Istio 1.29 End of Life: October 15, 2026, and the Move to 1.31
Istio 1.29 reached end of life on October 15, 2026. Istio's 1.29.9 release notes, posted that day, say so plainly: “This is the final 1.29 release, as 1.29 reached end of life on October 15, 2026.” The date comes from a rule, not a calendar: a minor release is supported until six weeks after the release two minors later, and Istio 1.31 shipped on August 27, 2026. Since that day there are no further 1.29.x patch releases, no security bulletins naming the 1.29 line, and no backports of the Envoy fixes that Istio bundles.
Why the date is October 15, not October 12
Istio's support policy reads: minor release support is provided until six weeks after the N+2 minor release. Istio 1.29's N+2 is 1.31, which was released on August 27, 2026. Until the day itself, Istio labelled 1.29's end of life as expected, and an Istio end-of-life notice of September 9 gave it as October 12, three days earlier. The project then put the end on October 15: its supported-releases table lists that date, and the final 1.29.9 patch, released on October 15, says 1.29 reached end of life that day. This page follows the table and the final patch notes. The date is read from Istio's supported-releases table every day, so if the project moves it again, the number above moves with it.
The policy also explains the shape of the whole table: with a new minor roughly every quarter, each line lives about eight months, and only two minors are supported at any time. There is no long-term-support line and the open-source project offers no extended support for a minor after its end of life. Commercial Istio distributions carry their own support terms, which are not the project's.
Supported Istio releases
| Minor | Released | End of life | Tested Kubernetes versions | Status |
|---|---|---|---|---|
| 1.31 | 2026-08-27 | around February 2027 (Istio marks it expected) | 1.32 to 1.36 | Supported, current |
| 1.30 | 2026-05-14 | around December 2026 (Istio marks it expected) | 1.32 to 1.36 | Supported |
| 1.29 | 2026-02-16 | 2026-10-15 | 1.31 to 1.35 | End of life |
| 1.28 | 2025-11-05 | 2026-07-01 | 1.30 to 1.34 | End of life |
| 1.27 | 2025-08-11 | 2026-04-07 | 1.29 to 1.33 | End of life |
Istio prints only a month for the two younger lines, so this page prints only a month for them too. The Kubernetes column is Istio's own "tested, supported" list: 1.29 was never tested on Kubernetes 1.36, so a cluster that has moved to 1.36 is already outside the tested matrix for 1.29 before the end-of-life date arrives.
What the 2026 security bulletins fixed in 1.29
Istio has published six security bulletins in 2026 so far, and every one of them named the 1.29 line or all releases. The latest, ISTIO-SECURITY-2026-006 on August 27, 2026, covered 1.29.0 through 1.29.6 with a top CVSS score of 7.7, bundling CVEs reported by Envoy with Istio's own fixes for a control-plane denial of service through EnvoyFilter and a fail-open in BackendTLSPolicy on sidecars. Earlier bulletins in the year fixed an authorization bypass and an SSRF (2026-003), a man-in-the-middle path through the VirtualService mesh gateway option (2026-002), and three rounds of Envoy CVEs (2026-001, 004, 005).
That cadence, roughly one bulletin a month, is the cost of running an unsupported line. Since October 15, 2026, bulletins list fixed versions for 1.30 and 1.31 only. A 1.29 mesh now carries every subsequent Envoy and Istio CVE unpatched, in the component that terminates TLS and enforces authorization for every workload in the cluster. Istio's CPE for scanners is cpe:2.3:a:istio:istio; the product page lists the package URLs for the control-plane and proxy images.
The Envoy line underneath
Istio's data plane is Envoy, and Envoy keeps its own release calendar with a one-year window per minor. Envoy 1.36 reached end of life on October 14, 2026, one day before Istio 1.29. The two dates are independent, but they landed together: an Istio minor only receives the Envoy fixes that Istio's bulletins backport, so once the Istio minor is unsupported, the Envoy line inside it is unsupported in practice regardless of Envoy's own date.
Moving off 1.29
- Target 1.31 unless you are already mid-upgrade. It has the longest window (expected around February 2027; Istio names no day) and is tested on Kubernetes 1.32 to 1.36. 1.30 is expected to end around December 2026 (Istio names no day), which buys only weeks.
- Check the cluster version first. Both supported minors are tested on Kubernetes 1.32 to 1.36. A cluster still on 1.31 needs its own upgrade before, or alongside, the mesh.
- Read the upgrade notes for every minor you cross. Istio publishes upgrade notes per release with the behaviour changes and removed APIs. Canary upgrades (a second control-plane revision, workloads moved namespace by namespace) are the low-risk path for a production mesh; in-place upgrades are faster and riskier.
- Plan the next hop now. With an eight-month window per line, a mesh that lands on 1.31 now needs to be on 1.32 or 1.33 by early 2027. Put the N+2 rule in the upgrade calendar rather than the date.
The Istio product page carries every minor with its live score, and the API serves the same dates with their source: curl -H "X-API-Key: YOUR_KEY" https://api.endoflife.ai/v1/score/istio/1.29.
Frequently asked questions
When did Istio 1.29 reach end of life?
October 15, 2026. Istio's supported-releases table gives that date, and the 1.29.9 release notes, posted the same day, say: “This is the final 1.29 release, as 1.29 reached end of life on October 15, 2026.” An earlier Istio notice of September 9 had said October 12. The date follows the project's support policy: a minor release is supported until six weeks after the release two minors later.
Does Istio offer extended support for an end-of-life minor?
No. The open-source project has no long-term-support line and issues no patches for a minor after its end of life. Commercial Istio distributions carry their own support terms, which are not the project's.
Which release should replace Istio 1.29?
Istio 1.31, released August 27, 2026, is the current line and has the longest remaining window. Istio 1.30, released May 14, 2026, is expected to reach end of life around December 2026 (Istio marks it expected and names no day) and ends next. Both are tested on Kubernetes 1.32 through 1.36.
What about the Envoy proxy that Istio 1.29 ships?
Envoy maintains its own release lines with a one-year window each. Envoy 1.36's end of life date was October 14, 2026, one day before Istio 1.29's. Istio's own bulletins carry the Envoy CVE fixes for supported Istio minors, so an unsupported Istio minor also stops receiving Envoy fixes.
Related
- Istio and Envoy product pages — every minor with its live score
- Kubernetes end-of-life guide — the cluster versions the mesh is tested on
- GKE version end of life — managed-cluster windows
- How we verify our dates — sources, confidence and the disagreement log