Istio teams face urgent migration as Google Cloud hosting ends
Teams running Istio with Google Cloud-hosted images and Helm charts are now racing the clock. Istio 1.31 has started pulling release artifacts from Google Cloud. The project is moving everything to Docker Hub. The next outage test hits October 13. The final cutoff comes in December. There is no time to waste.
Solo.io has positioned agentgateway as a full-featured AI-native gateway, supporting Kubernetes Gateway API, MCP/A2A protocols, and a Rust implementation, confirming its evolution beyond the original Istio 1.31 announcement.
Agentgateway waypoints reshape ambient mesh
Istio 1.31 brings more than just a hosting change. The update adds agentgateway as a Layer 7 waypoint proxy for ambient mesh. This new data plane is written in Rust and was donated by Solo.io to the Linux Foundation. It now runs through the istio-agentgateway-waypoint GatewayClass. Supported protocols include Model Context Protocol and standard HTTP. This builds on the gateway-only integration first seen in version 1.30. A technical overview from September 2026 describes agentgateway as a waypoint, ingress, and egress proxy for Istio ambient mesh. The project is moving in a new direction.
Traffic management gets a real boost. Teams can set a canary waypoint for a service or namespace using the use-waypoint-canary label. They can control traffic split with the use-waypoint-canary-weight annotation. This lets teams shift traffic between waypoints in alpha stage, without changing clients. Long-lived connections might slow down the full switch. Independent Istio docs from late September 2026 describe ambient mesh as using per-node ztunnel and optional waypoint proxies for Layer 7 features. This matches the new focus on waypoint-based traffic control.
Istio 1.31.1, released September 21, fixed a major bug. Canary-only agentgateway waypoints were missing the right routes and policies. That caused rejected connections. The patch also brings security fixes and corrects ALLOW_ANY_DYNAMIC_DNS forwarding for IPv6-only clusters. The 1.31.1 release shows the 1.31 line is still getting bug fixes and production support. A late September 2026 GitHub README confirms this ongoing work.
Traffic management and security enhancements
A late-September 2026 technical overview states that Istio ambient mode remains the current default for teams needing a full mesh, reinforcing that the waypoint/ambient direction is not experimental-only in practice.
Outbound traffic is easier to manage. The ALLOW_ANY_DYNAMIC_DNS mode now resolves hostnames from the HTTP Host header at request time. Teams no longer need a ServiceEntry for every external destination.
Security rules are tighter. A new fips-140-3 value for the COMPLIANCE_POLICY environment variable enforces TLS 1.2 or later, FIPS-compliant cipher suites, and P-256/P-384 curves. Go components must be built with Go 1.24 or later and a validated GOFIPS140 version. Just setting the runtime policy is not enough. AuthorizationPolicy now has trustDomains and notTrustDomains fields. These match or exclude requests by trust domain from peer certificates.
Migration deadlines and operational impact
The next "scream test" that disables old endpoints is set for October 13, from 15:00 to 18:00 UTC. The final test runs December 8 to December 9. Teams that check image signatures must update their keys. Use istio-key.pub for 1.31.0 and istio-key-v2.pub for 1.31.1 and later. Jin explained why Docker Hub was chosen over GHCR. GHCR has undocumented limits that can't handle Istio's scale.
Kubernetes operators can't ignore this. Forced migration, new traffic controls, and stricter security rules mean teams must act now. Outages and compliance failures are real risks. The Istio project is clear: move fast or get left behind. Google Cloud is no longer home.
