<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/announcing-istio-1-29-6-66xxszfc3" -->

---
title: Announcing Istio 1.29.6 | daily.dev
description: Istio 1.29.6 is a patch release fixing five bugs: EXIT_ON_ZERO_ACTIVE_CONNECTIONS not firing on ambient ingress gateways and waypoints due to HBONE internal...
canonical: https://daily.dev/posts/announcing-istio-1-29-6-66xxszfc3
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: Announcing Istio 1.29.6 | daily.dev
og:description: Istio 1.29.6 is a patch release fixing five bugs: EXIT_ON_ZERO_ACTIVE_CONNECTIONS not firing on ambient ingress gateways and waypoints due to HBONE internal...
og:url: https://daily.dev/posts/announcing-istio-1-29-6-66xxszfc3
og:image: https://api.daily.dev/og/posts/66XxSzfc3.png
og:image:alt: Announcing Istio 1.29.6
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Announcing Istio 1.29.6

**[Istio](https://daily.dev/sources/istio)** · 2 min read · 4 upvotes · 0 comments

## Summary

Istio 1.29.6 is a patch release fixing five bugs: EXIT_ON_ZERO_ACTIVE_CONNECTIONS not firing on ambient ingress gateways and waypoints due to HBONE internal listener connection counting; HBONE capability not propagating to auto-registered WorkloadEntry resources for non-Kubernetes workloads; a deadlock in the ambient CNI node agent caused by concurrent pod deletion and ztunnel reconnection; a memory leak in Istiod where needResync entries for failed pod IPs were never cleaned up; and cross-network traffic through the east-west gateway being blocked by a spurious deny-all RBAC filter when L7 AuthorizationPolicies are present.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://istio.io/latest/news/releases/1.29.x/announcing-1.29.6>

## Questions this post answers

### Why doesn't EXIT_ON_ZERO_ACTIVE_CONNECTIONS ever fire on my ambient ingress gateway, forcing pods to wait the full terminationGracePeriodSeconds before terminating?

In Istio versions before 1.29.6, pilot-agent's drain loop counted in-process connections on Envoy's HBONE internal listeners such as connect_originate, connect_terminate, and main_internal, which prevented the active-connection count from ever reaching zero on ambient ingress gateways and waypoints. This bug is fixed in Istio 1.29.6, allowing the drain check to complete normally instead of stalling until the grace period expires.

_daily.dev surfaces fixes like this one for teams debugging slow pod termination in ambient mesh deployments._

### After upgrading Istio, why are my auto-registered WorkloadEntry resources for non-Kubernetes workloads still using plaintext instead of HBONE?

Prior to Istio 1.29.6, the advertised HBONE capability was not propagated onto auto-registered WorkloadEntry resources for non-Kubernetes workloads. Workloads registered before upgrading continue to be reached over plaintext until they either re-register or someone manually adds the networking.istio.io/tunnel=http label to their existing WorkloadEntry.

_Engineers migrating VM or non-Kubernetes workloads onto Istio mesh can track patch details like this via daily.dev._

### What caused a deadlock in Istio's ambient CNI node agent that blocked the ZDS server?

A deadlock occurred when a pod deletion event happened concurrently with a ztunnel (re)connection, which could permanently block the ZDS server in the ambient CNI node agent. This issue, tracked as ztunnel issue 1674, is fixed in Istio 1.29.6.

_Teams running ambient mesh in production can use daily.dev to keep up with node agent stability fixes like this._

## Similar posts on daily.dev

- [Announcing Istio 1.29.5](https://daily.dev/posts/announcing-istio-1-29-5-gj4qcmivr) · Istio · 0 upvotes · 0 comments
- [Announcing Istio 1.29.4](https://daily.dev/posts/announcing-istio-1-29-4-nbqrye7ll) · Istio · 0 upvotes · 0 comments
- [Announcing Istio 1.29.3](https://daily.dev/posts/announcing-istio-1-29-3-cekhvqthq) · Istio · 2 upvotes · 0 comments
- [Announcing Istio 1.28.7](https://daily.dev/posts/announcing-istio-1-28-7-hhxgq2hqu) · Istio · 0 upvotes · 0 comments
- [Announcing Istio 1.28.1](https://daily.dev/posts/announcing-istio-1-28-1-1qu1mzpyc) · Istio · 19 upvotes · 0 comments

---

Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#istio](https://daily.dev/tags/istio), [#service-mesh](https://daily.dev/tags/service-mesh), [#envoy](https://daily.dev/tags/envoy)

[View this post on daily.dev](https://daily.dev/posts/announcing-istio-1-29-6-66xxszfc3)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"Announcing Istio 1.29.6","url":"https://daily.dev/posts/announcing-istio-1-29-6-66xxszfc3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/announcing-istio-1-29-6-66xxszfc3"},"datePublished":"2026-07-16T16:24:01.918Z","dateModified":"2026-09-14T06:51:00.706Z","description":"Istio 1.29.6 is a patch release fixing five bugs: EXIT_ON_ZERO_ACTIVE_CONNECTIONS not firing on ambient ingress gateways and waypoints due to HBONE internal...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c6099bba9727c2a15aee6bdc2485513c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c6099bba9727c2a15aee6bdc2485513c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Istio","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Istio","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/istio","url":"https://daily.dev/sources/istio"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/announcing-istio-1-29-6-66xxszfc3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,istio,service-mesh,envoy","timeRequired":"PT2M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Istio","item":"https://daily.dev/sources/istio"},{"@type":"ListItem","position":3,"name":"Announcing Istio 1.29.6"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/announcing-istio-1-29-6-66xxszfc3#faq","mainEntity":[{"@type":"Question","name":"Why doesn't EXIT_ON_ZERO_ACTIVE_CONNECTIONS ever fire on my ambient ingress gateway, forcing pods to wait the full terminationGracePeriodSeconds before terminating?","acceptedAnswer":{"@type":"Answer","text":"In Istio versions before 1.29.6, pilot-agent's drain loop counted in-process connections on Envoy's HBONE internal listeners such as connect_originate, connect_terminate, and main_internal, which prevented the active-connection count from ever reaching zero on ambient ingress gateways and waypoints. This bug is fixed in Istio 1.29.6, allowing the drain check to complete normally instead of stalling until the grace period expires. daily.dev surfaces fixes like this one for teams debugging slow pod termination in ambient mesh deployments."}},{"@type":"Question","name":"After upgrading Istio, why are my auto-registered WorkloadEntry resources for non-Kubernetes workloads still using plaintext instead of HBONE?","acceptedAnswer":{"@type":"Answer","text":"Prior to Istio 1.29.6, the advertised HBONE capability was not propagated onto auto-registered WorkloadEntry resources for non-Kubernetes workloads. Workloads registered before upgrading continue to be reached over plaintext until they either re-register or someone manually adds the networking.istio.io/tunnel=http label to their existing WorkloadEntry. Engineers migrating VM or non-Kubernetes workloads onto Istio mesh can track patch details like this via daily.dev."}},{"@type":"Question","name":"What caused a deadlock in Istio's ambient CNI node agent that blocked the ZDS server?","acceptedAnswer":{"@type":"Answer","text":"A deadlock occurred when a pod deletion event happened concurrently with a ztunnel (re)connection, which could permanently block the ZDS server in the ambient CNI node agent. This issue, tracked as ztunnel issue 1674, is fixed in Istio 1.29.6. Teams running ambient mesh in production can use daily.dev to keep up with node agent stability fixes like this."}}]}
```