Cloud Service Mesh release notes

Managed Cloud Service Mesh will start using proxy version csm_mesh_proxy.20260819_RC00 for Gateway API on GKE clusters. This proxy version maps closest to Envoy version 1.37. This change is rolling out to all release channels and contains the fix for the managed Cloud Service Mesh security vulnerabilities listed in GCP-2026-057.

1.30.4-asm.1 is now available for in-cluster Cloud Service Mesh.

You can now download 1.30.4-asm.1 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.30.4 subject to the list of supported features.

The following are not supported:

• Failover Priority support for DNS clusters
• ENABLE_WILDCARD_HOST_SERVICE_ENTRIES_FOR_TLS
• Multiple CUSTOM external authorization providers per workload
• The DEBUG_ENDPOINT_AUTH_ALLOWED_NAMESPACES flag

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.30.4-asm.1 uses Envoy v1.38.4-dev.

In-cluster Cloud Service Mesh 1.27 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.71 is rolling out to the rapid release channel.
• 1.20.8-asm.119 is rolling out to the regular release channel.
• 1.19.10-asm.109 is rolling out to the stable release channel.

These versions resolve the security vulnerabilities listed in Security Bulletin GCP-2026-057.

1.29.7-asm.2 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.7-asm.2 uses Envoy v1.35.14.

This release resolves the security vulnerabilities listed in Security Bulletin GCP-2026-057.

Patch 1.29.7-asm.2 contains the fix for the following platform CVEs:

1.28.10-asm.24 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.10-asm.24 uses Envoy v1.36.10.

This release resolves the security vulnerabilities listed in Security Bulletin GCP-2026-057.

Patch 1.28.10-asm.24 contains the fix for the following platform CVEs:

1.27.9-asm.34 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.34 uses Envoy v1.35.14.

This release resolves the security vulnerabilities listed in Security Bulletin GCP-2026-057.

Patch 1.27.9-asm.34 contains fixes for the following platform CVEs:

For clusters using the TRAFFIC_DIRECTOR implementation, configuring the trace sampling rate with randomSamplingPercentage with the Telemetry API is now supported in the Rapid release channel. For more information, see Accessing Cloud Trace.

The guidance for using proxy image types (default and distroless) with Managed Cloud Service Mesh has been updated:

• Directly onboarded clusters using the TRAFFIC_DIRECTOR implementation use distroless proxy images by default, and other image types are not supported.
• Migrated clusters (migrated from ISTIOD to TRAFFIC_DIRECTOR) default to default images, but can opt in to distroless images via MeshConfig or the sidecar.istio.io/proxyImageType: distroless Pod annotation.

For more information, see Distroless proxy images and Identify the proxy image type used in the cluster.

For the clusters using TRAFFIC_DIRECTOR implementation, IP auto-allocation with DNS Proxy is now supported in Rapid release channel.

The Envoy Compressor Filter is now GA in the stable release channel.

The Envoy Lua Filter is now available as a preview feature in the stable release channel.

1.29.5-asm.12 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.12 uses Envoy v1.35.13.

Patch 1.29.5-asm.12 contains fixes for the following platform CVEs:

1.28.10-asm.4 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.10-asm.4 uses Envoy v1.36.9.

Patch 1.28.10-asm.4 contains fixes for the following platform CVEs:

1.27.9-asm.15 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.15 uses Envoy v1.35.13v.

Patch 1.27.9-asm.15 contains fixes for the following platform CVEs:

The Envoy Compressor Filter is now GA in the regular release channel.

The Envoy Lua Filter is now available as a preview feature in the regular release channel.

1.29.5-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.5 uses Envoy v1.37.5.

1.28.9-asm.4 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.4 uses Envoy v1.36.9.

1.27.9-asm.9 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-045.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.9 uses Envoy v1.35.13.

Proxy version csm_mesh_proxy.csm_mesh_proxy.20260624e_RC01 for Gateway API on GKE clusters is rolling out to all Managed Cloud Service Mesh release channels over the next week.

This patch release contains the fixes for the security vulnerabilities listed in GCP-2026-040.

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.38, is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.88 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.78 is rolling out to the stable release channel.

These patch releases contain the fix for the vulnerability listed in GCP-2026-040.

These rollouts will preempt those previously announced on June 12, 2026.

1.29.5-asm.3 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.3 uses Envoy v1.37.5-dev.

This patch release also contain the fixes for the following CVEs:

1.28.9-asm.2 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.2 uses Envoy v1.36.9-dev.

