Skip to content
Service Mesh

Istio Releases

Track Istio service mesh releases, Kubernetes version compatibility, ambient mesh evolution, sidecar vs sidecarless modes, Envoy version alignment, and upgrade complexity guidance.

Official Site Documentation

—

Total Versions

—

Supported

—

Latest

Version Timeline

All tracked releases with lifecycle status and EOL dates.

Loading version data…

Lifecycle Timeline

Visual overview of active support and maintenance windows.

1.18
1.19
1.20
1.21
1.22
1.23
1.24
1.25
2023 2024 2025 2026 2027 2028
Active
Maint
Active
Maint
Active
Maint
Active
Maint
Active
Maint
Active
Maint
Active
Maint
Active
Maint
Active / LTS
Maintenance
Today

Upgrade Paths

Migration guidance between major versions — breaking changes, effort estimates, and tips.

1.20/1.21 1.24+ High Difficulty
Est. 2-4 hours per minor version hop

Breaking Changes

  • Must upgrade one minor at a time (1.20→1.21→1.22→1.23→1.24)
  • Ambient mesh APIs changed between minor versions
  • EnvoyFilter API deprecated fields removed
  • Telemetry API v2 changes
  • Gateway API graduation (beta → stable)
  • Sidecar injection webhook changes
  • Revision-based canary upgrade recommended

Migration Notes

Multi-hop Istio upgrades are painful. Each hop requires: upgrade control plane, verify health, restart sidecars, verify data plane. For 4 hops, budget a full day. Use revision-based upgrades (istioctl install --revision) to run old and new control planes side by side. Migrate namespaces one at a time.

1.23 1.24 Medium Difficulty
Est. 1-3 hours (cluster size dependent)

Breaking Changes

  • Ambient mesh promoted to stable (API changes)
  • Waypoint proxy configuration changes
  • Updated default mTLS behavior
  • Envoy version bump (1.31 → 1.32)

Migration Notes

Single-hop upgrade. Use canary method: install 1.24 as a new revision, label namespaces to use the new revision, restart workloads, verify, then remove the old revision. If using ambient, review the waypoint proxy config changes.

Version Risk Assessment

Evaluate risk factors before choosing a version for production.

Version EOL Risk CVE Risk Ecosystem Cloud Support Overall Recommended Action
Istio 1.20 and older Critical Critical Unsupported None Critical No patches, known CVEs — upgrade immediately
Istio 1.21 Critical High Unsupported Degrading Critical Past EOL — multiple hop upgrade needed
Istio 1.22 High Medium Maintenance Full High Security-only — plan upgrade to 1.24+
Istio 1.23 Medium Low Supported Full Medium Supported until Aug 2025
Istio 1.24 Low Low Active Full Low Current — ambient mesh stable
Istio 1.25 None Low Active Full Low Latest — recommended

Istio supports the latest 3 minor versions. The fast release cadence means falling behind quickly leads to unsupported versions. CVEs in Envoy propagate through Istio. Assessed March 2026.

Istio Version Feature Comparison

Side-by-side feature differences across major versions.

Feature 1.20 1.21 1.22 1.23 1.24
Ambient mesh Alpha Beta Beta Beta Stable
Gateway API Beta Beta Stable Stable Stable
Sidecar mode Stable Stable Stable Stable Stable
Envoy version 1.28 1.29 1.30 1.31 1.32
Telemetry API v2 Stable Stable Enhanced Enhanced Enhanced
External control plane Beta Stable Stable Stable Stable
Multi-cluster mesh Stable Stable Stable Enhanced Enhanced
K8s support range 1.26-1.30 1.27-1.30 1.27-1.31 1.28-1.31 1.28-1.32
WASM plugin support Stable Stable Enhanced Enhanced Enhanced

Embed Badges

Add live Istio status badges to your README, docs, or dashboard.

Health Status

Overall support health

Istio Health Status
![Istio Health Status](https://img.releaserun.com/badge/health/istio.svg)

EOL Countdown

Next end-of-life date

Istio EOL Countdown
![Istio EOL Countdown](https://img.releaserun.com/badge/eol/istio.svg)

Latest Version

Current stable release

Istio Latest Version
![Istio Latest Version](https://img.releaserun.com/badge/v/istio.svg)

CVE Status

Known vulnerabilities

Istio CVE Status
![Istio CVE Status](https://img.releaserun.com/badge/cve/istio.svg)

Frequently Asked Questions

Common questions about Istio releases and lifecycle.

How does Istio versioning and support work?
Istio releases roughly quarterly. Each minor release is supported for about 6 months (until N+2 releases). At any time, the latest 3 minor versions receive patches. Istio follows semantic versioning: minor bumps may include breaking changes, patch bumps are bug/security fixes only.
What is Istio ambient mesh?
Ambient mesh is Istio's sidecarless data plane, graduated to stable in Istio 1.24 (late 2024). Instead of injecting an Envoy sidecar into every pod, ambient uses a shared ztunnel DaemonSet for L4 (mTLS, identity) and optional waypoint proxies for L7 (routing, policy). Benefits: lower resource overhead, no pod restarts for mesh enrollment, simpler operations. Trade-off: L7 features require waypoint proxy deployment.
Which Kubernetes versions does Istio support?
Each Istio release supports specific K8s versions. Istio 1.22 supports K8s 1.27-1.31, Istio 1.23 supports K8s 1.28-1.31, Istio 1.24 supports K8s 1.28-1.32. Always check the support status page at istio.io. Running Istio on unsupported K8s versions causes subtle breakage in webhook admission and CRD handling.
Should I use sidecar or ambient mode?
For new deployments, ambient is recommended if your use case is primarily mTLS and basic traffic management. Sidecar mode is more mature and supports the full feature set (custom EnvoyFilters, WASM extensions, per-pod L7 policy). If you need EnvoyFilter or WASM, stick with sidecars. If you want simpler ops and lower overhead, go ambient.
How complex are Istio upgrades?
Istio upgrades are the most complex of any CNCF project. You must upgrade one minor version at a time. Canary upgrades (running two control planes simultaneously) are recommended. Sidecar proxies must be restarted to pick up the new version. In large clusters (1000+ pods), this can take hours. Use istioctl upgrade for in-place or Helm for canary. Always test in staging first.
Which Envoy version does Istio use?
Istio pins a specific Envoy version per release. Istio 1.22 uses Envoy 1.30, Istio 1.23 uses Envoy 1.31, Istio 1.24 uses Envoy 1.32. You cannot independently choose the Envoy version. Upgrading Istio automatically upgrades the Envoy data plane after pod restarts.

Related Tools

Dep EOL Scanner

Check your dependencies for end-of-life packages.

Stack Health Scorecard

Get an overall health grade for your tech stack.

Release Index

Browse all tracked platforms and their release timelines.
Browse All Version History