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.7-asm.2 uses Envoy v1.35.14.

This release resolves the security vulnerabilities listed in Security Bulletin GCP-2026-057.

Fixed

Patch 1.29.7-asm.2 contains the fix for the following platform CVEs:

Announcement

1.28.10-asm.24 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.10-asm.24 uses Envoy v1.36.10.

This release resolves the security vulnerabilities listed in Security Bulletin GCP-2026-057.

Fixed

Patch 1.28.10-asm.24 contains the fix for the following platform CVEs:

Announcement

1.27.9-asm.34 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.34 uses Envoy v1.35.14.

This release resolves the security vulnerabilities listed in Security Bulletin GCP-2026-057.

Fixed

Patch 1.27.9-asm.34 contains fixes for the following platform CVEs:

Feature

For clusters using the TRAFFIC_DIRECTOR implementation, configuring the trace sampling rate with randomSamplingPercentage with the Telemetry API is now supported in the Rapid release channel. For more information, see Accessing Cloud Trace.

Feature

The guidance for using proxy image types (default and distroless) with Managed Cloud Service Mesh has been updated:

• Directly onboarded clusters using the TRAFFIC_DIRECTOR implementation use distroless proxy images by default, and other image types are not supported.
• Migrated clusters (migrated from ISTIOD to TRAFFIC_DIRECTOR) default to default images, but can opt in to distroless images via MeshConfig or the sidecar.istio.io/proxyImageType: distroless Pod annotation.

For more information, see Distroless proxy images and Identify the proxy image type used in the cluster.

Feature

The guidance for using proxy image types (default and distroless) with Managed Cloud Service Mesh has been updated:

• Directly onboarded clusters using the TRAFFIC_DIRECTOR implementation use distroless proxy images by default, and other image types are not supported.
• Migrated clusters (migrated from ISTIOD to TRAFFIC_DIRECTOR) default to default images, but can opt in to distroless images via MeshConfig or the sidecar.istio.io/proxyImageType: distroless Pod annotation.

For more information, see Distroless proxy images and Identify the proxy image type used in the cluster.

Feature

For the clusters using TRAFFIC_DIRECTOR implementation, IP auto-allocation with DNS Proxy is now supported in Rapid release channel.

Feature

For the clusters using TRAFFIC_DIRECTOR implementation, IP auto-allocation with DNS Proxy is now supported in Rapid release channel.

Feature

The Envoy Compressor Filter is now GA in the stable release channel.

Feature

The Envoy Compressor Filter is now GA in the stable release channel.

Feature

The Envoy Lua Filter is now available as a preview feature in the stable release channel.

Feature

The Envoy Lua Filter is now available as a preview feature in the stable release channel.

Announcement

1.29.5-asm.12 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.12 uses Envoy v1.35.13.

Announcement

1.29.5-asm.12 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.12 uses Envoy v1.35.13.

Fixed

Patch 1.29.5-asm.12 contains fixes for the following platform CVEs:

Fixed

Patch 1.29.5-asm.12 contains fixes for the following platform CVEs:

Announcement

1.28.10-asm.4 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.10-asm.4 uses Envoy v1.36.9.

Announcement

1.28.10-asm.4 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.10-asm.4 uses Envoy v1.36.9.

Fixed

Patch 1.28.10-asm.4 contains fixes for the following platform CVEs:

Fixed

Patch 1.28.10-asm.4 contains fixes for the following platform CVEs:

Announcement

1.27.9-asm.15 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.15 uses Envoy v1.35.13v.

Announcement

1.27.9-asm.15 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.15 uses Envoy v1.35.13v.

Fixed

Patch 1.27.9-asm.15 contains fixes for the following platform CVEs:

Fixed

Patch 1.27.9-asm.15 contains fixes for the following platform CVEs:

Feature

The Envoy Compressor Filter is now GA in the regular release channel.

Feature

The Envoy Compressor Filter is now GA in the regular release channel.

Feature

The Envoy Lua Filter is now available as a preview feature in the regular release channel.

Feature

The Envoy Lua Filter is now available as a preview feature in the regular release channel.

Security

1.29.5-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.5 uses Envoy v1.37.5.

Security

1.29.5-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.5 uses Envoy v1.37.5.

Security

1.28.9-asm.4 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.4 uses Envoy v1.36.9.

Security

1.28.9-asm.4 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.4 uses Envoy v1.36.9.

Security

1.27.9-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.9 uses Envoy v1.35.13.

Security

1.27.9-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.9 uses Envoy v1.35.13.

Security

Proxy version csm_mesh_proxy.csm_mesh_proxy.20260624e_RC01 for Gateway API on GKE clusters is rolling out to all Managed Cloud Service Mesh release channels over the next week.

