Istio 1.31 Brings Agent-Based Waypoint Proxies and Shifts Release Hosting to AWS

New agentgateway waypoint support#

Istio 1.31, released in late August, now allows operators to deploy agentgateway as a Layer 7 waypoint proxy within ambient mesh environments using the new istio-agentgateway-waypoint GatewayClass. The Rust-based data plane, which Solo.io contributed to the Linux Foundation, extends proxy capabilities beyond traditional HTTP to handle specialized protocols like the Model Context Protocol, enabling mesh support for AI agent communication.

This feature builds on experimental gateway-only integration introduced in version 1.30. The release resolves critical issues with ListenerSet configuration and mTLS connectivity for agentgateway backends, while traffic shifting between waypoints remains in alpha with potential changes to labels and behavior ahead.

Traffic shifting and canary deployments#

Istio 1.31 introduces a mechanism for gradually directing traffic between a primary waypoint and a secondary canary variant. Teams can designate a canary waypoint using the use-waypoint-canary label at the service or namespace level, then control what percentage of new connections route to it via the use-waypoint-canary-weight annotation—all without modifying client applications. However, established connections persist with their original waypoints, so long-lived communication patterns may delay full traffic migration.

A patch release on 21 September (1.31.1) corrected a bug where canary-only waypoints lacked proper route and policy programming, causing redirected connections to fail. This update also addressed IPv6-only cluster issues and included security improvements.

Infrastructure migration from Google Cloud to AWS#

In a significant operational shift, Istio stopped publishing container images and Helm charts to Google Cloud during this release cycle. Teams relying on gcr.io/istio-release, registry.istio.io, or Google-hosted Helm repositories must migrate to new locations before service disruptions occur—a scheduled test will disable the old endpoints on 13 October (15:00–18:00 UTC), with permanent retirement planned for December.