What you can do with your Helm charts and signing keys to ensure you are not impacted by the migration to AWS.
This year, Istio is migrating all of our infrastructure from Google Cloud Platform to Amazon Web Services due to changes in our funding model.
This post describes the transition of our container images, Helm charts, other release artifacts (RPMs, DEBs, source code, SPDX documents, istioctl
, and licenses), signing keys, and upcoming scream tests where we will disable access to all GCP-hosted artifacts.
Container Images
In a previous blog post, we announced that the gcr.io/istio-release
and registry.istio.io
container registries will be decommissioned in December 2026 and we would only publish Istio container images to Docker Hub.
Starting with Istio 1.31, we will only publish Istio container images to docker.io/istio
.
Please see the previous blog post for details on migrating away from gcr.io/istio-release
and registry.istio.io
.
Helm Charts and Other Release Artifacts
Historically, Istio published Helm charts to https://istio-release.storage.googleapis.com/charts
as well as gcr.io/istio-release/charts
as OCI artifacts.
Similarly, we published other release artifacts (RPMs, DEBs, source code, SPDX documents, istioctl
, and licenses) to https://istio-release.storage.googleapis.com/releases
.
Helm charts and other release artifacts will be removed from the above locations in December 2026.
All Helm charts of all Istio versions are currently available at https://blob.istio.io/istio-release/charts
and we will continue to publish them there for the foreseeable future.
All OCI Helm charts of all Istio versions are currently available at ghcr.io/istio/release/charts
and we will continue to publish them there for the foreseeable future.
All other release artifacts of all Istio versions are currently available at https://blob.istio.io/istio-release/releases
and we will continue to publish them there for the foreseeable future.
Istio 1.30 will be the last minor version with Helm charts, OCI Helm charts, and images published to gcr.io/istio-release
, registry.istio.io/release
and https://istio-release.storage.googleapis.com/charts
.
Istio 1.31 will not have Helm charts, OCI Helm charts, nor images published to gcr.io/istio-release/
, registry.istio.io/release
, and https://istio-release.storage.googleapis.com/charts
.
More information will be available in the release notes.
Signing Keys
As a result of our migration, we will switch our public/private key pairs.
We will still host the old public key at https://istio.io/misc/istio-key.pub
for the foreseeable future.
However, newer images will be signed with a new key, which will have the corresponding public key available at https://istio.io/misc/istio-key-v2.pub
.
We expect the following signing keys to be used for each release:
| Version | Signing Public Key |
|---|---|
| 1.18.x - 1.30.x | https://istio.io/misc/istio-key.pub |
| 1.31.0 | https://istio.io/misc/istio-key.pub |
| 1.31.1+ | https://istio.io/misc/istio-key-v2.pub |
Scream Tests and What You Need to Do
We will be conducting a series of “scream tests” where we will temporarily disable access to gcr.io/istio-release
, registry.istio.io/release
, and https://istio-release.storage.googleapis.com/
.
The first scream test will be September 15th, 2026 from 3:00 PM to 4:00 PM UTC.
The second scream test will be October 13th, 2026 from 3:00 PM to 6:00 PM UTC.
The third scream test will be November 17th, 2026 from 3:00 PM to 9:00 PM UTC.
The fourth and last scream test will be from December 8th, 2026 3:00 PM UTC to December 9th, 2026 3:00 PM UTC.
If you are using registry.istio.io/release
or gcr.io/istio-release
, you should migrate to docker.io/istio
or a pull-through cache as soon as possible.
If you install Istio using Helm charts from https://istio-release.storage.googleapis.com/charts
, you should migrate to https://blob.istio.io/istio-release/charts
as soon as possible.
If you install Istio using OCI Helm charts at gcr.io/istio-release/charts
, you should migrate to ghcr.io/istio/release/charts
as soon as possible.
If you verify the signature of Istio images, keep an eye out for which signing key is used for your Istio version and update your public key accordingly.
You should complete your migration as soon as possible to avoid any disruption in your Istio deployments.
Facts Only
* Istio is migrating infrastructure from Google Cloud Platform to Amazon Web Services.
* Container registries gcr.io/istio-release and registry.istio.io will be decommissioned in December 2026.
* Istio 1.31 images will be published only to docker.io/istio.
* Helm charts and release artifacts will be removed from Google Cloud Storage in December 2026.
* New Helm chart locations are https://blob.istio.io/istio-release/charts and ghcr.io/istio/release/charts.
* Other release artifacts are available at https://blob.istio.io/istio-release/releases
* Versions 1.18.x through 1.31.0 use the public key at https://istio.io/misc/istio-key.pub
* Versions 1.31.1 and later use the public key at https://istio.io/misc/istio-key-v2.pub
* Scream tests occur September 15, October 13, and November 17, 2026.
* The final scream test runs from December 8 to December 9, 2026.
Executive Summary
Istio is migrating its infrastructure from Google Cloud Platform to Amazon Web Services, necessitating a transition of container images, Helm charts, and release artifacts. Starting with version 1.31, images will be published exclusively to Docker Hub. Legacy GCP-hosted registries and storage locations will be decommissioned in December 2026. To ensure a smooth transition, new hosting locations have been established via blob.istio.io and ghcr.io.
The migration includes a change in cryptographic signing keys. Versions 1.18 through 1.31.0 utilize the original public key, while versions 1.31.1 and later will transition to a second public key (v2). To identify dependencies still relying on legacy infrastructure, a series of "scream tests" will occur between September and December 2026, during which access to GCP-hosted artifacts will be temporarily disabled. Users are advised to migrate to the new registries and update their signing keys immediately to avoid deployment disruptions.
Full Take
The strongest version of this narrative is a transparent, proactive technical migration notice designed to prevent systemic failure for thousands of downstream users. By providing a two-year runway and scheduled "scream tests," the operators are prioritizing stability over a sudden cutover.
This is a technical announcement, but the methodology employed—the "scream test"—reveals a pragmatic admission of the "dependency hell" inherent in modern cloud-native ecosystems. The operators acknowledge that they cannot know every single system relying on their artifacts; therefore, they must intentionally break the system on a small scale to force visibility.
The root cause is a shift in funding models, highlighting a systemic vulnerability in open-source infrastructure: the reliance on corporate cloud credits or sponsorships. When the funding source changes, the physical location of the "truth" (the binaries and keys) must move, forcing an administrative burden onto the end-user. This echoes a broader pattern of infrastructure fragility where the convenience of public registries creates a hidden tax of maintenance for the user.
The primary cost is borne by the DevOps engineers who must now audit their pipelines and update signing keys. The benefit is the continued viability of the project under its new funding model.
Patterns detected: none
Bridge Questions:
1. How does the reliance on third-party cloud providers for open-source distribution affect long-term project sovereignty?
2. What would a more resilient, provider-agnostic distribution model look like for critical infrastructure like Istio?
Counterstrike Scan:
A bad actor would use a similar "migration" narrative to trick users into updating their signing keys to a compromised key or pulling images from a malicious registry. However, this content is a standard operational notice with verifiable timelines and official domains; it does not match a deceptive influence pattern.