Istio 1.29 End of Life: Support Ends October 12, 2026 (Expected)
Istio 1.29 is expected to reach end of life on October 12, 2026. Istio marks the date as expected rather than fixed because it comes from a rule, not a calendar: a minor release is supported until six weeks after the release two minors later, and Istio 1.31 shipped on August 27, 2026. From that day, no further 1.29.x patch releases, no security bulletins naming the 1.29 line, and no backports of the Envoy fixes that Istio bundles.
Why the date is October 12 and why Istio calls it expected
Istio's support policy reads: minor release support is provided until six weeks after the N+2 minor release. Istio 1.29's N+2 is 1.31, which was released on August 27, 2026; the project publishes the resulting end of life for 1.29 as October 12, 2026 and labels it expected. The date on this page is read from Istio's supported-releases table every day, so if the project moves it, the number above moves with it.
The policy also explains the shape of the whole table: with a new minor roughly every quarter, each line lives about eight months, and only two minors are supported at any time. There is no long-term-support line and the open-source project offers no extended support for a minor after its end of life. Commercial Istio distributions carry their own support terms, which are not the project's.
Supported Istio releases
| Minor | Released | End of life | Tested Kubernetes versions | Status |
|---|---|---|---|---|
| 1.31 | 2026-08-27 | about February 2027 (expected) | 1.32 to 1.36 | Supported, current |
| 1.30 | 2026-05-14 | about December 2026 (expected) | 1.32 to 1.36 | Supported |
| 1.29 | 2026-02-16 | 2026-10-12 (expected) | 1.31 to 1.35 | Supported until end of life |
| 1.28 | 2025-11-05 | 2026-07-01 | 1.30 to 1.34 | End of life |
| 1.27 | 2025-08-11 | 2026-04-07 | 1.29 to 1.33 | End of life |
Istio prints only a month for the two younger lines, so this page prints only a month for them too. The Kubernetes column is Istio's own "tested, supported" list: 1.29 was never tested on Kubernetes 1.36, so a cluster that has moved to 1.36 is already outside the tested matrix for 1.29 before the end-of-life date arrives.
What the 2026 security bulletins fixed in 1.29
Istio has published six security bulletins in 2026 so far, and every one of them named the 1.29 line or all releases. The latest, ISTIO-SECURITY-2026-006 on August 27, 2026, covered 1.29.0 through 1.29.6 with a top CVSS score of 7.7, bundling CVEs reported by Envoy with Istio's own fixes for a control-plane denial of service through EnvoyFilter and a fail-open in BackendTLSPolicy on sidecars. Earlier bulletins in the year fixed an authorization bypass and an SSRF (2026-003), a man-in-the-middle path through the VirtualService mesh gateway option (2026-002), and three rounds of Envoy CVEs (2026-001, 004, 005).
That cadence, roughly one bulletin a month, is the cost of running an unsupported line. After October 12, 2026 the next bulletin will list fixed versions for 1.30 and 1.31 only. A 1.29 mesh will carry every subsequent Envoy and Istio CVE unpatched, in the component that terminates TLS and enforces authorization for every workload in the cluster. Istio's CPE for scanners is cpe:2.3:a:istio:istio; the product page lists the package URLs for the control-plane and proxy images.
The Envoy line underneath
Istio's data plane is Envoy, and Envoy keeps its own release calendar with a one-year window per minor. Envoy 1.36 reaches end of life on October 14, 2026, two days after Istio 1.29. The two dates are independent, but they land together: an Istio minor only receives the Envoy fixes that Istio's bulletins backport, so once the Istio minor is unsupported, the Envoy line inside it is unsupported in practice regardless of Envoy's own date.
Moving off 1.29
- Target 1.31 unless you are already mid-upgrade. It has the longest window (about February 2027, expected) and is tested on Kubernetes 1.32 to 1.36. 1.30 ends about December 2026, which buys only weeks.
- Check the cluster version first. Both supported minors are tested on Kubernetes 1.32 to 1.36. A cluster still on 1.31 needs its own upgrade before, or alongside, the mesh.
- Read the upgrade notes for every minor you cross. Istio publishes upgrade notes per release with the behaviour changes and removed APIs. Canary upgrades (a second control-plane revision, workloads moved namespace by namespace) are the low-risk path for a production mesh; in-place upgrades are faster and riskier.
- Plan the next hop now. With an eight-month window per line, a mesh that lands on 1.31 in October needs to be on 1.32 or 1.33 by early 2027. Put the N+2 rule in the upgrade calendar rather than the date.
The Istio product page carries every minor with its live score, and the API serves the same dates with their source: curl https://api.endoflife.ai/v1/score/istio/1.29.
Frequently asked questions
When does Istio 1.29 reach end of life?
Istio lists October 12, 2026 as the expected end of life for 1.29. The date follows the project's support policy: a minor release is supported until six weeks after the release two minors later, and Istio 1.31 shipped on August 27, 2026.
Does Istio offer extended support for an end-of-life minor?
No. The open-source project has no long-term-support line and issues no patches for a minor after its end of life. Commercial Istio distributions carry their own support terms, which are not the project's.
Which release should replace Istio 1.29?
Istio 1.31, released August 27, 2026, is the current line and has the longest remaining window. Istio 1.30, released May 14, 2026, is supported until about December 2026 and ends next. Both are tested on Kubernetes 1.32 through 1.36.
What about the Envoy proxy that Istio 1.29 ships?
Envoy maintains its own release lines with a one-year window each. Envoy 1.36 reaches end of life on October 14, 2026, two days after Istio 1.29. Istio's own bulletins carry the Envoy CVE fixes for supported Istio minors, so an unsupported Istio minor also stops receiving Envoy fixes.
Related
- Istio and Envoy product pages — every minor with its live score
- Kubernetes end-of-life guide — the cluster versions the mesh is tested on
- GKE version end of life — managed-cluster windows
- How we verify our dates — sources, confidence and the disagreement log