diff --git a/content/en/news/releases/1.10.x/announcing-1.10/upgrade-notes/index.md b/content/en/news/releases/1.10.x/announcing-1.10/upgrade-notes/index.md index 7dc5ffdda7..ae582fb81b 100644 --- a/content/en/news/releases/1.10.x/announcing-1.10/upgrade-notes/index.md +++ b/content/en/news/releases/1.10.x/announcing-1.10/upgrade-notes/index.md @@ -83,3 +83,11 @@ If this behavior is not desired, it can be temporarily disabled with `--set valu This option will be removed in future releases. See the updated [Automatic sidecar injection](/docs/setup/additional-setup/sidecar-injection/) documentation for more information. + +## Multicluster `.global` stub domain + +As part of the fixes for [ISTIO-SECURITY-2021-006](/news/security/istio-security-2021-006/), the [previously deprecated](/news/releases/1.8.x/announcing-1.8/upgrade-notes/#multicluster-global-stub-domain-deprecation) `.global` stub domain for multicluster will no longer work. + +This change can be temporarily disabled if desired by setting the environment variable `PILOT_ENABLE_LEGACY_AUTO_PASSTHROUGH=true` in Istiod. However, this is strongly discouraged, as it negates the fix to [ISTIO-SECURITY-2021-006](/news/security/istio-security-2021-006/). + +Please follow the [Multicluster Installation documentation](/docs/setup/install/multicluster/) for more information. diff --git a/content/en/news/releases/1.8.x/announcing-1.8.6/index.md b/content/en/news/releases/1.8.x/announcing-1.8.6/index.md index 81d6b7b0e5..38aee9b790 100644 --- a/content/en/news/releases/1.8.x/announcing-1.8.6/index.md +++ b/content/en/news/releases/1.8.x/announcing-1.8.6/index.md @@ -48,3 +48,11 @@ Istio contains a remotely exploitable vulnerability where an HTTP request path w - **Fixed** the Kubernetes API server so it is now considered to be cluster-local by default . This means that any pod attempting to reach `kubernetes.default.svc` will always be directed to the in-cluster server. [Issue 31340](https://github.com/istio/istio/issues/31340) - **Fixed** Istio operator to prune resources that do not belong to the specific Istio operator CR. [Issue 30833](https://github.com/istio/istio/issues/30833) + +## Breaking Changes + +As part of the fixes for [ISTIO-SECURITY-2021-006](/news/security/istio-security-2021-006/), the [previously deprecated](/news/releases/1.8.x/announcing-1.8/upgrade-notes/#multicluster-global-stub-domain-deprecation) `.global` stub domain for multicluster will no longer work. + +This change can be temporarily disabled if desired by setting the environment variable `PILOT_ENABLE_LEGACY_AUTO_PASSTHROUGH=true` in Istiod. However, this is strongly discouraged, as it negates the fix to [ISTIO-SECURITY-2021-006](/news/security/istio-security-2021-006/). + +Please follow the [Multicluster Installation documentation](/docs/setup/install/multicluster/) for more information. diff --git a/content/en/news/releases/1.9.x/announcing-1.9.5/index.md b/content/en/news/releases/1.9.x/announcing-1.9.5/index.md index 61e2acd713..cd79a102ec 100644 --- a/content/en/news/releases/1.9.x/announcing-1.9.5/index.md +++ b/content/en/news/releases/1.9.x/announcing-1.9.5/index.md @@ -32,3 +32,11 @@ Istio contains a remotely exploitable vulnerability where an HTTP request path w ## Changes - **Added** [security best practice for authorization policies](/docs/ops/best-practices/security/#authorization-policies) + +## Breaking Changes + +As part of the fixes for [ISTIO-SECURITY-2021-006](/news/security/istio-security-2021-006/), the [previously deprecated](/news/releases/1.8.x/announcing-1.8/upgrade-notes/#multicluster-global-stub-domain-deprecation) `.global` stub domain for multicluster will no longer work. + +This change can be temporarily disabled if desired by setting the environment variable `PILOT_ENABLE_LEGACY_AUTO_PASSTHROUGH=true` in Istiod. However, this is strongly discouraged, as it negates the fix to [ISTIO-SECURITY-2021-006](/news/security/istio-security-2021-006/). + +Please follow the [Multicluster Installation documentation](/docs/setup/install/multicluster/) for more information.