Cloud Service Mesh release notes

Managed Cloud Service Mesh will start using proxy version csm_mesh_proxy.20260819_RC00 for Gateway API on GKE clusters. This proxy version maps closest to Envoy version 1.37. This change is rolling out to all release channels and contains the fix for the managed Cloud Service Mesh security vulnerabilities listed in GCP-2026-057.

1.30.4-asm.1 is now available for in-cluster Cloud Service Mesh.

You can now download 1.30.4-asm.1 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.30.4 subject to the list of supported features.

The following are not supported:

• Failover Priority support for DNS clusters
• ENABLE_WILDCARD_HOST_SERVICE_ENTRIES_FOR_TLS
• Multiple CUSTOM external authorization providers per workload
• The DEBUG_ENDPOINT_AUTH_ALLOWED_NAMESPACES flag

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.30.4-asm.1 uses Envoy v1.38.4-dev.

In-cluster Cloud Service Mesh 1.27 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.

The following images are now rolling out for managed Cloud Service Mesh:

• 1.21.6-asm.71 is rolling out to the rapid release channel.
• 1.20.8-asm.119 is rolling out to the regular release channel.
• 1.19.10-asm.109 is rolling out to the stable release channel.

These versions resolve the security vulnerabilities listed in Security Bulletin GCP-2026-057.

1.29.7-asm.2 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.7-asm.2 uses Envoy v1.35.14.

This release resolves the security vulnerabilities listed in Security Bulletin GCP-2026-057.

Patch 1.29.7-asm.2 contains the fix for the following platform CVEs:

1.28.10-asm.24 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.10-asm.24 uses Envoy v1.36.10.

This release resolves the security vulnerabilities listed in Security Bulletin GCP-2026-057.

Patch 1.28.10-asm.24 contains the fix for the following platform CVEs:

1.27.9-asm.34 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.34 uses Envoy v1.35.14.

This release resolves the security vulnerabilities listed in Security Bulletin GCP-2026-057.

Patch 1.27.9-asm.34 contains fixes for the following platform CVEs:

For clusters using the TRAFFIC_DIRECTOR implementation, configuring the trace sampling rate with randomSamplingPercentage with the Telemetry API is now supported in the Rapid release channel. For more information, see Accessing Cloud Trace.

The guidance for using proxy image types (default and distroless) with Managed Cloud Service Mesh has been updated:

• Directly onboarded clusters using the TRAFFIC_DIRECTOR implementation use distroless proxy images by default, and other image types are not supported.
• Migrated clusters (migrated from ISTIOD to TRAFFIC_DIRECTOR) default to default images, but can opt in to distroless images via MeshConfig or the sidecar.istio.io/proxyImageType: distroless Pod annotation.

For more information, see Distroless proxy images and Identify the proxy image type used in the cluster.

For the clusters using TRAFFIC_DIRECTOR implementation, IP auto-allocation with DNS Proxy is now supported in Rapid release channel.

The Envoy Compressor Filter is now GA in the stable release channel.

The Envoy Lua Filter is now available as a preview feature in the stable release channel.

1.29.5-asm.12 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see