Alibaba Cloud Service Mesh:Release notes

Feature

Description

Regions

Versions

Editions

References

Support for version 1.28

Adds support for Istio version 1.28.

• Inference extensions now support InferencePool v1.

• Gateway API and traffic management enhancements:

  • Adds full support for Gateway API v1.4.

  • Extends TLS configuration to support services outside the Service Mesh.

  • ServiceEntry now supports wildcard hosts configured with DYNAMIC_DNS.

• Ambient mode enhancements:

  • Supports traffic lanes using Baggage propagation.

  • Ztunnel now supports Layer 7 access logging, which is disabled by default.

  • Supports traffic fallback.

  • Supports Serverless scenarios.

• Upgrade notes:

  • Starting from version 1.28, you must restart workloads for the periodic metric cleanup configuration to take effect.

All

1.28

All

Versioning

Enhanced pre-upgrade checks

Before an upgrade, Mesh diagnostics runs to detect configuration issues in the Service Mesh. These issues do not block the upgrade, but we recommend fixing them to prevent unexpected behavior afterward.

All

1.25 and later

All

Use ASM mesh diagnostics

Mesh diagnostics enhancement

Adds a new diagnostic check for an excessive number of pods in the Data Plane.

All

1.25 and later

All

Use ASM mesh diagnostics

Feature updates

• Hash-based tagging plugin enhancements:

  • Supports extracting data from cookies.

  • Supports configuring traffic policies for when a header is absent.

  • Supports rewriting extracted data by using regular expressions.

All

1.24 and later

All

Feature

Description

Regions

Versions

Editions

References

Support for version 1.27

Adds support for Istio version 1.27.

• Sidecar mode now supports Container Compute Service (ACS) GPU instances.

• Enhanced Gateway API support: Adds support for the ListenerSets API.

• Supports locality-aware traffic routing for Kubernetes services at the node and Availability Zone levels.

• DestinationRule now supports RetryBudget configuration.

All

1.27

All

Versioning

Enhanced access to Istio resources via the data plane KubeAPI

You can use the Terraform Kubernetes Provider in Container Service for Kubernetes (ACK) clusters to manage Service Mesh (ASM) resources.

All

1.26 and later

All

Access Istio resources through the KubeAPI of a data plane cluster

Mesh diagnostics enhancement

Adds conflict detection for the Hosts field in ServiceEntry.

All

1.27 and later

All

Use ASM mesh diagnostics

Feature

Description

Region

Version

Editions

References

Support for version 1.26

• Supports Istio 1.26.

• Supports Gateway API 1.3 and TCPRoute.

• The CNI plugin no longer uses hostNetwork to avoid port conflicts.

• Supports matching VirtualHost using EnvoyFilter.

All

N/A

All

Versioning

Enhanced graceful shutdown for Service Mesh (ASM) gateways

Supports a longer drain duration and improves support for HTTP and gRPC protocols.

All

1.26 and later

Enterprise Edition and Ultimate Edition

Enable graceful shutdown to prevent traffic loss

Support for managing Service Mesh (ASM) through the ACK component center

Create and add Service Mesh (ASM) instances from the ACK component center.

All

N/A

All

servicemesh-operator component

Feature

Description

Regions

Applicable versions

Applicable editions

References

Enhanced data plane KubeAPI access

Adds support for server-side apply and patch operations.

All

1.25.6.101 and later

All

Access Istio resources through the KubeAPI of a data plane cluster

New diagnostic checks for Mesh Diagnostics

Adds the following diagnostic checks:

• Validation for regular expressions in HTTPRoute.

• A diagnostic check for the Gateway API version on the data plane.

All

1.25.6.101 and later

All

Use ASM Mesh Diagnostics

Graceful shutdown for waypoints in Ambient mode

Lets you customize the ProxyConfig field of a waypoint proxy to specify drain-related parameters, enabling graceful shutdown during waypoint rolling updates.

All

1.25.6.101 and later

All

Customize waypoint configurations

ASM Gateway defaults to NLB

Network Load Balancer (NLB) is a high-performance Layer 4 load balancing service with automatic elasticity, designed for high-concurrency scenarios involving a large number of connections.

All

1.18 and later

Enterprise and Ultimate editions

Use Network Load Balancer (NLB) in ASM ingress gateways

Feature

Description

Publishing region

Version

Edition

References

Support for Version 1.25

Supports Istio 1.25.

Ambient Sidecarless Mode is now in General Availability (GA):

• Improves ztunnel stability.

• Adds support for waypoint resource customization.

All

N/A

All

Versioning

Mesh Diagnostics 2.0

Adds more than 30 new diagnostic rules and supports diagnostics for Ambient Sidecarless Mode. Diagnostic results are now standardized and more specific. This feature is compatible with the upstream community.

All

1.25 and later

All

N/A

Support for Certificate Management

You can now deploy certificates from the Certificate Management Service console directly to a Data Plane Cluster for use by an ASM Gateway.

All

1.25 and later

All

Use SSL certificates from Certificate Management Service in an ASM gateway

Enhanced Circuit Breaking and Throttling

Improves semantic consistency. You can now reference resource objects, such as VirtualService and Kubernetes Service, in throttling configurations.

All

1.25 and later

All

• ASMCircuitBreaker CRD reference

• ASMLocalRateLimiter CRD reference

• ASMGlobalRateLimiter CRD reference

GUI Operations for the Traffic Scheduling Suite

You can now enable and configure the Traffic Scheduling Suite through the GUI, which reduces complexity and improves the user experience.

All

All

All

Use the ASM traffic scheduling suite for traffic control in distributed systems

Feature

Description

Regions

Applicable versions

Applicable editions

References

Proportional Sidecar Resource Allocation

You can now set a ratio to allocate Resources to a Sidecar Container in proportion to the Resources of its corresponding Application Container.

All

1.24 and later

All

Configure Sidecar Resources by ratio

Local development and testing with KtConnect and Service Mesh

KtConnect is a local development tool for Kubernetes. Its deployed proxy is compatible with the core traffic management capabilities of Service Mesh (ASM). This integration helps you debug local Applications more efficiently and accelerate your development and testing workflow.

All

All

All

Local development and testing with KtConnect and Service Mesh

Custom status codes for local Rate Limiting

You can now configure custom HTTP status codes for responses when a local Rate Limit is triggered.

All

1.24.6.64 and later

All

ASMLocalRateLimiter CRD

Distributed Tracing at the Namespace and Workload levels

Starting with version 1.24.6.83, you can use the Kubernetes API to configure Distributed Tracing at the Namespace and Workload levels by modifying Telemetry Resources.

