Istio Quick Reference OMNI52 GmbH

Istio releases and support windows

Istio ships roughly one minor per quarter. A minor line is supported until six weeks after the N+2 release; after that, not even security fixes are back-ported. With 1.31 out, support for 1.29 ends on 12 October 2026.

Last checked: 1 October 2026. Every date below comes from the project's own release documentation, linked at the bottom.

Line	Released	Latest patch	End of support	Status
1.31	31 Aug 2026	1.31.1 (21 Sep 2026)	six weeks after 1.33 (expected Feb 2027)	current
1.30	18 May 2026	1.30.5 (21 Sep 2026)	six weeks after 1.32 (expected Dec 2026)	supported
1.29	16 Feb 2026	1.29.8 (21 Sep 2026)	12 Oct 2026	supported
1.28	5 Nov 2025	1.28.10 (1 Jul 2026)	1 Jul 2026	end of life

Worth knowing

The Envoy version equals the Istio version plus 8: Istio 1.31 runs Envoy 1.39.
In-place upgrades go one minor at a time; revision-based (canary) upgrades in sidecar mode may skip one minor, e.g. 1.29 directly to 1.31. In ambient mode, ztunnel and istio-cni support only a control plane at most one minor ahead, so upgrade one minor at a time.
Run 1.31.1, not 1.31.0: the fix for GHSA-qm8v-g4f9-qhjx (BackendTLSPolicy fails open to plaintext on sidecars when its CA reference is unresolved) shipped in 1.30.4 and 1.29.7 on 27 Aug 2026, but only reached the 1.31 line with 1.31.1.
Per the compatibility matrix (supportStatus.yml), 1.31 supports Kubernetes 1.32 to 1.37, 1.30 supports 1.32 to 1.36 and 1.29 supports 1.31 to 1.35. The 1.31.0 release announcement still listed 1.32 to 1.36.
From 1.31 on, images are published only to docker.io/istio and Helm charts to blob.istio.io and ghcr.io/istio/release/charts. gcr.io/istio-release, registry.istio.io/release and istio-release.storage.googleapis.com go dark in December 2026. 1.30 installations pull from registry.istio.io/release by default, so they are affected without an upgrade: set hub (and global.hub) to docker.io/istio or a pull-through cache. 1.31.0 is still signed with istio-key.pub, 1.31.1 and later with istio-key-v2.pub.
Dates follow the release announcements and EOL notices. supportStatus.yml lists 27 Aug 2026 for 1.31 (the rc.4 tag date) and 14 May 2026 for 1.30. The 1.28 end of support was first announced for 28 Jun 2026; support ended on 1 Jul 2026 with 1.28.10.
The end of support for 1.30 and 1.31 depends on the 1.32 and 1.33 releases; the months are the expectation from supportStatus.yml, not fixed dates. No 1.32 pre-release has been tagged as of 1 October 2026.

Sources

Back to the cheatsheet