This patch release contains the fixes for the security vulnerabilities listed in GCP-2026-040.

Security

Proxy version csm_mesh_proxy.csm_mesh_proxy.20260624e_RC01 for Gateway API on GKE clusters is rolling out to all Managed Cloud Service Mesh release channels over the next week.

This patch release contains the fixes for the security vulnerabilities listed in GCP-2026-040.

Security

1.29.5-asm.3 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.3 uses Envoy v1.37.5-dev.

Security

1.29.5-asm.3 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.3 uses Envoy v1.37.5-dev.

Fixed

This patch release also contain the fixes for the following CVEs:

Fixed

This patch release also contain the fixes for the following CVEs:

Security

1.28.9-asm.2 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.2 uses Envoy v1.36.9-dev.

Security

1.28.9-asm.2 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.2 uses Envoy v1.36.9-dev.

Fixed

This patch release also contain the fixes for the following CVEs:

Fixed

This patch release also contain the fixes for the following CVEs:

Security

1.27.9-asm.8 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.8 uses Envoy v1.35.13-dev.

Security

1.27.9-asm.8 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.8 uses Envoy v1.35.13-dev.

Fixed

This patch release also contain the fixes for the following CVEs:

Fixed

This patch release also contain the fixes for the following CVEs:

Security

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.38, is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.88 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.78 is rolling out to the stable release channel.

These patch releases contain the fix for the vulnerability listed in GCP-2026-040.

These rollouts will preempt those previously announced on June 12, 2026.

Security

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.38, is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.88 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.78 is rolling out to the stable release channel.

These patch releases contain the fix for the vulnerability listed in GCP-2026-040.

These rollouts will preempt those previously announced on June 12, 2026.

Feature

The Envoy Lua Filter is now available as a preview feature in the rapid release channel.

Feature

The Envoy Lua Filter is now available as a preview feature in the rapid release channel.

Feature

The Envoy Compressor Filter is now GA in the rapid release channel.

To ensure your EnvoyFilter compressor configuration is fully supported, see Modernize EnvoyFilter compressor configurations.

Feature

The Envoy Compressor Filter is now GA in the rapid release channel.

To ensure your EnvoyFilter compressor configuration is fully supported, see Modernize EnvoyFilter compressor configurations.

Security

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.36, is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.86 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.76 is rolling out to the stable release channel.

These rollouts will preempt those previously announced on June 3, 2026.

These patch releases contain the fix for the vulnerability listed in GCP-2026-035

Security

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.36, is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.86 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.76 is rolling out to the stable release channel.

These rollouts will preempt those previously announced on June 3, 2026.

These patch releases contain the fix for the vulnerability listed in GCP-2026-035

Security

Proxy version csm_mesh_proxy.20260423_RC03 for Gateway API on GKE clusters is rolling out to all Managed Cloud Service Mesh release channels over the next week.

Security

Proxy version csm_mesh_proxy.20260423_RC03 for Gateway API on GKE clusters is rolling out to all Managed Cloud Service Mesh release channels over the next week.

Announcement

1.29.4-asm.0 is now available for in-cluster Cloud Service Mesh.

You can now download 1.29.4-asm.0 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.29.4 subject to the list of supported features.

The following environment variables, labels, and annotations are not supported:

• PILOT_IGNORE_RESOURCES and PILOT_INCLUDE_RESOURCES
• RetryIgnorePreviousHosts
• omit_empty_values
• PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY
• MAX_CONNECTIONS_PER_SOCKET_EVENT_LOOP with the value 1
• PILOT_DNS_JITTER_DURATION
• PILOT_DNS_JITTER_DURATION
• ENABLE_NATIVE_SIDECARS with the value true
• PILOT_IP_AUTOALLOCATE_IPV4_PREFIX and PILOT_IP_AUTOALLOCATE_IPV6_PREFIX
• PILOT_DNS_CARES_UDP_MAX_QUERIES
• ENABLE_WILDCARD_HOST_SERVICE_ENTRIES_FOR_TLS
• 'BLOCKED_CIDRS_IN_JWKS_URIS`
• ENABLE_DEBUG_ENDPOINT_AUTH
• DISABLE_TRACK_REMAINING_CB_METRICS
• gateway.istio.io/tls-cipher-suites
• fileFlushMinSizeKB and fileFlushInterval settings in ProxyConfig
• topology.istio.io/locality
• statsCompression ProxyConfig option
• proxy.istio.io/config annotation for metric compression overrides

Istio's experimental feature to enable lazy subset creation of envoy statistics is not supported.

The formatter option within the spec.tracing[].customTags field of the Telemetry custom resource (telemetry.istio.io) is unsupported.

The istiod_remote_cluster_sync_status Prometheus gauge metric, exposed on the Istiod control plane metrics endpoint (port 15014 /metrics), is not supported.

The following are unsupported for proxyless gRPC clients:

• Configuring the LEAST_REQUEST load balancing policy within the spec.trafficPolicy.loadBalancer.simple field of a DestinationRule custom resource (networking.istio.io)

• Configuring the http2MaxRequests circuit breaker within the spec.trafficPolicy.connectionPool.http.http2MaxRequests field of a DestinationRule custom resource (networking.istio.io)

The ENABLE_AUTO_SNI flag is still supported to keep aligned with the legacy behavior.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.29.4-asm.0 uses Envoy v1.37.4-dev.

Announcement

1.29.4-asm.0 is now available for in-cluster Cloud Service Mesh.

You can now download 1.29.4-asm.0 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.29.4 subject to the list of supported features.

The following environment variables, labels, and annotations are not supported:

• PILOT_IGNORE_RESOURCES and PILOT_INCLUDE_RESOURCES
• RetryIgnorePreviousHosts
• omit_empty_values
• PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY
• MAX_CONNECTIONS_PER_SOCKET_EVENT_LOOP with the value 1
• PILOT_DNS_JITTER_DURATION
• PILOT_DNS_JITTER_DURATION
• ENABLE_NATIVE_SIDECARS with the value true
• PILOT_IP_AUTOALLOCATE_IPV4_PREFIX and PILOT_IP_AUTOALLOCATE_IPV6_PREFIX
• PILOT_DNS_CARES_UDP_MAX_QUERIES
• ENABLE_WILDCARD_HOST_SERVICE_ENTRIES_FOR_TLS
• 'BLOCKED_CIDRS_IN_JWKS_URIS`
• ENABLE_DEBUG_ENDPOINT_AUTH
• DISABLE_TRACK_REMAINING_CB_METRICS
• gateway.istio.io/tls-cipher-suites
• fileFlushMinSizeKB and fileFlushInterval settings in ProxyConfig
• topology.istio.io/locality
• statsCompression ProxyConfig option
• proxy.istio.io/config annotation for metric compression overrides

Istio's experimental feature to enable lazy subset creation of envoy statistics is not supported.

The formatter option within the spec.tracing[].customTags field of the Telemetry custom resource (telemetry.istio.io) is unsupported.

The istiod_remote_cluster_sync_status Prometheus gauge metric, exposed on the Istiod control plane metrics endpoint (port 15014 /metrics), is not supported.

The following are unsupported for proxyless gRPC clients:

• Configuring the LEAST_REQUEST load balancing policy within the spec.trafficPolicy.loadBalancer.simple field of a DestinationRule custom resource (networking.istio.io)

• Configuring the http2MaxRequests circuit breaker within the spec.trafficPolicy.connectionPool.http.http2MaxRequests field of a DestinationRule custom resource (networking.istio.io)

The ENABLE_AUTO_SNI flag is still supported to keep aligned with the legacy behavior.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.29.4-asm.0 uses Envoy v1.37.4-dev.

Announcement

In-cluster Cloud Service Mesh 1.26 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

Announcement

In-cluster Cloud Service Mesh 1.26 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

Security

1.28.7-asm.4 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.7-asm.4 uses Envoy v1.36.8-dev.

Security

1.28.7-asm.4 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.7-asm.4 uses Envoy v1.36.8-dev.

Security

1.27.9-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.5 uses Envoy v1.35.12-dev.

Security

1.27.9-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.5 uses Envoy v1.35.12-dev.

Security

1.26.8-asm.11 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.11 uses Envoy v1.34.14.

Security

1.26.8-asm.11 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.11 uses Envoy v1.34.14.

Announcement

The rollouts previously announced on June 3, 2026 have been stopped. The following release will supersede them and include those patches and the fix for the vulnerability listed in GCP-2026-035.

Announcement

The rollouts previously announced on June 3, 2026 have been stopped. The following release will supersede them and include those patches and the fix for the vulnerability listed in GCP-2026-035.

Announcement

1.28.7-asm.3 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.7-asm.3 uses Envoy v1.36.7-dev.

Announcement

1.28.7-asm.3 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.7-asm.3 uses Envoy v1.36.7-dev.

Fixed

Patch 1.28.7-asm.3 contains fixes for the following platform CVEs:

Fixed

Patch 1.28.7-asm.3 contains fixes for the following platform CVEs:

Announcement

1.27.9-asm.4 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.4 uses Envoy v1.35.10-dev.

Announcement

1.27.9-asm.4 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.4 uses Envoy v1.35.10-dev.

