Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 1. OpenShift Service Mesh release notes

The Red Hat OpenShift Service Mesh release notes provide details about new features and enhancements, deprecated features, technology preview features, fixed issues, and known issues. The release notes also include tables for supported component versions and Istio features, organized by OpenShift Service Mesh version.

Note

For additional information about the Red Hat OpenShift Service Mesh life cycle and supported platforms, refer to the OpenShift Operator Life Cycles.

1.1. Red Hat OpenShift Service Mesh version 3.1.3
Copy link

This release of Red Hat OpenShift Service Mesh is included with the Red Hat OpenShift Service Mesh Operator 3.1.3 and is supported on OpenShift Container Platform 4.16 and later. This release addresses enhancements, fixed issues, and Common Vulnerabilities and Exposures (CVEs).

For supported component versions for 3.1.3, see "Service Mesh version support tables".

1.1.1. Enhancements
Copy link

  • This enhancement updates Kiali Operator and Kiali server to version 2.11.4.

1.1.2. Fixed issues
Copy link

  • Before this update, images were incorrectly switched to use the newer manifest format, causing mirroring issues with older registries. As a consequence, the users experienced mirroring failures due to incompatible manifest formats. With this release, images now use the expected, older manifest format for mirroring to older registries. As a result, end users can now successfully mirror images to older registries. (OSSM-11139)

1.2. Red Hat OpenShift Service Mesh version 3.1.2
Copy link

This release of Red Hat OpenShift Service Mesh is included with the Red Hat OpenShift Service Mesh Operator 3.1.2 and is supported on OpenShift Container Platform 4.16 and later. This release addresses enhancements, fixed issues, and Common Vulnerabilities and Exposures (CVEs).

For supported component versions for 3.1.2, see "Service Mesh version support tables".

1.2.1. Enhancements
Copy link

  • This enhancement updates Istio to version 1.26.4.
  • This enhancement updates Kiali operator and Kiali server to version 2.11.3.

1.3. Red Hat OpenShift Service Mesh version 3.1.1
Copy link

This release of Red Hat OpenShift Service Mesh is included with the Red Hat OpenShift Service Mesh Operator 3.1.1 and is supported on OpenShift Container Platform 4.16 and later. This release addresses enhancements, fixed issues, and Common Vulnerabilities and Exposures (CVEs).

For supported component versions for 3.1.1, see "Service Mesh version support tables".

1.3.1. Enhancements
Copy link

  • This enhancement updates Istio to version 1.26.3.
  • This enhancement updates Kiali operator to version 2.11.2.

1.3.2. Fixed issues
Copy link

  • Before this update, enabling NetworkPolicy field globally in the Istio custom resource (CR) failed to create the corresponding NetworkPolicy resource due to incorrect resource handling. This issue prevented users from applying network policies when Istio was enabled globally. With this update, NetworkPolicy resource creation is enabled upon Istio CR update, allowing end users to consistently apply network policy rules in Istio. (OSSM-10595)
  • Before this update, creating a PodDisruptionBudget for a single istiod pod with a minAvailable value of 1 caused an upgrade to fail, preventing node restart during upgrade. As a consequence, the upgrade was unsuccessful. With this update, the Istio Operator disables the default podDisruptionBudget for the single istiod pod in the Istio 1.24.3 configuration. As a result, the node can now restart during an upgrade without being prevented by the single istiod pod. (OSSM-9392)

This release makes Red Hat OpenShift Service Mesh 3.1 generally available, adds new features, addresses Common Vulnerabilities and Exposures (CVEs), and is supported on OpenShift Container Platform 4.16 and later.

For a list of supported component versions and support features, see "Service Mesh 3.0 feature support tables".

When upgrading from OpenShift Service Mesh 2.x, first you must migrate to version 3.0. Then, you can upgrade to version 3.1. For more information see, "Migrating from Service Mesh 2 to Service Mesh 3".

1.4.1. Support for Kubernetes Gateway API
Copy link

This release introduces support for Kubernetes Gateway API custom resource definitions (CRDs). You can now use these CRDs to configure OpenShift Service Mesh with the Kubernetes Gateway API. This feature is available with Red Hat OpenShift Service Mesh 4.19.

This release introduces support for OpenShift Service Mesh on x86 dual-stack clusters. This feature remains a technology preview on all other platforms.