This patch release also contain the fixes for the following CVEs:

1.27.9-asm.8 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-040.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.8 uses Envoy v1.35.13-dev.

This patch release also contain the fixes for the following CVEs:

The Envoy Lua Filter is now available as a preview feature in the rapid release channel.

The Envoy Compressor Filter is now GA in the rapid release channel.

To ensure your EnvoyFilter compressor configuration is fully supported, see Modernize EnvoyFilter compressor configurations.

The following images are now rolling out for managed Cloud Service Mesh:

• Sidecar version 1.21.6-asm.36, is rolling out to the rapid release channel.
• Sidecar version 1.20.8-asm.86 is rolling out to the regular release channel.
• Sidecar version 1.19.10-asm.76 is rolling out to the stable release channel.

These rollouts will preempt those previously announced on June 3, 2026.

These patch releases contain the fix for the vulnerability listed in GCP-2026-035

Proxy version csm_mesh_proxy.20260423_RC03 for Gateway API on GKE clusters is rolling out to all Managed Cloud Service Mesh release channels over the next week.

1.29.4-asm.0 is now available for in-cluster Cloud Service Mesh.

You can now download 1.29.4-asm.0 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.29.4 subject to the list of supported features.

The following environment variables, labels, and annotations are not supported:

• PILOT_IGNORE_RESOURCES and PILOT_INCLUDE_RESOURCES
• RetryIgnorePreviousHosts
• omit_empty_values
• PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY
• MAX_CONNECTIONS_PER_SOCKET_EVENT_LOOP with the value 1
• PILOT_DNS_JITTER_DURATION
• PILOT_DNS_JITTER_DURATION
• ENABLE_NATIVE_SIDECARS with the value true
• PILOT_IP_AUTOALLOCATE_IPV4_PREFIX and PILOT_IP_AUTOALLOCATE_IPV6_PREFIX
• PILOT_DNS_CARES_UDP_MAX_QUERIES
• ENABLE_WILDCARD_HOST_SERVICE_ENTRIES_FOR_TLS
• 'BLOCKED_CIDRS_IN_JWKS_URIS`
• ENABLE_DEBUG_ENDPOINT_AUTH
• DISABLE_TRACK_REMAINING_CB_METRICS
• gateway.istio.io/tls-cipher-suites
• fileFlushMinSizeKB and fileFlushInterval settings in ProxyConfig
• topology.istio.io/locality
• statsCompression ProxyConfig option
• proxy.istio.io/config annotation for metric compression overrides

Istio's experimental feature to enable lazy subset creation of envoy statistics is not supported.

The formatter option within the spec.tracing[].customTags field of the Telemetry custom resource (telemetry.istio.io) is unsupported.

The istiod_remote_cluster_sync_status Prometheus gauge metric, exposed on the Istiod control plane metrics endpoint (port 15014 /metrics), is not supported.

The following are unsupported for proxyless gRPC clients:

• Configuring the LEAST_REQUEST load balancing policy within the spec.trafficPolicy.loadBalancer.simple field of a DestinationRule custom resource (networking.istio.io)

• Configuring the http2MaxRequests circuit breaker within the spec.trafficPolicy.connectionPool.http.http2MaxRequests field of a DestinationRule custom resource (networking.istio.io)

The ENABLE_AUTO_SNI flag is still supported to keep aligned with the legacy behavior.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.29.4-asm.0 uses Envoy v1.37.4-dev.

In-cluster Cloud Service Mesh 1.26 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

The rollouts previously announced on June 3, 2026 have been stopped. The following release will supersede them and include those patches and the fix for the vulnerability listed in GCP-2026-035.

1.28.7-asm.4 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.7-asm.4 uses Envoy v1.36.8-dev.

1.27.9-asm.5 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.5 uses Envoy v1.35.12-dev.

1.26.8-asm.11 is now available for in-cluster Cloud Service Mesh.

This patch release contains the fix for the security vulnerability listed in GCP-2026-035.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.26.8-asm.11 uses Envoy v1.34.14.

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.32 is rolling out to the rapid release channel.
• The regular release channel is being upgraded from 1.20 to 1.21.6-asm.32.
• The stable release channel is being upgraded from 1.19 to 1.20.8-asm.80.

These patch releases contain the fixes for the following CVEs:

1.28.7-asm.3 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.7-asm.3 uses Envoy v1.36.7-dev.

Patch 1.28.7-asm.3 contains fixes for the following platform CVEs: