Chapter 1. OpenShift Service Mesh release notes

This release adds a set of checklists and migration guides to help you migrate from OpenShift Service Mesh 2 to OpenShift Service Mesh 3.0.

You must complete the checklists first. The checklists help you set up and configure OpenShift Service Mesh 2 and the ServiceMeshControlPlane resource to migrate to OpenShift Service Mesh 3.0 and the Istio control plane resource.

Your migration depends on your deployment model:

You can also migrate gateways. For more information, see "Migrating from Service Mesh 2 to Service Mesh 3".

OpenShift Service Mesh 3.0 is based on a Red Hat distribution of the Istio project and is deployed with a new Operator for Istio based on the Sail Operator project that is part of the istio-ecosystem organization on GitHub. The Sail Operator includes a new set of custom resource definitions (CRDs) for managing Istio. For example, the Istio CRD replaces the ServiceMeshControlPlane CRD in previous releases of OpenShift Service Mesh.

This release adds support for select platforms and commands for Istioctl, the command line utility for the Istio project that includes many diagnostic and debugging utilities. For more information, see "Support for Istioctl".

This release introduces support for the following Istio multi-cluster deployment models:

The federation feature introduced in OpenShift Service Mesh 2.1 is not available in OpenShift Service Mesh 3.0.

This release adds support for the Istio feature of multiple control planes in a single cluster. This replaces the MultiTenant deployment model (mode) in OpenShift Service Mesh 2.

This release adds support for canary-style updates of the Istio control plane using the Istio revision feature. This enables a new Istio control plane to be created alongside the existing Istio control plane so that workloads can be migrated incrementally. The update strategy is configured using the spec.updateStrategy parameter of the Istio resource.

For more information, see "About RevisionBased strategy".

This release introduces the IstioCNI custom resource definition (CRD), which is used to manage the lifecycle of the Istio Container Network Interface (CNI) daemon set. A single instance of this resource must be created per cluster to configure traffic redirection for pods in the mesh. The Istio CNI lifecycle is independent of the Istio control plane or planes.

This release includes IPv4/IPv6 dual-stack support as a technology preview feature. This aligns with the Alpha status of the Istio upstream project, and is feature-complete for Istio when using sidecars. Dual-stack helps organizations smoothly transition to IPv6, while still maintaining compatibility with their existing IPv4 setup.

In OpenShift Service Mesh 3.0, dual-stack is disabled by default in the Istio resource. You can enable it with specific configuration changes, such as the one shown in the following example:

apiVersion: sailoperator.io/v1
kind: Istio
metadata:
  name: default
spec:
  values:
    meshConfig:
      defaultConfig:
        proxyMetadata:
          ISTIO_DUAL_STACK: "true"
    pilot:
      ipFamilyPolicy: RequireDualStack
      env:
        ISTIO_DUAL_STACK: "true"
  namespace: istio-system

apiVersion: sailoperator.io/v1
kind: Istio
metadata:
  name: default
spec:
  values:
    meshConfig:
      defaultConfig:
        proxyMetadata:
          ISTIO_DUAL_STACK: "true"
    pilot:
      ipFamilyPolicy: RequireDualStack
      env:
        ISTIO_DUAL_STACK: "true"
  namespace: istio-system

Istio Ambient mode provides a sidecarless service mesh architecture that reduces resource overhead, simplifies operations, and allows incremental adoption without application changes. It maintains security and observability through a layered security model with mTLS and authorization. The OpenShift Service Mesh 3 Operator includes deploying the Ambient profile as a developer preview feature using the community Ztunnel image. However, the Ambient profile should not be used on clusters with production workloads or for multi-control plane use cases.

The community Ztunnel image is unavailable on the following platforms:

This release removes the Istio OpenShift Route (IOR) for automatically creating and managing OpenShift Route resources with Istio Gateway resources. Istio Gateways are managed independent of the Istio control plane using either Gateway injection or Kubernetes Gateway API.

OpenShift Service Mesh 3.0 no longer includes Prometheus and Grafana, and it does not manage the configuration of Jaeger and Elasticsearch. Both Jaeger and Elasticsearch are deprecated and will be removed in a future release.

Supported integrations are provided with Red Hat OpenShift Observability, including user-workload monitoring and distributed tracing. For more information, see "Red Hat OpenShift Observability and Service Mesh". Support is also provided for the Kiali Operator provided by Red Hat. For more information, see "Using Kiali Operator provided by Red Hat".