Skip to content

Instantly share code, notes, and snippets.

@Pawan-Bishnoi

Pawan-Bishnoi/release-diff-1.0.41-vs-1.0.50.md

Created June 29, 2026 07:39
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save Pawan-Bishnoi/d1c4cdd1f7ea8531a3c078066799ee26 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save Pawan-Bishnoi/d1c4cdd1f7ea8531a3c078066799ee26 to your computer and use it in GitHub Desktop.
Download ZIP
Release diff: istiod canary 1.23 — 1.0.41 vs 1.0.50
Raw
release-diff-1.0.41-vs-1.0.50.md

Release Diff: mesh.canary_1_23 — 1.0.41 vs 1.0.50

Service: istiod
Pipeline: deploy-canary-revision
Branch: release-1.23

Helm Charts (istio-installer-helm-charts) — 5 commits (ff408e0 → 5a8810e)

Commit Description
5a8810e @W-23081193: Add per-proxy xDS recycle at :15011, gated by enableXdsControlAtPilotProxy
498c2cc @W-23081193: Gate istiod keepalive=0s behind enableXdsControlAtPilotProxy flag
dfd9c2e @W-23057552: Make preserve_client_ip configurable via values.yaml
7825e1c Update packaging SHA for zipkin changes
0b8543e @W-22431926: Skip VPA MDO template ConfigMap on non-primary clusters

Key changes:

  • xDS connection recycling (W-23081193): New flag enableXdsControlAtPilotProxy — when enabled, sets keepalive to 0s and adds max_connection_duration: 1800s / max_stream_duration: 1990s on the :15011 listener for per-proxy recycling.
  • preserve_client_ip (W-23057552): Now templated from values.yaml instead of hardcoded false.
  • VPA MDO (W-22431926): VPA ConfigMap skipped on non-primary clusters.
  • istioTag bump: release-1.23-4b6a304e → release-1.23-25fd5a7f (pulls in zipkin fix).

Structured Config (istiod-fedx) — 5 commits (0807cb8 → 8f9f1eb)

Commit Description
8f9f1eb @W-23081193: Enable enableXdsControlAtPilotProxy for pre-prod-phase-2/3/4
fcba5a7 @W-23081193: Enable enableXdsControlAtPilotProxy for pre-prod-phase-1
983ed51 @W-23081193: Enable enableXdsControlAtPilotProxy for pre-prod-phase-0
6a4f9fe @W-23081193: Enable enableXdsControlAtPilotProxy for scratchpad15
10c7162 @W-22561399: Switch VPA to enabled mode

Key changes:

  • VPA (W-22561399): istiod.vpa.mode changed from "shadow" → "enabled" across all 5 prod phases.
  • xDS control (W-23081193): enableXdsControlAtPilotProxy: true added to all 5 pre-prod phase configs (incremental rollout).

Binary / istio-packaging (istio-packaging) — 1 commit (db4f20b → 25fd5a7)

Commit Description
25fd5a7 Port zipkin protocol and port changes (#1472)

Key change:

  • Zipkin tracing protocol gating: In proxy/files/envoy_bootstrap_v2.json, adds a conditional — if the tracing SNI contains "sfproxy" (port 9443, supports HTTP/2), use http2_protocol_options; otherwise (direct funnel on port 443 / AAG, HTTP/1.1 only), use http_protocol_options: {}. Prevents upstream_cx_protocol_error on endpoints that don't support HTTP/2.

Summary

The main themes across this release delta are:

  1. W-23081193 (xDS control) — new per-proxy connection recycling feature, rolled out to pre-prod via structured config
  2. W-22431926 (VPA) — VPA fully enabled in prod + MDO template skipped on non-primary clusters
  3. Zipkin HTTP/2 fix — protocol gating in envoy bootstrap to handle different tracing endpoints
  4. W-23057552 — preserve_client_ip made configurable

Artifact Versions

Artifact Version (1.0.41) Version (1.0.50)
Helm charts istio-installer-1.0.0-release-1.23-73.tar.gz istio-installer-1.0.0-release-1.23-78.tar.gz
Structured config timestamp=17816515570713219 timestamp=17824521691260589
istioctl 8.0.2600-rhel9.aws.com.release-1.23.db4f20b 8.0.2700-rhel9.aws.com.release-1.23.25fd5a7
discovery-metrics-agent 100.0.591800 (unchanged) 100.0.591800 (unchanged)
metrics-scraper 100.0.662001 (unchanged) 100.0.662001 (unchanged)
FIT bundle 150.0.1148800 150.0.1127700
mesh-fit-tests 1.80.0 1.79.0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment