What you can do today to ensure your clusters are not impacted by the retirement of `gcr.io/istio-release`.
Due to changes in Istio’s funding model, Istio images will no longer be available at gcr.io/istio-release
starting January 1st, 2027.
That is, clusters that reference images hosted on gcr.io/istio-release
might fail to create new pods in 2027.
In fact, we are fully migrating all Istio artifacts out of Google Cloud, including Helm charts. Future communications will cover the migration of Helm charts and other artifacts. This post will focus on what you can do today in response to the 2027 container registry migration.
Am I affected?
By default, Istio installations use Docker Hub (docker.io/istio
) as their container registry, but many users choose to use the gcr.io/istio-release
mirror.
You can check whether you are using the mirror using the following command.
$ kubectl get pods --all-namespaces -o json \
| jq -r '.items[] | select(.spec.containers[].image | startswith("gcr.io/istio-release")) | "\(.metadata.namespace)/\(.metadata.name)"'
The above command will list all the pods that use images hosted on gcr.io/istio-release
.
If there are any such pods, you will likely need to migrate.
What to do today
Although we plan to keep images available on gcr.io/istio-release
until late 2026,
we have set up registry.istio.io
as the new home for Istio images.
Please migrate to using registry.istio.io
as soon as possible.
Using istioctl
If you install Istio using istioctl
, you can update your IstioOperator
configuration as follows:
istiooperator.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
...
hub: registry.istio.io/release
Everything else can stay the same unless you reference `gcr.io/istio-release` images elsewhere
and install Istio using this configuration
$ istioctl install -f istiooperator.yaml
Alternatively, you can pass in the registry as a command line argument
$ istioctl install --set hub=registry.istio.io/release # the rest of your arguments
Using Helm
If you use Helm to install Istio, update your values file to have the following:
...
hub: registry.istio.io/release
global:
hub: registry.istio.io/release
Everything else can stay the same unless you reference `gcr.io/istio-release` images elsewhere
Then, update your Helm installation with your new values file.
Private mirrors
Your organization might pull images from gcr.io/istio-release
, push them to a private registry, and reference the private registry in your Istio installation.
This process will still work, but you will have to pull from registry.istio.io/release
instead of gcr.io/istio-release
.
Facts Only
Istio will retire gcr.io/istio-release starting January 1st, 2027
Users may experience pod failures if not migrated before then
registry.istio.io has been set up as the new home for Istio images
Executive Summary
Full Take
This announcement by Istio highlights a shift in their container registry and could be seen as an opportunity for users to update their configurations to ensure continued functionality of their clusters. It's crucial for users to proactively migrate their dependencies to the new registry, as failure to do so may result in pod creation issues after 2027. This change also emphasizes the importance of keeping infrastructure updated and adaptable to changes in external resources.
Patterns detected: ARC-0043 Motte-and-Bailey (Istio provides a new registry while still maintaining the old one, creating a potential transition period with uncertainty), ARC-0024 Ambiguity (the article does not specify the exact date for when images will no longer be available on gcr.io/istio-release)