chore(deps): update istio to v1.31.1 and move charts to blob.istio.io #58

Merged

morten-olsen merged 1 commit from chore/istio-1.31 into main

2026-10-08 21:57:58 +02:00

morten-olsen commented

2026-10-08 21:55:48 +02:00

Owner

Why

Istio 1.31 is the prerequisite for the K3s upgrade campaign (1.33.4 → 1.37): Istio 1.30 supports Kubernetes 1.32–1.36 only, 1.31 adds 1.37. Runbook: docs/k3s-upgrade.md in the homelab base repo.

What

Chart	Change
base	1.30.5 → 1.31.1, repo → `https://blob.istio.io/istio-release/charts`
istiod	1.30.5 → 1.31.1, repo → `https://blob.istio.io/istio-release/charts`
gateway	1.30.5 → 1.31.1, repo → `https://blob.istio.io/istio-release/charts`

From 1.31 the charts are only published at blob.istio.io; the old istio-release.storage.googleapis.com index stops at 1.30.5, which is why Renovate never offered the minor. The GCP endpoints are scheduled for retirement with scream tests until 2026-12-09.

Checks

helm lint charts/core charts/shared: clean
Real 1.31.1 charts rendered with the live Application values: istiod keeps ingressService/ingressSelector and the DNS-capture proxyMetadata; gateway keeps all five ports; base renders 15 CRDs.
Default image hub moves from registry.istio.io/release to docker.io/istio (chart default, three images).
Blast radius: only the two istio-ingress/gateway pods carry a proxy; no sidecar fleet to restart.

1.31 upgrade notes reviewed

Unhealthy endpoints are now sent to Envoy unless OutlierDetection.minHealthPercent is set (PILOT_AUTO_SEND_UNHEALTHY_ENDPOINTS). Two DestinationRules in the mesh; watch gateway routing after sync.
PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY removed (not set here).
WorkloadEntry HBONE labels, WDS scale limits, XDS generator auth: not applicable.

After merge

Monitor istio-base, istiod, gateway Applications to 1.31.1 Synced/Healthy, confirm istiod and both gateway pods run 1.31.1, then probe the four ServiceLB endpoints (gateway 80/443/18080/18443, forgejo-ssh 2206, mqtt 1883, pihole-dns 53).

## Why Istio 1.31 is the prerequisite for the K3s upgrade campaign (1.33.4 → 1.37): Istio 1.30 supports Kubernetes 1.32–1.36 only, 1.31 adds 1.37. Runbook: `docs/k3s-upgrade.md` in the homelab base repo. ## What | Chart | Change | |---|---| | base | 1.30.5 → 1.31.1, repo → `https://blob.istio.io/istio-release/charts` | | istiod | 1.30.5 → 1.31.1, repo → `https://blob.istio.io/istio-release/charts` | | gateway | 1.30.5 → 1.31.1, repo → `https://blob.istio.io/istio-release/charts` | From 1.31 the charts are only published at blob.istio.io; the old `istio-release.storage.googleapis.com` index stops at 1.30.5, which is why Renovate never offered the minor. The GCP endpoints are scheduled for retirement with scream tests until 2026-12-09. ## Checks - `helm lint charts/core charts/shared`: clean - Real 1.31.1 charts rendered with the live Application values: istiod keeps `ingressService`/`ingressSelector` and the DNS-capture proxyMetadata; gateway keeps all five ports; base renders 15 CRDs. - Default image hub moves from `registry.istio.io/release` to `docker.io/istio` (chart default, three images). - Blast radius: only the two `istio-ingress/gateway` pods carry a proxy; no sidecar fleet to restart. ## 1.31 upgrade notes reviewed - Unhealthy endpoints are now sent to Envoy unless `OutlierDetection.minHealthPercent` is set (`PILOT_AUTO_SEND_UNHEALTHY_ENDPOINTS`). Two DestinationRules in the mesh; watch gateway routing after sync. - `PILOT_SPAWN_UPSTREAM_SPAN_FOR_GATEWAY` removed (not set here). - WorkloadEntry HBONE labels, WDS scale limits, XDS generator auth: not applicable. ## After merge Monitor `istio-base`, `istiod`, `gateway` Applications to 1.31.1 Synced/Healthy, confirm `istiod` and both gateway pods run 1.31.1, then probe the four ServiceLB endpoints (gateway 80/443/18080/18443, forgejo-ssh 2206, mqtt 1883, pihole-dns 53).

morten-olsen added 1 commit

2026-10-08 21:55:48 +02:00

chore(deps): update istio to v1.31.1 and move charts to blob.istio.io 99df139302

Istio 1.31 is required before Kubernetes 1.37 (1.30 supports up to 1.36).
From 1.31 the charts are only published at blob.istio.io; the old
istio-release.storage.googleapis.com index stops at 1.30.5, which is also
why Renovate never offered the minor.

morten-olsen merged commit 341d6f79bb into main

2026-10-08 21:57:58 +02:00

morten-olsen referenced this pull request from a commit

2026-10-08 21:58:00 +02:00

chore(deps): update istio to v1.31.1 and move charts to blob.istio.io (#58)

morten-olsen referenced this pull request

2026-10-24 22:55:13 +02:00

fix: deploy the available AuthentikServer image default #68