Fixed

Patch 1.27.9-asm.4 contains fixes for the following platform CVEs:

Fixed

Patch 1.27.9-asm.4 contains fixes for the following platform CVEs:

Announcement

1.26.8-asm.10 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.10 uses Envoy v1.34.14.

Announcement

1.26.8-asm.10 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.10 uses Envoy v1.34.14.

Fixed

Patch 1.26.8-asm.10 contains fixes for the following platform CVEs:

Fixed

Patch 1.26.8-asm.10 contains fixes for the following platform CVEs:

Announcement

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.32 is rolling out to the rapid release channel.
• The regular release channel is being upgraded from 1.20 to 1.21.6-asm.32.
• The stable release channel is being upgraded from 1.19 to 1.20.8-asm.80.

Announcement

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.32 is rolling out to the rapid release channel.
• The regular release channel is being upgraded from 1.20 to 1.21.6-asm.32.
• The stable release channel is being upgraded from 1.19 to 1.20.8-asm.80.

Fixed

These patch releases contain the fixes for the following CVEs:

Fixed

These patch releases contain the fixes for the following CVEs:

Announcement

Managed Cloud Service Mesh using the TRAFFIC_DIRECTOR implementation in the stable channel now supports a limited implementation of the EnvoyFilter API. To learn about the supported fields, extensions, and how to use EnvoyFilter for features like local rate limiting see Data plane extensibility with EnvoyFilter.

To troubleshoot any issue while configuring, see Resolving data plane extensibility issues.

Announcement

Managed Cloud Service Mesh using the TRAFFIC_DIRECTOR implementation in the stable channel now supports a limited implementation of the EnvoyFilter API. To learn about the supported fields, extensions, and how to use EnvoyFilter for features like local rate limiting see Data plane extensibility with EnvoyFilter.

To troubleshoot any issue while configuring, see Resolving data plane extensibility issues.

Announcement

Cloud Service Mesh can now report a status code to indicate whether an Istio API is accepted or rejected. You can view the status code on the resource and mesh state. For more information see MembershipState Error Codes.

Announcement

Cloud Service Mesh can now report a status code to indicate whether an Istio API is accepted or rejected. You can view the status code on the resource and mesh state. For more information see MembershipState Error Codes.

Security

Proxy version csm_mesh_proxy.20260423_RC03 is rolling out to all Managed Cloud Service Mesh release channels over the next week.

Security

Proxy version csm_mesh_proxy.20260423_RC03 is rolling out to all Managed Cloud Service Mesh release channels over the next week.

Announcement

Managed Cloud Service Mesh using the TRAFFIC_DIRECTOR implementation in the regular channel now supports a limited implementation of the EnvoyFilter API. To learn about the supported fields, extensions, and how to use EnvoyFilter for features like local rate limiting see Data plane extensibility with EnvoyFilter.

To troubleshoot any issue while configuring, see Resolving data plane extensibility issues.

Announcement

Managed Cloud Service Mesh using the TRAFFIC_DIRECTOR implementation in the regular channel now supports a limited implementation of the EnvoyFilter API. To learn about the supported fields, extensions, and how to use EnvoyFilter for features like local rate limiting see Data plane extensibility with EnvoyFilter.

To troubleshoot any issue while configuring, see Resolving data plane extensibility issues.

Announcement

Managed Cloud Service Mesh using the TRAFFIC_DIRECTOR implementation in the regular channel now supports a limited implementation of the EnvoyFilter API. To learn about the supported fields, extensions, and how to use EnvoyFilter for features like local rate limiting see Data plane extensibility with EnvoyFilter.

To troubleshoot any issue while configuring, see Resolving data plane extensibility issues.

Announcement

1.28.5-asm.12 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.5-asm.12 uses Envoy 1.36.5-dev.

Announcement

1.28.5-asm.12 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.5-asm.12 uses Envoy 1.36.5-dev.

Announcement

1.28.5-asm.12 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.5-asm.12 uses Envoy 1.36.5-dev.

Announcement

1.27.8-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.8-asm.9 uses Envoy 1.35.10-dev.

Announcement

1.27.8-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.8-asm.9 uses Envoy 1.35.10-dev.

Announcement

1.27.8-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains fixes for the following platform CVEs:

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.8-asm.9 uses Envoy 1.35.10-dev.

Announcement

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.19 is rolling out to the rapid release channel.
• 1.20.8-asm.73 is rolling out to the regular release channel.
• 1.19.10-asm.66 is rolling out to the stable release channel.

These patch releases contain the fixes for the following CVEs:

Announcement

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.19 is rolling out to the rapid release channel.
• 1.20.8-asm.73 is rolling out to the regular release channel.
• 1.19.10-asm.66 is rolling out to the stable release channel.

These patch releases contain the fixes for the following CVEs: