content/en/news/releases/1.1.x/announcing-1.1.3/index.md
We're pleased to announce the availability of Istio 1.1.3. Please see below for what's changed.
{{< relnote >}}
Istio-specific back-ports of Envoy patches for CVE-2019-9900 and
CVE-2019-9901 included in Istio 1.1.2 have been dropped in favor of an
Envoy update which contains the final version of the patches.
Fix load balancer weight setting for split horizon EDS.
Fix typo in the default Envoy JSON log format (Issue 12232).
Correctly reload out-of-process adapter address upon configuration change (Issue 12488).
Restore Kiali settings that were accidentally deleted (Issue 3660).
Prevent services with same target port resulting in duplicate inbound listeners (Issue 9504).
Fix issue with configuring Sidecar egress ports for namespaces other than istio-system resulting in a envoy.tcp_proxy filter of BlackHoleCluster by auto binding
to services for Sidecar listeners (Issue 12536).
Fix gateway vhost configuration generation issue by favoring more specific host matches (Issue 12655).
Fix ALLOW_ANY so it now allows external traffic if there is already an http service present on a port.
Fix validation logic so that port.name is no longer a valid PortSelection.
Fix istioctl proxy-config cluster cluster type column rendering (Issue 12455).
Fix SDS secret mount configuration.
Fix incorrect Istio version in the Helm charts.
Fix partial DNS failures in the presence of overlapping ports (Issue 11658).
Fix Helm podAntiAffinity template error (Issue 12790).
Fix bug with the original destination service discovery not using the original destination load balancer.
Fix SDS memory leak in the presence of invalid or missing keying materials (Issue 13197).
Hide ServiceAccounts from PushContext log to reduce log volume.
Configure localityLbSetting in values.yaml by passing it through to the mesh configuration.
Remove the soon-to-be deprecated critical-pod annotation from Helm charts (Issue 12650).
Support pod anti-affinity annotations to improve control plane availability (Issue 11333).
Pretty print IP addresses in access logs.
Remove redundant write header to further reduce log volume.
Improve destination host validation in Pilot.
Explicitly configure istio-init to run as root so use of pod-level securityContext.runAsUser doesn't break it (Issue 5453).
Add configuration samples for Vault integration.
Respect locality load balancing weight settings from ServiceEntry.
Make the TLS certificate location watched by Pilot Agent configurable (Issue 11984).
Add support for Datadog tracing.
Add alias to istioctl so 'x' can be used instead of 'experimental'.
Provide improved distribution of sidecar certificate by adding jitter to their CSR requests.
Allow weighted load balancing registry locality to be configured.
Add support for standard CRDs for compiled-in Mixer adapters.
Reduce Pilot resource requirements for demo configuration.
Fully populate Galley dashboard by adding data source (Issue 13040).
Propagate Istio 1.1 sidecar performance tuning to the istio-gateway.
Improve destination host validation by rejecting * hosts (Issue 12794).
Expose upstream idle_timeout in cluster definition so dead connections can sometimes be removed from connection pools before they are used
(Issue 9113).
When registering a Sidecar resource to restrict what a pod can see, the restrictions are now applied if the spec contains a
workloadSelector (Issue 11818).
Update the Bookinfo example to use port 80 for TLS origination.
Add liveness probe for Citadel.
Improve AWS ELB interoperability by making 15020 the first port listed in the ingressgateway service (Issue 12502).
Use outlier detection for failover mode but not for distribute mode for locality weighted load balancing (Issues 12965).
Replace generation of Envoy's deprecated enabled field in CorsPolicy with the replacement filter_enabled field for 1.1.0+ sidecars only.
Standardize labels on Mixer's Helm charts.