<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/announcing-istio-1-31-0-onsnrwev9" -->

---
title: Announcing Istio 1.31.0 | daily.dev
description: Istio 1.31.0 has been released, bringing agentgateway support as a waypoint proxy, Gateway API AllowInsecureFallback for client cert validation, ambient mode...
canonical: https://daily.dev/posts/announcing-istio-1-31-0-onsnrwev9
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: Announcing Istio 1.31.0 | daily.dev
og:description: Istio 1.31.0 has been released, bringing agentgateway support as a waypoint proxy, Gateway API AllowInsecureFallback for client cert validation, ambient mode...
og:url: https://daily.dev/posts/announcing-istio-1-31-0-onsnrwev9
og:image: https://api.daily.dev/og/posts/oNsNRWev9.png
og:image:alt: Announcing Istio 1.31.0
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Announcing Istio 1.31.0

**[Istio](https://daily.dev/sources/istio)** · 6 min read · 0 upvotes · 0 comments

## Summary

Istio 1.31.0 has been released, bringing agentgateway support as a waypoint proxy, Gateway API AllowInsecureFallback for client cert validation, ambient mode improvements including weighted waypoint canaries and multi-cluster stability fixes, new traffic management features like zone-aware load balancing and mesh-wide default traffic policies, FIPS 140-3 compliance support, strict gateway merging, and various telemetry and operability enhancements. Notably, Istio is deprecating GCP-hosted infrastructure (gcr.io/istio-release, registry.istio.io, istio-release.storage.googleapis.com) starting with this release, moving artifacts to Docker Hub, blob.istio.io, and ghcr.io, with scheduled 'scream tests' from September through December 2026 to help users detect dependencies on the old hosting.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://istio.io/latest/news/releases/1.31.x/announcing-1.31>

## Questions this post answers

### Is Istio dropping GCP-hosted artifact registries like gcr.io/istio-release?

Yes, starting with Istio 1.31, artifacts will no longer be published to gcr.io/istio-release, registry.istio.io, or istio-release.storage.googleapis.com. Docker images move to Docker Hub, Helm charts move to blob.istio.io/istio-release/charts and ghcr.io/istio/release/charts, and other artifacts move to blob.istio.io/istio-release. Scheduled scream tests disabling GCP hosting run from September 15 through December 8-9, 2026 to help users find dependencies before the final cutover.

_Track infrastructure deprecations like Istio's GCP artifact retirement as you plan mesh upgrades, on daily.dev._

### What is zoneAwareLbSetting in Istio 1.31?

It is a new field on DestinationRule.TrafficPolicy.LoadBalancerSettings and MeshConfig that lets Envoy automatically route traffic to endpoints in the same availability zone as the downstream proxy, spilling over to other zones only when local capacity is insufficient. Unlike the existing localityLbSetting, which relies on static percentages, zone-level routing is handled automatically by Envoy, and can be layered with cross-region failover ordering and label-based priority tiers.

_Engineers tuning service mesh traffic routing can weigh options like this on daily.dev._

### How do I achieve FIPS 140-3 compliance in Istio 1.31?

Set the COMPLIANCE_POLICY environment variable to fips-140-3, which enforces TLS 1.2+ with FIPS-compliant cipher suites and P-256/P-384 curves. Go components involved must be built with Go 1.24 or later using GOFIPS140=v1.0.0. This is a new compliance policy value introduced in Istio 1.31 for organizations with regulatory requirements around cryptographic modules.

_Teams navigating compliance requirements in their mesh setup follow release details like this on daily.dev._

## Similar posts on daily.dev

- [Announcing Istio 1.30.0](https://daily.dev/posts/announcing-istio-1-30-0-8ia7qm8bs) · Istio · 1 upvotes · 0 comments
- [Announcing Istio 1.30.2](https://daily.dev/posts/announcing-istio-1-30-2-czzzkx40i) · Istio · 1 upvotes · 0 comments
- [Istio 1.31.0 Change Notes](https://daily.dev/posts/istio-1-31-0-change-notes-kyf3ouoes) · Istio · 6 upvotes · 0 comments
- [Announcing Istio 1.29.0](https://daily.dev/posts/announcing-istio-1-29-0-p84o4ejd1) · Istio · 0 upvotes · 0 comments
- [Announcing Istio 1.30.3](https://daily.dev/posts/announcing-istio-1-30-3-gko21nydq) · Istio · 3 upvotes · 0 comments

---

Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#istio](https://daily.dev/tags/istio), [#service-mesh](https://daily.dev/tags/service-mesh), [#envoy](https://daily.dev/tags/envoy)

[View this post on daily.dev](https://daily.dev/posts/announcing-istio-1-31-0-onsnrwev9)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"Announcing Istio 1.31.0","url":"https://daily.dev/posts/announcing-istio-1-31-0-onsnrwev9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/announcing-istio-1-31-0-onsnrwev9"},"datePublished":"2026-08-31T15:41:56.564Z","dateModified":"2026-08-31T15:42:22.775Z","description":"Istio 1.31.0 has been released, bringing agentgateway support as a waypoint proxy, Gateway API AllowInsecureFallback for client cert validation, ambient mode...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c6099bba9727c2a15aee6bdc2485513c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c6099bba9727c2a15aee6bdc2485513c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Istio","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Istio","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/istio","url":"https://daily.dev/sources/istio"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/announcing-istio-1-31-0-onsnrwev9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,istio,service-mesh,envoy","timeRequired":"PT6M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Istio","item":"https://daily.dev/sources/istio"},{"@type":"ListItem","position":3,"name":"Announcing Istio 1.31.0"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/announcing-istio-1-31-0-onsnrwev9#faq","mainEntity":[{"@type":"Question","name":"Is Istio dropping GCP-hosted artifact registries like gcr.io/istio-release?","acceptedAnswer":{"@type":"Answer","text":"Yes, starting with Istio 1.31, artifacts will no longer be published to gcr.io/istio-release, registry.istio.io, or istio-release.storage.googleapis.com. Docker images move to Docker Hub, Helm charts move to blob.istio.io/istio-release/charts and ghcr.io/istio/release/charts, and other artifacts move to blob.istio.io/istio-release. Scheduled scream tests disabling GCP hosting run from September 15 through December 8-9, 2026 to help users find dependencies before the final cutover. Track infrastructure deprecations like Istio's GCP artifact retirement as you plan mesh upgrades, on daily.dev."}},{"@type":"Question","name":"What is zoneAwareLbSetting in Istio 1.31?","acceptedAnswer":{"@type":"Answer","text":"It is a new field on DestinationRule.TrafficPolicy.LoadBalancerSettings and MeshConfig that lets Envoy automatically route traffic to endpoints in the same availability zone as the downstream proxy, spilling over to other zones only when local capacity is insufficient. Unlike the existing localityLbSetting, which relies on static percentages, zone-level routing is handled automatically by Envoy, and can be layered with cross-region failover ordering and label-based priority tiers. Engineers tuning service mesh traffic routing can weigh options like this on daily.dev."}},{"@type":"Question","name":"How do I achieve FIPS 140-3 compliance in Istio 1.31?","acceptedAnswer":{"@type":"Answer","text":"Set the COMPLIANCE_POLICY environment variable to fips-140-3, which enforces TLS 1.2+ with FIPS-compliant cipher suites and P-256/P-384 curves. Go components involved must be built with Go 1.24 or later using GOFIPS140=v1.0.0. This is a new compliance policy value introduced in Istio 1.31 for organizations with regulatory requirements around cryptographic modules. Teams navigating compliance requirements in their mesh setup follow release details like this on daily.dev."}}]}
```