1.4.3. Kubernetes Traffic Distribution Support
Copy link

This release introduces support for the Kubernetes traffic distribution feature, part of the Kubernetes Service API, within OpenShift Service Mesh. As of Red Hat OpenShift Service Mesh 4.19, this is a Beta feature and requires enabling the ServiceTrafficDistribution parameter in the Istio Custom Resources (CRs).

This release introduces developer preview support for the experimental Kubernetes ClusterTrustBundle feature. This feature provides a new way of distributing X.509 trust anchors (root certificates) to workloads within the cluster. As of Red Hat OpenShift Service Mesh 4.19, this is an Alpha feature and requires enabling the ClusterTrustBundle feature.

1.4.5. UBI-micro base containers
Copy link

This release updates OpenShift Service Mesh to use UBI-micro base containers for most container images. The UBI-micro image is the smallest possible Universal Base Image (UBI), which excludes a package manager and all of its dependencies normally included in a container image. This change minimizes the attack surface of container images that use the UBI-micro base.

This release includes some features that are currently in Technology Preview. These experimental features are not intended for production use. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

1.5.1. Istio ambient mode
Copy link

This release updates the status of Istio ambient mode to Technology Preview. Istio ambient mode provides a sidecar-less alternative data plane to the traditional sidecar-based data plane. By default, ambient mode splits the data plane into node-level L4 ZTunnels and namespace-scoped L7 Waypoint proxies.

Istio ambient mode requires Kubernetes Gateway API custom resource definitions (CRDs). Use OpenShift Service Mesh 4.19 or later, which includes the CRDs by default.

To avoid potential conflicts, you must install Istio ambient mode only on clusters that do not have an existing Red Hat OpenShift Service Mesh installation. Istio ambient mode is not compatible with clusters that use Red Hat OpenShift Service Mesh 2.6 or earlier.

When you use Istio ambient mode, pods that rely on liveness or readiness probes require you to set the OVN-Kubernetes gateway mode to local instead of the default shared mode. In local mode, traffic routes through the host and the host processes it using the routing table, ensuring that probes function correctly. For more information, see the "Configuring gateway mode" section in the OVN-Kubernetes documentation.

To start using Istio ambient mode, see the "Istio ambient mode" section in the OpenShift Service Mesh 3 installation documentation.

1.5.2. Kubernetes Gateway API Inference Extensions
Copy link

This release provides technology preview support for Kubernetes Gateway API Inference Extensions. These extensions build on Kubernetes Gateway API to provide inference-specific routing capabilities that optimize for self-hosted generative-AI workloads. This implementation was backported to OpenShift Service Mesh 3.1 from Istio 1.27.

1.6.1. Kiali fixed issue
Copy link

  • Before this update, the Kiali Operator provided by Red Hat used the k8s_cluster_info Ansible module from the kubernetes.core collection, which caused failures in certain environments during the Get API version information from the cluster task. As a result, Kiali deployment failure occurred, affecting service visibility and management. With this update, the Kiali Operator provided by Red Hat avoids the k8s_cluster_info module, resolving the issue and ensuring smooth Kiali installation for users. (OSSM-9659)

There is currently a known issue that prevents OpenShift Container Platform nodes from upgrading. The podDisruptionBudget resource prevents the draining of the node where the istiod pod is running, unless there are multiple replicas of the istiod pod.

Workaround: Set the .spec.values.global.defaultPodDisruptionBudget.enabled field in the Istio CR to false. Alternatively, you can temporarily increase the number of replicas for the istiod deployment. OSSM-9392

Some features available in previous releases have been deprecated or removed.

Deprecated functionality is still included in OpenShift Container Platform and continues to be supported; however, it will be removed in a future release of Red Hat OpenShift Service Mesh 3 and is not recommended for new deployments.

Removed functionality no longer exists in the product.

1.8.1. DNS auto-allocation in ProxyMetadata
Copy link

This release removes the use of ISTIO_META_DNS_AUTO_ALLOCATE option in the proxyMetadata configuration. You can use the DNS auto-allocation label in the ServiceEntry resource instead. A future release will remove support for the ISTIO_META_DNS_AUTO_ALLOCATE option.

For more information about using the DNS auto-allocation label in the ServiceEntry resource, see the "Address auto-collection" section in the Istio documentation.

Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat