Lore

Istio is one of the older CNCF projects in active development. This page is the narrative history of the codebase: the eras, the deprecated features, the major rewrites, and what each one looked like in git. Dates are derived from commit and tag timestamps in this repository.

Eras

The "three components" era — May 2017 to Aug 2019

The very first commits to this repository land in November 2016, but the project takes recognizable shape in mid-2017 as Istio's design crystallizes around three separate control-plane components written by different teams:

• Pilot (pilot/) — config translation and proxy programming.
• Mixer — policy and telemetry checks. Each request to a sidecar phoned home to Mixer; performance was a perennial pain point.
• Citadel — the workload CA.
• Galley — added later (2018) as a config validation/distribution layer over MCP.

The Eliminate k8s dependencies from proxy agent (#950) commit on 2017-07-24 is one of the first restructurings of pilot/cmd/pilot-discovery/main.go and shows the team already rethinking module boundaries. Istio 1.0 ships on 2018-07-31. Pilot's package layout is reorganized in Restructuring pilot packages (#2739) on 2018-01-24.

This era ends with the first commit toward the unified daemon: Initial version of istiod (#17944) on 2019-10-18.

The Istiod era — Oct 2019 to Aug 2020

Starting in 1.5 (2020-03-05), Istiod ships as a single binary that subsumes Pilot, Citadel, the sidecar injector, and Galley's validation responsibilities. The wiring is what is now pilot/pkg/bootstrap/server.go. Subsequent removals tear out the rest of the legacy stack:

• Apr 2020 — Galley's MCP callout code is removed (Galley: remove callout code (#24418), 2020-06-04) ahead of its retirement.
• Jul 2020 — Remove Mixer from the Istio codebase (#25669) lands on 2020-07-22, deleting the Mixer service tree. Mixer's CRDs are removed in 2020-09-02 (#26849), and telemetry v1 follows on 2020-09-03.
• Jan 2021 — Completely remove mixer service (#29815) finishes the cleanup on 2021-01-04.

The result is a single ~50MB Go binary that owns essentially everything the control plane does today.

The operator and Helm consolidation — Jan 2020 to mid-2024

The operator originally lived in istio/operator. It was merged into this repo on 2020-01-12 with Move everything under operator/ followed by Hook up operator build, testing, docker (#20128). For a few years it ran as both a CLI and an in-cluster reconciler.

The in-cluster mode was deprecated and eventually removed: today the operator package is exclusively a client-side renderer that takes an IstioOperator CR plus profiles and produces install manifests, invoked via istioctl install. Helm charts under manifests/charts/ (base, default, gateway, gateways, istio-cni, istio-control/istio-discovery, ztunnel) became the canonical install method.

The CNI move and sidecar handoff — Jun 2020

CNI plugin code lived in istio/cni until Move CNI into Istio (#24692) on 2020-06-16 brought it home. Two days later, Replace CNI's iptables.sh with istio-iptables golang implementation (#24759) removed the shell-out and replaced it with the Go library now living under tools/istio-iptables/. This set the stage for CNI to take on more responsibility — eventually displacing the privileged istio-init container in standard sidecar installations and, later, becoming the foundation for Ambient mode.

The Ambient era — Sep 2022 to today

Ambient mode is the most consequential architectural change Istio has made since 1.0. It introduces a sidecar-less data plane: a per-node ztunnel for L4 + mTLS and per-namespace waypoint Envoys for L7 features.

• Sep 2022 — labels are added (add Ambient option for labeling new issues, features and pull requests (#40880), 2022-09-08).
• Feb 2023 — the upstream merge wave: ambient upstream: node CA authenticator (#43288), import ztunnel helm/operator charts (#43365), CNI for ambient redirection (#43382), all between 2023-02-13 and 2023-02-15.
• Aug-Sep 2023 — the architecture/ambient/ design docs are added: Create architecture directory and add file for Ambient peerauthentication (#46378) on 2023-08-09, then architecture: add ztunnel.md (#46472) on 2023-09-12. Istio 1.18.0 (the first release with Ambient as alpha) shipped on 2023-06-07, and 1.19.0 on 2023-09-05 stabilized many of these moving parts.
• Dec 2023 — the krt library lands (Initial krt library, ("Building Better Controllers") (#47891), 2023-12-18), bringing a declarative controller framework explicitly designed for the cross-cutting state machines Ambient needs.
• Feb 2024 — ambient: rewrite controller using krt (#49162) ports the Ambient registry to the new framework on 2024-02-29. This commit is one of the largest single PRs in the recent history, and the Ambient code is now one of krt's heaviest users.
• 2024-2026 — continuous evolution: refactoring (ambient: move ambient index outside of kube (#59285), 2026-04-07), CIDR support, waypoint connection strategy improvements, and ongoing graduation toward GA.

istio.deps — the file pinning the ztunnel and proxy commits — is the single most-changed file in the last 90 days (69 commits), reflecting how tightly coupled the Go control plane is to the Rust ztunnel.

Longest-standing features

• Pilot's xDS server. The earliest discovery-related code in pilot/cmd/pilot-discovery/main.go is from Jul 2017. Despite a complete rewrite of the generator architecture, a switch from MCP to ADS, the introduction of caching, and the addition of delta xDS, the xDS server is conceptually unchanged: it watches a config store, builds a snapshot, and serves it to proxies.
• VirtualService / DestinationRule / Gateway. The Istio networking APIs date from the very first releases. Wire formats are stable; conversion code in pilot/pkg/config/kube/crdclient/ is a continuous evolution rather than a rewrite.
• istioctl. First makes its consistent appearance with make istioctl directory structure consistent with other components (#3881) on 2018-03-01, but commands like kube-inject predate that. Today it is the only supported install path; the legacy helm template based install is gone.

Major rewrites and deprecations

• Mixer → in-proxy telemetry. Removed in 2020. Telemetry filters are now part of the proxy build (Wasm or built-in stats filter). Telemetry API replaces Mixer's MixerCheck and MixerReport rules.
• Galley → in-istiod validation. Same wave as Mixer. The validation webhook is now served by istiod itself (pkg/webhooks/validation/). MCP-over-XDS is still supported as a config source for advanced setups, but most users only see CRDs.
• In-cluster operator → CLI-only. The reconciler is gone. Today's operator/pkg/ is a manifest renderer.
• istio-init privileged init container → istio-cni. The CNI plugin replaces the per-pod NET_ADMIN init container. With Ambient, CNI's role expands further: it programs in-pod redirects to the local ztunnel, with no sidecar at all.
• Helm charts: monolithic → split. Early Helm charts had everything under install/kubernetes/helm/. Today there are six charts (base, default, gateway, gateways, istio-cni, istio-control/istio-discovery, ztunnel) under manifests/charts/, each with its own values schema.
• MCP server → CRD client default. ConfigStore was originally implemented with a Mesh Configuration Protocol server. Today the CRD client is the default. The MCP/xDS path remains as pilot/pkg/config/aggregate plus the ConfigStore xDS adapter.
• Sidecar boilerplate → istio-agent. Older Istio shipped a thin shell wrapper around Envoy. Today's pilot-agent is a full process supervisor, SDS server, xDS proxy, and health-probe translator (~30,000 lines under pkg/istio-agent/).
• Ambient registry: ad-hoc → krt-based. Mar 2024's ambient: rewrite controller using krt replaced custom watchers with declarative Collection transforms.

Growth trajectory

Year     Commits   Major event
2016         134   First commits
2017       2,811   Project takes shape; 1.0 prep
2018       3,465   1.0 release (Jul 2018)
2019       4,314   Istiod merge begins; the busiest year
2020       3,624   Mixer removed; CNI and Operator merged in
2021       2,686   1.9–1.12 stabilization
2022       2,355   Ambient design takes shape
2023       2,539   Ambient lands upstream; 1.18 alpha
2024       2,340   krt lands; Ambient rewrite
2025       1,459   GA momentum slows the YoY rate
2026         434   (partial; through Apr 2026)

Annual minor releases since the project's first GA:

• 1.0 — 2018-07-31
• 1.1 — 2019-03-18
• 1.2 — 2019-06-18
• 1.3 — 2019-09-11
• 1.4 — 2019-11-14
• 1.5 — 2020-03-05 (Istiod first appears)
• 1.6 — 2020-05-21
• 1.7 — 2020-08-21
• 1.8 — 2020-11-19
• 1.9 — 2021-02-09
• 1.10 — 2021-05-18
• 1.11 — 2021-08-12
• 1.12 — 2021-11-18
• 1.13 — 2022-02-11
• 1.14 — 2022-06-01
• 1.15 — 2022-08-31
• 1.16 — 2022-11-15
• 1.17 — 2023-02-14
• 1.18 — 2023-06-07 (Ambient alpha)
• 1.19 — 2023-09-05
• 1.20 — 2023-11-14
• 1.21 — 2024-03-13
• 1.22 — 2024-05-13
• 1.23 — 2024-08-14
• 1.24 — 2024-11-07
• 1.25 — 2025-03-03
• 1.26 — 2025-05-08
• 1.27 — 2025-08-11
• 1.28 — 2025-11-05
• 1.29 — 2026-02-16
• 1.30 — alpha as of 2026-04-30

Cadence has settled at roughly four minor releases per year — a quarterly train. Patch releases (1.x.1, 1.x.2, …) follow as needed, governed by RELEASE_BRANCHES.md.