All

1.24.6.83 and later

All

Distributed Tracing settings

Support for trusted CIDR blocks in X-Forwarded-For headers

You can now configure trusted CIDR blocks in addition to the number of trusted proxies. This gives Gateways more flexibility to determine a request's true Source IP.

All

1.24 and later

All

Configure the X-Forwarded-For header to allow ASM Gateways to obtain client Source IPs

Feature

Description

Regions

Applicable versions

Applicable editions

References

Forced sidecar injection policy

Enable the forced ASM sidecar injection policy in ACK Policy Management to secure east-west traffic within your Cluster.

All

1.24 and later

All

Enforce the forced sidecar injection policy for a Cluster

ASMCircuitBreaker enhancements

ASMCircuitBreaker now supports configuring Circuit Breaking rules for Gateway errors.

All

1.24.6.54 and later

All

ASMCircuitBreaker CRD reference

LLMRoute CRD for AI traffic routing

The LLMRoute CRD routes traffic to specified external LLM services or in-cluster Inference Pools by matching conditions such as Request Headers and resource tags.

All

1.21 and later

All

LLMRoute CRD reference

Manage Service Mesh resources using the Go SDK

Use the Go SDK to programmatically manage resources in Service Mesh.

All

1.24 and later

All

Manage Service Mesh resources using the Go SDK

Configure Grafana Dashboards and Alert Rules for Circuit Breaking and Throttling

Learn best practices for configuring Grafana Dashboards and Alert Rules for Circuit Breaking and Throttling.

All

All

All

Configure Grafana Dashboards and Alert Rules for Circuit Breaking and Throttling

Feature

Description

Regions

Versions

Editions

References

CNI compatibility with debian_12_7_x64_20G_alibase_20241031.vhd

Service Mesh (ASM) CNI now supports Debian nodes.

All

1.24 and later

All

None

Configure mesh instances using the ASMMeshConfig CRD

ASMMeshConfig is a Custom Resource provided by Service Mesh (ASM) to globally configure core service mesh parameters. This CRD centrally manages mesh-level settings, such as connection timeouts, protocol detection, path normalization, and retry policies. It also supports Resource Quotas and behavioral controls for the Sidecar Injector.

All

1.24 and later

All

ASMMeshConfig CRD

Message queue adaptation for loose Traffic Lanes

In loose Traffic Lane scenarios, if you want message queues to preserve and carry lane tags, you must adapt your application. Service Mesh (ASM) provides a standard adaptation solution.

All

1.21 and later

All

Adapt message queues in ASM loose traffic lanes

ASMEgressTrafficPolicy support for external TCP services

ASMEgressTrafficPolicy now supports external TCP services. You can use ASMEgressTrafficPolicy to easily configure egress traffic for protocols such as HTTP, HTTPS, and TCP. This update also introduces automatic Egress Gateway port allocation, reducing maintenance effort.

All

1.24 and later

All

Manage egress traffic using ASMEgressTrafficPolicy

ASMExtensionProvider CRD documentation

ASMExtensionProvider is a Component that extends and configures mesh features. It supports the flexible integration and custom configuration of key features, such as Distributed Tracing and Access Logs.

All

1.23 and later

All

ASMExtensionProvider CRD

Feature

Description

Regions

Version

Specification

References

Support for Version 1.24

Supports Istio 1.24.

All

N/A

All

Versioning

Enhanced Load Balancing and Traffic Management for in-cluster LLM services

Traditional Load Balancing methods are often ineffective for LLM Inference Services deployed in a Kubernetes Cluster because of the unique characteristics of LLM inference traffic and Workloads. Additionally, extracting LLM-specific information from logs and monitoring metrics is difficult.

Service Mesh (ASM) now lets you declare Inference Service pools and routing definitions for LLM Inference Services in a Cluster, improving Load Balancing performance and enabling intelligent Traffic Management and Observability for inference traffic. This feature currently supports LLM Inference Services deployed with vLLM.

All

1.24 or later

All

Smart routing and traffic management based on multiple dimensions such as request queues, KVCache, and LoRA awareness

In-place Migration from Istio

Service Mesh (ASM) supports an In-place Migration from Istio. For a Cluster with an existing Istio installation, you can migrate to ASM without downtime. During the migration, ASM and Istio coexist, allowing you to gradually switch Workloads from Istio sidecar injection to ASM Mesh Proxy injection. This progressive approach ensures a smooth transition until Service Mesh (ASM) fully manages all Workloads.

This In-place Migration feature currently supports migrating from single-cluster, primary-remote, multi-primary, and hybrid Istio architectures to Service Mesh (ASM).

All

1.24 or later

All

In-place Canary Migration from Istio to ASM

Feature

Description

Regions

Versions

Editions

References

Istio 1.23 support

Supports Istio 1.23.

All

1.23 or later

All

Versioning

Use Envoy External Processing for custom request handling

Envoy External Processing is an extension that uses an external service to enhance HTTP request and response handling. This eliminates the need to write Wasm plugins or other processing scripts, offering a more flexible and scalable solution.

All

1.23 or later

All

Use Envoy External Processing for custom request handling

Token-based throttling for LLM requests

Throttling LLM requests differs from throttling standard HTTP requests. Because the number of tokens per LLM request varies, the count must be dynamically obtained from the response. ASM provides default LLM request throttling based on the Token Bucket Algorithm and allows you to customize the algorithm.

All

1.23 or later

All

Implement LLM token throttling based on request headers

Exclude Pods with specified labels from the Service Discovery Scope

If a Pod is outside the Service Discovery Scope, the Control Plane will not discover it, and Sidecar Proxies will not send any requests to it. You can configure a Label Selector to exclude Pods with specific labels from the Service Discovery Scope. This allows you to quickly shift traffic away from a Pod for rapid failover.

All

1.20 or later

All

Configure a service discovery scope to improve the efficiency of mesh configuration pushes

Support for new fields in ASMGrpcJsonTranscoder

The ASMGrpcJsonTranscoder CRD is used for JSON/HTTP-to-gRPC protocol transcoding. In version 1.22 and later, ASMGrpcJsonTranscoder supports new fields for advanced scenarios such as converting gRPC errors to the response body and ignoring specific request query parameters.

All

1.22 or later

All

ASMGrpcJsonTranscoder CRD reference

LLM traffic management

Service Mesh (ASM) now supports the specialized HTTP protocols used by major Large Language Model (LLM) providers. This feature simplifies integration and enables advanced Traffic Routing and Observability for LLM traffic.

Alibaba Cloud International Website

1.21 or later

All

LLM traffic management

Feature

Description

Regions

Applicable versions

Product specifications

References

Implement user identity-based canary testing with traffic lanes and hash tagging

In a production environment, you may want to use traffic lanes to isolate stable and canary release versions and route traffic to different lanes based on user identity. Specifically, you might want to route a specific group of users to the canary release version for testing, while routing a certain percentage of requests from other users to the canary release version randomly based on weight.

All

1.18 or later

All

Implement user identity-based canary testing with traffic lanes and hash tagging

ASM supports namespace-level RBAC authorization

RAM users and RAM roles require RBAC authorization to operate on custom resources within ASM. You can use this authorization to control their specific Permissions.

All

All

All

Grant RBAC permissions to RAM users and RAM roles

Feature

Description

Regions

Applicable versions

Applicable editions

References

Multi-primary control plane mode

Service Mesh (ASM) supports a multi-primary control plane mode. In this architecture, multiple ASM instances manage multiple Kubernetes clusters. This mode provides significant advantages over a single-instance setup, such as better configuration isolation and lower configuration push latency. It is ideal for implementing multi-cluster disaster recovery for peer-deployed services.

All

1.22 and later

All

Implementing Multi-Cluster Disaster Recovery with the ASM Multi-Primary Control Plane Architecture

Native Sidecar proxy

Starting with version 1.28, Kubernetes introduced native Sidecar containers, which resolve known issues with the container lifecycle relative to the Pod lifecycle. Service Mesh (ASM) 1.22 and later supports this feature and adaptively enables the native Sidecar mode to inject the mesh proxy into a Pod.

All

1.22 and later

All

Deploying Mesh Proxies with the Native Sidecar Method

Metric Collection for the Traffic Scheduling Suite

You can collect monitoring metrics for the ASM request scheduling agent by integrating with Alibaba Cloud Managed Service for Prometheus or a self-managed Prometheus instance. This allows you to monitor how different policies in the traffic scheduling suite control and schedule traffic.

All

1.21 and later

All

Controlling Traffic in Distributed Systems with the ASM Traffic Scheduling Suite

Metric Extension with WASM Plugins

In addition to its built-in metrics, Service Mesh (ASM) provides a powerful extension mechanism. You can use WASM plugins to write custom logic based on request or response data. This allows you to add processed results as new dimensions to your monitoring metrics, providing deeper visibility into your application's behavior.

All

1.18 and later

All

Extending ASM Monitoring Metric Dimensions with a WASM Plugin

Periodic Cleanup of Monitoring Metrics

Service Mesh (ASM) generates metrics such as traffic volume, error rates, and request latency for all service traffic, allowing you to monitor service behavior. Over time, accumulating this data increases resource consumption for both the Envoy proxies and Prometheus. To address this, ASM now offers periodic metric cleanup. This feature automatically removes unused metrics cached in Envoy, reducing memory usage and lowering the network load from Prometheus scrapes.

All

1.18 and later

All

Configuring Periodic Cleanup of ASM Monitoring Metrics

Feature

Description

Regions

Versions

Editions

References

Deploy and manage Service Mesh (ASM) on CloudBox

Create a CloudBox node pool in an ACK Cluster and schedule workload Pods to its nodes to use CloudBox resources. After adding the ACK Cluster to Service Mesh (ASM), ASM manages Pods on both the public cloud and the CloudBox node pool, providing unified routing, security, and observability for inter-application traffic.

All

All

All

Manage workloads on ACK CloudBox nodes using ASM

Manage Kubernetes clusters imported via Kubeconfig

Service Mesh (ASM) supports importing any Kubernetes cluster using a Kubeconfig file with cluster administrator permissions, enabling Application Management on the imported cluster.

All

1.22 or later

All

Manage Kubernetes clusters imported via Kubeconfig

Best Practices: End-to-end security

A standard TLS connection only requires the client to validate the server's certificate, leaving the client's identity unverified. For higher security, mTLS (Mutual TLS) requires both the client and server to present certificates. Encrypted communication begins only after this mutual validation is successful.

All

1.22 or later

All

• Implement end-to-end mTLS encryption for applications using ASM

• Configure an mTLS service on an ASM ingress gateway and restrict access from specific clients

• Use an ASM egress gateway to access an external mTLS service

Best Practices:

Custom error pages

An ingress gateway or mesh proxy sometimes responds directly to a client with an HTTP response code instead of proxying the request to an upstream service. The CustomLocalReply Wasm plugin lets you customize the body and status code of these direct responses, allowing you to define unique response content for each status code.

All

All

All

CustomLocalReply plugin

ASMSwimlane/ASMSwimlaneGroup CRD enhancements

You can now apply custom destination traffic policies and HTTP routing operations to services within a traffic lane group.

All

1.22 or later

All

ASMSwimLaneGroup and ASMSwimLane CRDs

Support for remote control plane mode

Use the remote control plane mode to reduce configuration push latency. This mode is ideal when your data plane cluster is in a different public cloud or an on-premises data center, and the network connection to the Service Mesh (ASM) managed control plane is unstable or bandwidth-limited.

All

1.22 or later

All

• Use the ASM remote control plane to reduce push latency

• Enable mutual access between workloads of a remote control plane and a managed control plane

Develop Wasm plugins using Rust

Service Mesh (ASM) supports deploying Wasm plugins to the mesh proxy to add custom logic. The proxy-wasm community provides a Rust Software Development Kit (SDK) for building these plugins.

All

1.18 or later

All

Develop Wasm plugins for the mesh proxy using Rust

Feature

Description

Regions

Applicable versions

Supported editions

References

Support for Istio 1.22

This release adds support for Istio 1.22, which includes the following key updates:

• Native sidecar container support (enabled by default in Container Service for Kubernetes (ACK) 1.30 and later).

• Container Compute Service (ACS) cluster support.

• Yitian ARM support.

• The Gateway API is updated to v1.1 and adds support for GRPCRoute.

• The Control Plane now uses Delta xDS by default to communicate with the Data Plane, improving configuration push efficiency.

• Authorization Policy now supports matching the request path using templates.

• Authorization policies now include a timeout for fetching a jwksUri.

All

1.22 or later

All

N/A

New ACMG mode

The Alibaba Centralized Mesh Gateway (ACMG) mode is a solution designed for large-scale network architectures. It improves network scalability, flexibility, and management efficiency.

All

1.22 or later

All

ACMG mode

Egress Traffic Security

You can use ASMEgressTrafficPolicy and an Egress Gateway to secure egress traffic from the mesh to external destinations.

All

1.20 or later

All

• Overview of egress traffic management

• Manage egress traffic using ASMEgressTrafficPolicy

Enhanced multi-cluster capabilities

This release enhances East-West Gateway capabilities. Cross-cluster calls through an East-West Gateway now support full Layer 7 Load Balancing, Authorization Policy, and CIDR conflict shielding. For multi-cluster scenarios without underlying network connectivity, a Service Mesh (ASM) East-West Gateway provides an experience equivalent to a fully connected network.

All

1.22 or later

Enterprise Edition, Ultimate Edition

Disaster recovery for multiple ACK clusters in different VPCs (achieving network connectivity using ASM cross-cluster mesh proxies)

Integration with ARMS for extended metrics

Service Mesh (ASM) provides Monitoring Metrics for the Data Plane. When enabled, gateways and sidecar proxies generate operational metrics that are collected in Alibaba Cloud Managed Service for Prometheus.

All

1.17.2.35 or later

All

Upgrade ASM monitoring metrics and dashboards

Best practices: Integrate a custom authorization service

You can now integrate with custom authorization services that use the HTTP and gRPC protocols.

All

1.20 or later

All

• Develop a custom authorization service based on the HTTP protocol

• Develop a custom authorization service based on the gRPC protocol

Monitoring Metrics and Alerting for Rate Limiting and Circuit Breaking

You can now collect Monitoring Metrics for Rate Limiting and Circuit Breaking in Alibaba Cloud Managed Service for Prometheus. This includes metrics for local and global Rate Limiting, as well as service-level, host-level, and Connection Pool Circuit Breaking. You can also configure Alerting based on these metrics to be notified of Rate Limiting or Circuit Breaking events.

All

All

All

• Configure local rate limiting in the traffic management center

• Use ASMGlobalRateLimiter to configure global rate limiting for application service ingress traffic

• Configure a connection pool to implement circuit breaking

• Use ASMCircuitBreaker to configure circuit breaking rules for inter-service call traffic

• Build fault tolerance for distributed systems using ASM

Feature

Description

Regions

Versions

Editions

Documentation

ASM Gateway support for HTTP/3 and QUIC protocols

The ASM Gateway now supports the HTTP/3 protocol. Compared to HTTP/2, HTTP/3 provides lower handshake latency, a new multiplexing mechanism, connection migration, and enhanced security. HTTP/3 is based on the UDP protocol, which allows you to enable TCP and UDP listeners on the same port without affecting existing HTTP/1.1 or HTTP/2 traffic.

All

1.16 or later

All

Access an ASM ingress gateway using the HTTP/3 protocol

Maximum downstream connection limit for sidecar proxies

You can now limit the maximum number of downstream connections a mesh proxy accepts. This helps prevent malicious attacks by controlling connection volume.

All

1.21 or later

All

Configure a sidecar proxy

Support for path normalization policies

You can now configure a path normalization policy for HTTP requests on the mesh proxy. This ensures that HTTP request paths within the Service Mesh are standardized, reducing security risks.

All

1.21 or later

All

Configure a path normalization policy for a service mesh

New policies for the ASM traffic scheduling suite

The ASM traffic scheduling suite now supports four new policies:

• Closed-loop feedback policy: Enables progressive rollouts for new services.

• Concurrency limit policy: Strictly limits request concurrency for a service.

• Concurrency scheduling policy: Performs priority-based request scheduling while strictly limiting concurrency.

• Quota scheduling policy: Performs priority-based request scheduling while ensuring the request rate meets quota requirements.

All

1.21 or later

All

Use the ASM traffic scheduling suite for traffic control in distributed systems

ASM Lab

ASM Lab lets you set up a complete environment for a specific scenario with a single click. This includes workloads and all required declarative API (CR) resources. Each scenario in ASM Lab showcases a specific feature by automatically deploying the required resources and offering varying levels of control. This one-click setup helps you quickly explore the powerful features of Service Mesh (ASM).

All

1.21 or later

All

ASM Lab

Feature

Description

Regions

Applicable versions

Applicable specifications

References

Service mesh network packet capture

This feature lets you create a network packet capture task to capture traffic for a specific workload within the service mesh, helping you quickly diagnose complex traffic issues.

All

1.21 or later

All

Use network packet capture tasks to diagnose traffic in the mesh

ASM traffic scheduling suite

Built on service mesh principles, the ASM traffic scheduling suite offers various scheduling policies for advanced traffic management, such as per-user throttling and request priority scheduling.

All

1.21 or later

All

Use the ASM traffic scheduling suite for traffic control in distributed systems

EWMA load balancing

The EWMA load balancer selects endpoints by calculating a score based on the moving average of factors like static weight, latency, and Error Rate. This improves overall performance by avoiding poorly performing endpoints during occasional latency spikes or errors.

All

1.21 or later

All

Use Exponentially Weighted Moving Average (EWMA) for workload latency-based load balancing

Enhanced Knative integration

Knative on ASM is updated to version 1.12.4. This release streamlines integration with Container Service for Knative and offers a one-click deployment experience.

All

1.21 or later

All

Use ASM to simplify the management of Serverless workloads

Improved Terraform support

• Updates documentation examples to use the latest version of ASM.

• Introduces a new section on modifying Service Mesh (ASM) instance properties with Terraform.

• Introduces a guide for handling fields that are deleted when you run terraform apply.

All

1.21 or later

All

Manage ASM instances using Terraform

Feature

Description

Regions

Applicable versions

Applicable editions

References

Support for Istio 1.21

This release adds support for Istio 1.21, which is now generally available. This version includes the latest community features:

• When you write a Virtual Service or Destination Rule for a Service of the ExternalName type, you must use the domain name that the service points to.

• In a Virtual Service, you can now set the :authority header in the HTTPRouteDestination field.

• In a Destination Rule, you can now configure maxConcurrentStreams for an HTTP connection pool and idleTimeout for a TCP connection pool.

• You can now use the Sidecar resource to control the connection pool settings for inbound requests to a Sidecar Proxy.

All

1.21 or later

All

Versioning

Traffic Lane enhancements

Traffic Lane 3.0 now supports baggage header propagation and percentage-based traffic routing.

All

1.21 or later

All

• Implement loose mode traffic lanes by configuring ASMHeaderPropagation

• Scenario 3: Pass through Baggage request headers in a call chain

Enhanced multi-cluster capabilities

This release introduces a new multi-cluster network solution. When underlying cluster networks cannot be connected directly, you can use an ASM East-West Gateway to connect them over the public internet. The new document, Overview of multi-cluster management, describes the modes and paths for multi-cluster management in ASM.

All

1.21 or later

All

Disaster recovery for multiple ACK clusters in different VPCs (achieving network connectivity based on ASM cross-cluster mesh proxies)

Mesh Topology supports subgraph views

Mesh Topology now allows you to select a Namespace or an Application to view its sub-topology. This feature makes the service topology easier to view and use in large-scale deployments.

All

1.21 or later

All

Enable Mesh Topology to improve observability

Route-level configuration for ASMCompressor

ASMCompressor now supports route-level configuration, which allows you to enable compression by default while disabling it for specific routes. This simplifies configuration and reduces the risk of misconfiguration.

All

1.21 or later

All

Use ASMCompressor to define compression configurations for inter-application service calls

Feature

Description

Regions

Istio version

Editions

References

Istio 1.21 support

This release adds support for Istio 1.21 as a Canary Release, which includes the latest community features:

• For a Service of the ExternalName type, VirtualService and DestinationRule resources must use the Domain Name that the service points to.

• In a VirtualService, you can set the :authority header in the HTTPRouteDestination field.

• In a DestinationRule, you can configure maxConcurrentStreams for an HTTP connection pool and idleTimeout for a TCP connection pool.

• You can use the Sidecar resource's traffic configuration to manage connection pool settings for inbound requests to a sidecar proxy.

All

1.21 or later

All

Versioning

Automatic Certificate issuance for ASM gateways using the ACME Protocol

The ACME Protocol allows a certificate authority (CA) to automatically verify an applicant's Domain Name ownership before issuing a Certificate. Service Mesh (ASM) gateways can connect to various CAs through the ACME Protocol to dynamically obtain Domain Name Certificates, reducing Certificate maintenance overhead.

All

All

All

Issue certificates for an ASM gateway from an ACME CA

Data plane performance optimization with eRDMA and SMC

You can enable SMC-based performance optimization for Service Mesh Data Plane communication on eighth-generation Alibaba Cloud Elastic Compute Service (ECS) instances that support eRDMA and run Alibaba Cloud Linux (Alinux) 3.

All

1.21 or later

All

Accelerate network performance between service mesh pods based on eRDMA

Manage cross-VPC connectivity between Control Plane and Data Plane clusters with PrivateLink

When a Service Mesh (ASM) instance and a Data Plane Container Service for Kubernetes (ACK) cluster are in the same Region but different VPCs, you can use PrivateLink to establish connectivity between the Control Plane and Data Plane clusters. ASM provides a CRD-based method to simplify network configuration.

All

1.21 or later

All

Manage connectivity between control plane and data plane clusters across VPCs using PrivateLink

Accelerate inference for model services with dynamic subset routing

Dynamic subset routing in Service Mesh (ASM) routes requests directly to the correct Runtime Environment, accelerating the Inference process for model services.

All

1.21 or later

All

Use dynamic subset routing to accelerate model service mesh inference

Use ASMCircuitBreaker to configure circuit breaker rules for inter-service call traffic

Use the ASMCircuitBreaker CRD to configure circuit breaker rules for east-west traffic.

All

1.19 and later

All

Use ASMCircuitBreaker to configure circuit breaker rules for inter-service call traffic

Feature

Description

Regions

Istio versions

Product specifications

References

Plain text format for access logs

You can now output access logs to the Container Standard Output as plain text. This format is more space-efficient and information-dense than JSON.

All

v1.20 and later

All

Observability configuration

Configure Maintenance Windows for the Managed Control Plane

You can now set a Maintenance Window for your Service Mesh to define when automatic maintenance of the Managed Control Plane occurs.

All

All

All

Using Service Mesh Maintenance Windows

Develop Wasm Extensions for the Mesh Proxy using Go

You can now develop Wasm Extensions in Go and inject them into the Mesh Proxy's filter chain. These extensions let you implement custom logic, such as dynamically modifying HTTP headers, adjusting routing, or integrating with external authorization services.

All

v1.18 and later

All

Write Wasm Extensions for the Mesh Proxy using Go

Support for Managed Security Groups

New ASM Instances now use Managed Security Groups. These groups provide enhanced security for the Managed Control Plane.

All

v1.20 and later

All

Create an ASM Instance

Feature

Description

Regions

Applicable Istio versions

Applicable editions

References

Support for Istio 1.20

Adds support for Istio 1.20 and its latest community features.

All

v1.20 and later

All

Versioning

Canary upgrade for ASM gateway

Service Mesh (ASM) now supports canary upgrades for the ASM gateway to ensure business continuity. You can deploy a new gateway version to verify traffic before completing the full upgrade. If an issue occurs, roll back at any time by deleting the new version's pods. After resolving the issue, you can resume the upgrade.

All

v1.20 and later

All

Perform a canary upgrade for an ASM gateway

Encrypted collection of monitoring metrics

Service Mesh (ASM) now uses mutual TLS (mTLS) to encrypt monitoring metrics for in-mesh applications, providing the same security as service-to-service communication.

All

All

All

Collect monitoring metrics for in-mesh applications via mTLS

Enhanced plugin center and Envoy filters

• The plugin center now supports additional plugin types. The ASMGrpcJsonTranscoder Custom Resource Definition (CRD) now provides HTTP/JSON to gRPC transcoding.

• The plugin center allows you to create multiple plugin instances, each with its own configuration and effective scope.

• You can now bind Envoy filter templates to a range of service mesh versions instead of just a single version.

All

v1.18 and later

All

• ASMGrpcJsonTranscoder CRD

• Use the plugin marketplace to extend mesh capabilities

• Create an Envoy filter from an Envoy filter template

Declarative management for Envoy filter templates and traffic lanes

• You can now use a Custom Resource Definition (CRD) to manage Envoy filter templates.

• Similarly, you can use a CRD to manage traffic lanes.

• Additionally, you can manage traffic lanes using a GitOps approach with Argo CD.

All

v1.20 and later

All

• EnvoyFilterTemplate and EnvoyFilterTemplateBinding CRDs

• ASMSwimLaneGroup and ASMSwimLane CRDs

• Implement end-to-end canary release for application services based on Argo CD

Feature

Description

Regions

Istio versions

Editions

References

AI-powered mesh diagnostics

Integrates an AI assistant to provide intelligent analysis. After a diagnostic result is generated, a Large Language Model (LLM) explains the cause of each issue and recommends a solution.

All

All

All

Use ASM mesh diagnostics

Enhanced Mesh Topology

The Mesh Topology feature enhances observability and usability.

• The Mesh Topology now calculates and displays the effective circuit breaking or rate limiting configurations for services and workloads. This feature is available in the ASM Enterprise and Ultimate editions.

• In single-cluster mode, enabling managed mode for the Mesh Topology automatically populates the relevant parameters, improving usability.

• The Server Load Balancer (SLB) used by the Mesh Topology service now supports the Pay-as-you-go billing method to reduce costs.

All

All

All

Enable Mesh Topology to improve observability

Support for custom request and response headers

Adds support for customizing request and response headers using VirtualService and EnvoyFilter resources.

All

All

All

• Overview of custom request and response headers

• Customize request and response headers using a VirtualService resource

• Customize request and response headers using an EnvoyFilter resource

Scenario-based rate limiting

Introduces best practices for applying rate limiting in the following scenarios:

• Configure local rate limiting rules on the ASM ingress gateway for a single route or a combination of a gateway domain name and port.

• Configure global rate limiting rules on the ASM ingress gateway for a single route or a combination of a gateway domain name and port, matching requests based on specific request headers, query parameters, or client IP addresses.

• Configure local rate limiting rules for requests to a specific port and path of an application service.

• Configure global rate limiting rules for requests to a specific port and path of an application service.

All

v1.11.5 and later

Enterprise and Ultimate editions

• Configure local rate limiting on an ingress gateway

• Configure global rate limiting for an ingress gateway

• Configure local rate limiting in the traffic management center

• Use ASMGlobalRateLimiter to configure global rate limiting for application service ingress traffic

Feature

Description

Regions

Istio version

Editions

References

Support for Istio 1.19 and 1.18 patch releases

• Adds support for Istio 1.19, incorporating the latest community features and upstream CVE fixes.

• Introduces a patch for Istio 1.18 that upgrades it to version 1.18.6 and includes upstream CVE fixes.

All

All

All

None

Pay-as-you-go billing for Server Load Balancer

When you create a new Service Mesh (ASM) instance, the system automatically creates a private-facing, pay-as-you-go Server Load Balancer (CLB) to access the API Server and the Istio control plane.

All

All

All

• Create an ASM instance

• Pay-as-you-go Server Load Balancer

Support for CEL-based log filtering rules

You can now use Common Expression Language (CEL) to set log filtering rules. In high-traffic scenarios, filtering logs based on specific conditions reduces sidecar proxy overhead and allows you to focus on critical log content.

All

v1.18 and later

All

Write access log filtering rules using CEL

Simplified management for Local Throttling

This release enhances the Local Throttling feature. A new graphical interface in the Traffic Management Center simplifies the configuration process, reduces operational errors, and improves usability.

All

v1.18 and later

All

• Overview of throttling protection

• Configure local throttling on an ingress gateway

• Configure local throttling in the Traffic Management Center

Feature

Description

Regions

Istio version

Editions

References

Support for Model Service Mesh

This feature lets you manage and route model services through the mesh. It provides advanced traffic management capabilities, such as Traffic Splitting, A/B Testing, and Canary Releases for granular control over model service traffic. You can also easily switch between model versions and perform a Rollback.

Dynamic Routing routes requests to the appropriate model service based on attributes such as model type, data format, or other metadata.

A Model Service Mesh helps developers easily deploy, manage, and scale Machine Learning Models while ensuring High Availability, Elasticity, and flexibility.

All

v1.18 and later

All

• Overview of model service mesh

• Use a model service mesh for multi-model inference services

• Customize model runtimes using a model service mesh

• Transform a large language model into an inference service

Standalone deployment for ASM gateways in a Serverless architecture

This feature introduces a Serverless gateway architecture that uses Virtual Nodes and Elastic Container Instance (ECI). This Standalone Deployment model is ideal for scenarios that require Elasticity and node-free operations.

All

v1.18 and later

All

Use an ASM Serverless gateway to improve high availability and elasticity

Server Load Balancer (CLB) support for Managed Mesh Topology

You can now use a Server Load Balancer (CLB) to directly access applications within a Managed Mesh Topology, which simplifies the topology's access configuration.

All

v1.18 and later

All

Enable managed mode for mesh topology

Support for KServe 0.11

This release adds support for integration with KServe 0.11, simplifying the management of model service workloads. You can now deploy Transformer services using InferenceService and select the KServe version during integration.

All

v1.18 and later

All

Use InferenceService to deploy a Transformer service

Support for OpenTelemetry Collector integration

Service Mesh (ASM) now exports Tracing data via the OpenTelemetry Collector, which simplifies connecting to ARMS Tracing Analysis or self-managed Tracing services. Existing Zipkin integrations remain supported.

All

v1.18 and later

All

• Configure reporting of ASM tracing data

• Export ASM tracing data to a self-managed system

Feature

Description

Regions

Istio versions

Product specifications

References

Introduces ASMCompressor, a Custom Resource Definition (CRD) for configuring compression between application services.

This Custom Resource Definition (CRD) provides a declarative method to configure compression for calls between application services. It offers a consistent method for adding compression filters to applications and supports both Gzip and Brotli compression algorithms.

All

v1.18 and later

All

• Use ASMCompressor to define compression configurations for inter-application service calls

• ASMCompressor Custom Resource Definition (CRD) reference

Introduces ASMGrpcJsonTranscoder, a Custom Resource Definition (CRD) for configuring JSON/HTTP to gRPC transcoding for inter-service communication.

This Custom Resource Definition (CRD) enables you to configure JSON/HTTP to gRPC transcoding for calls between application services. It provides a consistent way to add transcoding filters to applications.

All

v1.18 and later

All

• Use ASMGrpcJsonTranscoder to request gRPC services in the mesh using HTTP/JSON

• ASMGrpcJsonTranscoder Custom Resource Definition (CRD) reference

Enables custom Wasm plugins for the ASM data plane.

You can configure custom Wasm plugins for ASM mesh proxies or gateways to extend the capabilities of the data plane. Wasm plugins can be written in multiple languages, such as C++ and Go, and can be loaded from various sources, including an HTTP endpoint, an OCI image hub, or a ConfigMap.

All

v1.18 and later

All

Use a Coraza Wasm plugin to implement WAF capabilities on an ASM gateway

Introduces ASMGlobalRateLimiter to enable global rate limiting for gateways and application services.

This Custom Resource Definition (CRD) provides a declarative method to configure global rate limiting for gateways and application services.

All

v1.18 and later

All

• Use ASMGlobalRateLimiter to configure global rate limiting for application service ingress traffic

• ASMGlobalRateLimiter Custom Resource Definition (CRD) reference

Feature

Description

Regions

Istio version

Editions

References

Dynamic Subset Load Balancing

This feature provides dynamic subset load balancing, which allows you to flexibly select a target Service Subset based on request information such as metadata.

All

v1.18 and later

Enterprise Edition, Ultimate Edition

Dynamic subset routing

Traffic Lane 2.0 with Support for Strict and Loose Modes

The loose Mode includes a fallback mechanism to a baseline Traffic Lane, which simplifies request handling in scenarios where end-to-end headers are already propagated.

All

v1.18 and later

Enterprise Edition, Ultimate Edition

• Overview of Traffic Lanes

• Use strict Mode Traffic Lanes to implement end-to-end traffic management

• Use loose Mode Traffic Lanes to implement end-to-end traffic management

Mesh Topology 2.0 with Managed Mode Support

Compared to enabling Mesh Topology in deployment mode on a Data Plane Kubernetes cluster, Managed Mode offers significant advantages, including unified multi-cluster observability, simplified Configuration, and higher service reliability.

All

v1.18 and later

Enterprise Edition, Ultimate Edition

Enable Managed Mode for Mesh Topology

Feature

Description

Regions

Istio versions

Editions

References

Support for a new Data Plane mode

This release introduces a new Data Plane mode compatible with the community's Istio Ambient Mesh. This mode enables incremental adoption of Service Mesh technology, allowing you to use features as needed, including new Layer 4 (L4) and Layer 7 (L7) routing and authorization capabilities.

All

v1.18 and later

Enterprise Edition, Ultimate Edition

• Ambient mode (Deprecated)

• L7 routing

• L4 authentication and authorization

• L7 authentication and authorization

Support for Istio 1.18

Service Mesh (ASM) now supports Istio 1.18, which includes the latest community features.

All

v1.18 and later

All

None

Default CNI mode for ASM instance creation

The CNI Plugin mode is now enabled by default when you create a Service Mesh (ASM) instance. This ensures compatibility with the CNI DaemonSet in environments such as Container Service for Kubernetes (ACK) on Elastic Container Instance (ECI) and ACK Serverless.

All

v1.18 and later

All

Enable the CNI plugin to improve security

Support for Knative 1.8

Service Mesh (ASM) v1.18 now uses Knative 1.8 by default when deploying serverless workloads with Knative.

All

v1.18 and later

All

Use ASM to simplify the management of serverless workloads

Network Load Balancer (NLB) support for Ingress Gateways

You can now create an Ingress Gateway with a Network Load Balancer (NLB), leveraging its high performance and auto-scaling capabilities to improve traffic stability.

All

v1.18 and later

All

Use a Network Load Balancer (NLB) in an ASM Ingress Gateway

Feature

Description

Regions

Istio version

Edition

References

Control plane canary upgrade

Provides a safer and more stable canary upgrade for new control plane versions by using a revision- and label-based mode.

All

v1.16 and later

Enterprise Edition, Ultimate Edition

Use canary mode to enhance upgrade stability

Simplified label sync management for global namespaces

This feature lets you associate a global namespace with a specific Kubernetes Cluster and selectively sync different namespace labels to different clusters.

The ASM console now provides the namespace label istio.io/rev to simplify the injection of proxies for different versions during a canary upgrade.

All

v1.16 and later

All

Manage global namespaces

Audit alerts for mesh resource operations

After you enable the mesh audit feature, you can configure alerts in Simple Log Service (SLS) for changes to mesh resources to notify an alert contact whenever important resources are modified.

All

v1.15 and later

All

Configure audit alerts for mesh resource operations

Adaptive configuration push for egress gateways

When adaptive configuration push is enabled, the cluster deploys an egress gateway named istio-axds-egressgateway and lets you modify its configuration.

All

v1.15 and later

All

Use adaptive configuration push to improve control plane push efficiency

External OPA execution engine integration

Compared to the sidecar pattern, an external Open Policy Agent (OPA) execution engine consumes fewer resources, allows applications to be integrated without a restart, and provides more flexibility in deciding which requests execute OPA policies.

All

v1.15 and later

All

Use ASM security policies to connect to an external OPA execution engine

Gateway log dashboards

A new gateway-level log page allows you to view the raw logs and log dashboards for a specific gateway.

All

v1.17 and later

All

• Generate and collect ASM gateway access logs

• Generate and collect ASM gateway monitoring metrics

Feature

Description

Regions

Applicable Istio versions

Applicable editions

References

New observability management center 2.0

Provides integrated configuration for logs, monitoring metrics, and Tracing Analysis.

All

v1.17.2.35 and later

All

• Observability configuration

• Enable control plane log collection and log-based alerting (New version)

• Collect monitoring metrics to Managed Service for Prometheus

• Configure reporting of ASM Tracing Analysis data

Support for dynamically merging Istio and application monitoring metrics

Allows application services with Prometheus monitoring endpoints to export their business metrics through the mesh proxy by merging them with Istio metrics.

All

v1.17 and later

All

Merge monitoring metrics from Istio and applications

Service Discovery scope configuration supports a denylist mode for namespaces

The service discovery scope now supports both allowlist and denylist modes. In denylist mode, the Service Mesh (ASM) control plane discovers and processes applications in all namespaces except those on the denylist. This improves the efficiency of pushing configurations from the control plane to data plane sidecar proxies.

All

v1.17 and later

Enterprise Edition, Ultimate Edition

Configure the service discovery scope to improve mesh configuration push efficiency

Traffic management now supports a Fallback Mechanism

When a service call fails, a fallback mechanism provides an alternative execution path. Service Mesh (ASM) supports defining a fallback parameter in a VirtualService to enable a fallback mechanism for failed service requests.

All

v1.17 and later

Enterprise Edition, Ultimate Edition

Configure fallback routing in ASM

Mesh topology now supports login with Resource Access Management (RAM) users and custom access methods

Login with an Alibaba Cloud RAM user is now the default method for accessing the mesh topology UI console. You can also customize access by configuring the domain name, port, root path, and protocol.

All

v1.17 and later

All

Enable the mesh topology to improve observability

ASM certificate management can now send anomaly alerts to Simple Log Service (SLS)

You can now configure alerts for certificate management in control plane alerting. This feature supports two Alert Types: Expired and Expiring Soon.

All

v1.17 and later

All

Use ASM certificate management

Feature

Description

Regions

Istio versions

Applicable editions

References

Support for Istio 1.17

This release adds support for Istio 1.17, which includes the latest community features.

All

v1.17 and later

All

None

Integration with KServe for MLOps management

Alibaba Cloud Service Mesh (ASM) now integrates with KServe to simplify managing model service workloads.

All

v1.17 and later

Enterprise Edition, Ultimate Edition

Integrate ASM with KServe for cloud-native AI model inference services

Support for Serverless Gateway

The ASM Serverless Gateway is a gateway form factor based on Virtual Nodes and Elastic Container Instance (ECI). It is designed for elastic and node-free scenarios.

All

v1.16 and later

Enterprise Edition, Ultimate Edition

Use ASM Serverless Gateways to support elastic business scenarios

Global certificate management

ASM now supports global certificate management:

• Certificates from the certificate management service can be referenced directly in Gateway Rules.

