← Back to changelog

2026-11-02

Istio 1.31.3 with hardened gateways and a read-only Kiali

#kubernetes  #istio  #service-mesh  #kiali  #security  #upgrade  #add-on 

If you run the Istio service mesh with us, your clusters now run Istio 1.31.3 and Kiali 2.33.0. With 1.31, Istio stopped publishing its images to Google’s registry (gcr.io/istio-release), which has planned outages coming up. All Istio images now come from Docker Hub, so new pods and nodes keep starting during those windows.

What changed

  • Istio images without a shell. We moved to Istio’s distroless images: smaller, and with fewer packages to patch. kubectl exec into an istio-proxy container no longer works; use kubectl debug with an ephemeral container, or istioctl proxy-config, instead. Your own containers are not affected.
  • Kiali is read-only. You can still browse the mesh, traffic and Istio configuration, but no longer edit configuration from the Kiali UI. Kiali also only sees the namespaces labelled istio.io/rev=prod; when you add a meshed namespace, let us know so we can add it to Kiali.
  • Hardened ingress gateways and control plane. The gateways and istiod run with the default seccomp profile, and the gateways no longer get a Kubernetes API token: they never needed one, as they get their certificates from Istio itself. istiod now has a memory limit.
  • Same traffic behaviour. Istio 1.31 sends endpoints that fail their health checks to the proxies by default; we keep the previous behaviour, so traffic still skips unhealthy endpoints as before.

We upgraded with Istio’s canary method, so for a while you may see two istiod versions running. Your workloads switch to the new version when their pods restart or are redeployed, and traffic flows between both versions in the meantime. Once every workload has moved, we remove the old version. istioctl proxy-status shows which version each workload uses.

What you need to do

Nothing. If you have scripts or runbooks that exec into the istio-proxy container, switch them to kubectl debug or istioctl.

Component upgrades

See the Istio documentation for how to use the mesh and Kiali.