Istio 1.31 Adds Agentgateway Waypoints, Moves Hosting

Key Takeaways

Istio 1.31 lets agentgateway operate as a waypoint proxy in ambient meshes.
Weighted waypoint canaries give platform teams a gradual migration path.
Istio is moving release artifacts away from several Google Cloud endpoints.

Istio is extending its ambient mesh architecture toward AI and agentic workloads while changing how platform teams obtain its release artifacts. The combination makes version 1.31 more than a routine service-mesh update. It touches traffic management, migration practices, Kubernetes compatibility, and the software supply chain surrounding Istio deployments.

Released August 31, 2026, Istio 1.31 adds the istio-agentgateway-waypoint GatewayClass. This allows agentgateway to run as a waypoint proxy within an Istio ambient mesh, bringing traffic controls closer to applications that communicate with AI models, tools, and autonomous agents.

That positioning matters because agentic traffic can look different from conventional service-to-service requests. Interactions may be longer lived, involve several external services, or require policy decisions based on the model or tool being called. Agentgateway is intended to handle those patterns, while Istio supplies the broader mesh architecture and policy environment.

The addition also reflects a wider shift in Kubernetes usage. According to the Cloud Native Computing Foundation, 98% of organizations surveyed in its 2025 Annual Cloud Native Survey had adopted cloud-native techniques. Among surveyed organizations running AI workloads, 82% used Kubernetes in production during 2025.

Those figures help explain why AI traffic management is moving into established cloud-native infrastructure rather than developing as a completely separate operational layer. If enterprises already schedule AI workloads on Kubernetes, using familiar Gateway API resources and mesh policies can reduce the number of distinct control systems that platform teams manage.

Adding a new proxy option represents only part of the operational requirements; enterprises also need a controlled way to introduce it. Istio 1.31 addresses that issue with weighted waypoint canaries. Teams can direct a portion of traffic to a new waypoint deployment, observe its behavior, and then increase the share gradually. That approach limits exposure during migrations between waypoint implementations or versions. It also gives operators room to compare telemetry and policy behavior before committing an entire workload.

Waypoints serve as enforcement points for Layer 7 traffic in an ambient mesh, meaning a sudden replacement could affect routing, authorization, or application behavior across multiple services. Weighted canaries provide a more measured migration path, particularly for organizations with formal change controls.

Ambient mesh itself reduces dependence on sidecar proxies attached to every application pod. It uses Istio's HBONE protocol for secure traffic transport and introduces waypoint proxies when workloads need richer Layer 7 processing. Envoy remains central to much of Istio's data-plane ecosystem, but support for agentgateway gives organizations another specialized option for AI-oriented traffic.

The release also advances alignment with the Kubernetes Gateway API. Istio 1.31 implements the API's AllowInsecureFallback feature, which permits fallback behavior when secure listener configuration is unavailable or unsuitable. Operators will still want to examine how that behavior interacts with their security policies rather than treating it as a default choice.

Compatibility is another practical consideration. Istio 1.31 supports Kubernetes versions 1.32 through 1.36. Platform teams planning an upgrade can use that window to coordinate cluster, mesh, and vendor-supported distribution schedules. Solo.io's release documentation provides additional context for customers using Solo Enterprise for Istio.

Separately, Istio is changing the distribution paths used for release assets. The project will stop publishing to gcr.io/istio-release, registry.istio.io, and istio-release.storage.googleapis.com. Docker images will remain available through Docker Hub. Helm and other artifacts are moving to Istio's Blob storage, while OCI Helm charts are shifting to GitHub Container Registry.

Internal mirrors, CI pipelines, deployment scripts, admission policies, and firewall allowlists may contain references to the retiring locations. Updating those dependencies early will prevent failed builds or blocked upgrades after publication ends.

Istio is adapting the mesh for emerging AI traffic patterns while simultaneously revising its distribution machinery. Although the new waypoint capabilities represent the primary architectural change for version 1.31, artifact migration requires the most immediate operational work.

Editorial oversight by Rich Tehrani — CEO of TMC and creator of ITEXPO.

Disclosure: Rich Tehrani is also CEO of RT Advisors and a Registered Representative offering securities through Four Points Capital Partners LLC (Member FINRA/SIPC). Nothing in this article is an endorsement or recommendation to buy or sell any security or sector mentioned. RT Advisors may have or have had business relationships with companies mentioned in TMC Insight articles. Such relationships do not affect editorial judgment or coverage.