• Supports both TLS and mTLS certificates.

• Supports certificate expiration alerts.

All

v1.17 and later

All

Use an ASM gateway to enable secure HTTPS services

Enhanced Mesh Topology for visualizing Istio resources

The Mesh Topology page now includes a "Virtual Service badge" display option that visualizes configured VirtualService resources in the topology.

All

v1.15 and later

Enterprise Edition, Ultimate Edition

Enable Mesh Topology to improve observability

Exclude specific Namespaces in Mesh Diagnostics

You can now select Namespaces to exclude from Mesh Diagnostics. No diagnostic results will be generated for the excluded Namespaces.

All

v1.17 and later

All

Use ASM Mesh Diagnostics

Feature

Description

Release region

Istio version

Edition

References

Support for Istio 1.16

Adds compatibility with the Istio 1.16 community release series.

All

v1.16 and later

All

None

Enhanced sidecar injection management

Simplifies configuration management for injection policies and sidecar injectors.

All

v1.16 and later

All

Enable automatic injection in multiple ways

Support for the gRPC-JSON transcoder plugin

Lets you access gRPC services using RESTful APIs or other HTTP/JSON tools, simplifying integration.

All

v1.16 and later

Enterprise Edition, Ultimate Edition

Use ASMGrpcJsonTranscoder to request gRPC services in a mesh using HTTP/JSON

Support for RAM login to Mesh Topology

Allows you to log on with your Alibaba Cloud Resource Access Management (RAM) identity, enabling Single Sign-On (SSO) for the Mesh Topology UI.

All

v1.16 and later

Enterprise Edition, Ultimate Edition

Log on to ASM Mesh Topology using an Alibaba Cloud account

Feature

Description

Region

Istio versions

Editions

References

Integration with Web Application Firewall (WAF)

• Integrates the Gateway with Web Application Firewall (WAF) to provide Attack Prevention for your Services.

• You can now use custom access log formats to view headers that WAF adds to origin requests, which simplifies O&M (Operations and Maintenance).

All

All

Enterprise Edition, Ultimate Edition

Integrate an ASM Gateway with WAF

Support for Ingress resource configuration

You can now use Ingress resources in a Data Plane Cluster to specify traffic rules for the ASM Gateway.

All

v1.16 and later

Enterprise Edition, Ultimate Edition

Use an ASM Gateway as an Ingress controller to expose in-cluster services

Support for managing Knative services

Integrates the Knative Serving capabilities of Container Service for Kubernetes (ACK) and ACK Serverless Cluster to simplify the management of serverless workloads.

All

v1.16 and later

Enterprise Edition, Ultimate Edition

Use ASM to simplify the management of serverless workloads

Mesh Topology supports OIDC (OpenID Connect) login

Integrates the OIDC (OpenID Connect) protocol with an Identity Provider (IdP), allowing you to configure Single Sign-On (SSO) for Mesh Topology from the ASM console.

All

v1.15.3.120 and later

Enterprise Edition, Ultimate Edition

Enable Mesh Topology to improve observability

Sidecar Proxy supports Overcommitment Mode

When dynamic resource Overcommitment is enabled, you can set the resource type for Proxy pods.

All

v1.16 and later

Enterprise Edition, Ultimate Edition

Configure ACK dynamic overcommitment resources in a sidecar

New egress traffic policy: ASMEgressTrafficPolicy

The ASMEgressTrafficPolicy defines how to manage and access external traffic through an Egress Gateway. You can combine it with Sidecar and AuthorizationPolicy resources for more comprehensive control over egress traffic.

All

v1.16 and later

Enterprise Edition, Ultimate Edition

• ASMEgressTrafficPolicy CRD reference

• Manage egress traffic using ASMEgressTrafficPolicy

Support for a global default retry policy for HTTP requests

You can now configure a global default retry policy for HTTP requests, which includes the number of retries, retry timeout, and retry conditions.

All

v1.15 and later

All

None

Feature

Description

Regions

Istio version

Editions

References

Release of Istio version 1.15.3.105

Compatible with the community Istio 1.15 series. Supports Kubernetes versions 1.21 to 1.25.

All

v1.15.3.105

All

None

Enhanced mesh observability

• Full support for defining and managing logs, monitoring metrics, and tracing using Telemetry CRDs.

• Optimized configuration of monitoring metrics and the minimum metric set required for Mesh Topology.

• Supports fine-grained configuration at both the global mesh and Namespace levels.

All

All

All

Customize metrics in ASM

Improved Mesh Topology performance

• Significantly improves the loading speed of the Mesh Topology graph in clusters with more than 150 pods.

• Mesh Topology supports an optional configuration for Workload Health Checks. Disabling this feature can improve the loading speed of the topology graph.

All

v1.14 and later

All

Enable ASM Mesh Topology for enhanced observability

Enhanced multi-cluster traffic management

Supports configuring In-cluster Traffic Locality in multi-cluster environments. When this feature is enabled for a service, traffic is directed only to Workloads within the same cluster.

All

v1.15.3.101 and later

All

Keep traffic in-cluster in multi-cluster scenarios

Enhanced Sidecar Proxy Configuration

• The global Sidecar Proxy configuration now includes settings for the number of istio-proxy threads and monitoring statistics, aligning with Namespace-level and Workload-level configurations.

• Supports configuring Environment Variables for the Sidecar Proxy.

All

v1.15.3.101 and later

All

Configure a Sidecar proxy

Enhanced ASM gateway customization and observability

• Enhanced gateway configuration management in multi-cluster mode.

• Supports more flexible custom metric configuration.

• Adds a new gateway status Monitoring Dashboard for real-time monitoring of Key Metrics for gateway pods.

All

All

Enterprise Edition, Ultimate Edition

Configure a unified ingress gateway for multiple clusters

Feature

Description

Region

Applicable Istio versions

Applicable editions

References

Custom time ranges in grid topology

Grid Topology now lets you query the topology graph for any time range within the last 90 days, making it easier to view historical topologies.

All

v1.14 and later

All

Enable Grid Topology to improve observability

Enhanced configuration parameters for data plane sidecar proxies

A new option allows you to configure Sidecar Proxy environment variables to load a bootstrap configuration before the proxy starts.

All

v1.15.3.63 and later

All

Configure Sidecar Proxies

Enhanced gateway security capabilities

The Gateway now offers a single configuration for both OpenID Connect (OIDC) Single Sign-On (SSO) and JWT Authentication.

All

v1.15.3.25 and later

Enterprise Edition, Ultimate Edition

• Configure OIDC-based Single Sign-On in an ingress gateway

• Configure JWT Authentication in an ASM gateway