--- title: Announcing Istio 1.30.3 | daily.dev description: Istio 1.30.3 is a patch release focused on bug fixes and robustness improvements over 1.30.2. Key fixes include: a regression where metadata-only... canonical: https://daily.dev/posts/announcing-istio-1-30-3-gko21nydq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Announcing Istio 1.30.3 | daily.dev og:description: Istio 1.30.3 is a patch release focused on bug fixes and robustness improvements over 1.30.2. Key fixes include: a regression where metadata-only... og:url: https://daily.dev/posts/announcing-istio-1-30-3-gko21nydq og:image: https://api.daily.dev/og/posts/gKO21nydQ.png og:image:alt: Announcing Istio 1.30.3 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Announcing Istio 1.30.3 **[Istio](https://daily.dev/sources/istio)** · 3 min read · 3 upvotes · 0 comments ## Summary Istio 1.30.3 is a patch release focused on bug fixes and robustness improvements over 1.30.2. Key fixes include: a regression where metadata-only VirtualService changes (e.g. from GitOps tools like Argo CD) triggered unnecessary XDS pushes to all proxies, causing high control plane CPU usage; a deadlock in the ambient CNI node agent during concurrent pod deletion and ztunnel reconnection; a bug preventing istiod from picking up updated remote cluster secrets without a restart; a WasmPlugin crash-loop on waypoint proxies when targeting a Service via cross-namespace targetRefs; and cross-network traffic being blocked by a spurious deny-all RBAC filter. Additional improvements include scoped XDS pushes in ambient mode for better istiod scalability and support for a custom taint name in the pilot node untaint controller. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the Istio 1.30.3 patch release fix? Istio 1.30.3 fixes a regression introduced in Istio 1.30 where metadata-only changes to VirtualService objects, such as Helm annotations, Argo CD labels, or kubectl's last-applied-configuration annotation, triggered unnecessary XDS pushes to all proxies. This caused significant control plane CPU usage and push latency increases in clusters with many GitOps-managed VirtualServices. The fix restores pushing only on spec or istio.io label/annotation changes. _Track Istio patch releases like this on daily.dev before a GitOps regression hits your control plane._ ### Why is istiod not picking up remote cluster secret rotations in Istio ambient mode? Before Istio 1.30.3, istiod failed to pick up updated remote cluster secrets during credential or token rotation until it was manually restarted. The cluster registry could deadlock while waiting to sync, leaving the service registry stale for the affected remote cluster. Istio 1.30.3 fixes this deadlock so rotated secrets are picked up without requiring a restart. _Multi-cluster Istio operators follow fixes like this on daily.dev to avoid stale service registries._ ### Why does EXIT_ON_ZERO_ACTIVE_CONNECTIONS never fire on Istio ambient waypoints and ingress gateways? In versions before Istio 1.30.3, EXIT_ON_ZERO_ACTIVE_CONNECTIONS never fired on ambient ingress gateways and waypoints because pilot-agent's drain loop miscounted in-process connections on Envoy's HBONE internal listeners, such as connect_originate, connect_terminate, and main_internal. This prevented the active-connection count from reaching zero, forcing proxies to wait until terminationGracePeriodSeconds expired instead of draining gracefully. _Engineers tuning graceful shutdowns in ambient mesh deployments watch fixes like this via daily.dev._ ## Similar posts on daily.dev - [Announcing Istio 1.30.4](https://daily.dev/posts/announcing-istio-1-30-4-dsczfflez) · Istio · 0 upvotes · 0 comments - [Announcing Istio 1.30.2](https://daily.dev/posts/announcing-istio-1-30-2-czzzkx40i) · Istio · 1 upvotes · 0 comments - [Announcing Istio 1.30.1](https://daily.dev/posts/announcing-istio-1-30-1-t5vgckfhk) · Istio · 2 upvotes · 0 comments - [Announcing Istio 1.31.1](https://daily.dev/posts/announcing-istio-1-31-1-oft20opwn) · Istio · 0 upvotes · 0 comments - [Istio 1.31 Adds Agentgateway Waypoints and Moves Release Artifacts off Google Cloud](https://daily.dev/posts/istio-1-31-adds-agentgateway-waypoints-and-moves-release-artifacts-off-google-cloud-5pof4xnve) · InfoQ · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#microservices](https://daily.dev/tags/microservices), [#istio](https://daily.dev/tags/istio), [#service-mesh](https://daily.dev/tags/service-mesh), [#envoy](https://daily.dev/tags/envoy) [View this post on daily.dev](https://daily.dev/posts/announcing-istio-1-30-3-gko21nydq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Announcing Istio 1.30.3","url":"https://daily.dev/posts/announcing-istio-1-30-3-gko21nydq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/announcing-istio-1-30-3-gko21nydq"},"datePublished":"2026-07-16T16:24:01.881Z","dateModified":"2026-09-14T08:19:55.822Z","description":"Istio 1.30.3 is a patch release focused on bug fixes and robustness improvements over 1.30.2. Key fixes include: a regression where metadata-only...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c6099bba9727c2a15aee6bdc2485513c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c6099bba9727c2a15aee6bdc2485513c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Istio","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Istio","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/istio","url":"https://daily.dev/sources/istio"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/announcing-istio-1-30-3-gko21nydq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,microservices,istio,service-mesh,envoy","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Istio","item":"https://daily.dev/sources/istio"},{"@type":"ListItem","position":3,"name":"Announcing Istio 1.30.3"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/announcing-istio-1-30-3-gko21nydq#faq","mainEntity":[{"@type":"Question","name":"What does the Istio 1.30.3 patch release fix?","acceptedAnswer":{"@type":"Answer","text":"Istio 1.30.3 fixes a regression introduced in Istio 1.30 where metadata-only changes to VirtualService objects, such as Helm annotations, Argo CD labels, or kubectl's last-applied-configuration annotation, triggered unnecessary XDS pushes to all proxies. This caused significant control plane CPU usage and push latency increases in clusters with many GitOps-managed VirtualServices. The fix restores pushing only on spec or istio.io label/annotation changes. Track Istio patch releases like this on daily.dev before a GitOps regression hits your control plane."}},{"@type":"Question","name":"Why is istiod not picking up remote cluster secret rotations in Istio ambient mode?","acceptedAnswer":{"@type":"Answer","text":"Before Istio 1.30.3, istiod failed to pick up updated remote cluster secrets during credential or token rotation until it was manually restarted. The cluster registry could deadlock while waiting to sync, leaving the service registry stale for the affected remote cluster. Istio 1.30.3 fixes this deadlock so rotated secrets are picked up without requiring a restart. Multi-cluster Istio operators follow fixes like this on daily.dev to avoid stale service registries."}},{"@type":"Question","name":"Why does EXIT_ON_ZERO_ACTIVE_CONNECTIONS never fire on Istio ambient waypoints and ingress gateways?","acceptedAnswer":{"@type":"Answer","text":"In versions before Istio 1.30.3, EXIT_ON_ZERO_ACTIVE_CONNECTIONS never fired on ambient ingress gateways and waypoints because pilot-agent's drain loop miscounted in-process connections on Envoy's HBONE internal listeners, such as connect_originate, connect_terminate, and main_internal. This prevented the active-connection count from reaching zero, forcing proxies to wait until terminationGracePeriodSeconds expired instead of draining gracefully. Engineers tuning graceful shutdowns in ambient mesh deployments watch fixes like this via daily.dev."}}]} ```