istio/istio

Dependencies

What this repo depends on, what depends on it, and the moving parts at the boundaries.

What `istio/istio` depends on (Go)

Go module declared at the top of go.mod as module istio.io/istio. Notable direct dependencies, grouped:

Sister repos (same project, separate modules)

Dependency	Used for
`istio.io/api`	All Istio CRD protos and the `MeshConfig` proto
`istio.io/client-go`	Generated typed kube clients for Istio CRDs
`istio.io/envoy` (via images)	The Envoy build that ships with `istio-proxy`

The Envoy source isn't a Go module — it's a separate repo whose binary is built into the proxy image. The Istio repo references the proxy by image SHA in istio.deps.

Envoy control plane

Dependency	Used for
`github.com/envoyproxy/go-control-plane/envoy`	The Envoy v3 xDS protos
`github.com/envoyproxy/go-control-plane/contrib`	Contrib filters' protos
`github.com/cncf/xds/go`	Cross-cutting xDS types

These are the protos pilot/pkg/networking/core/ builds against. Major version bumps here are the most-impactful Istio-side dependency changes.

Kubernetes

Dependency	Used for
`k8s.io/api`, `k8s.io/apimachinery`, `k8s.io/client-go`	Standard kube client
`k8s.io/apiextensions-apiserver`	CRD installation
`sigs.k8s.io/gateway-api`	The Kubernetes Gateway API
`sigs.k8s.io/mcs-api`	Multi-cluster Services
`sigs.k8s.io/controller-runtime`	Used in tests, not in main control plane

Kube versions are upgraded together (make update-deps). Istio targets the latest 3-4 Kubernetes versions; older versions are explicitly tested against in CI.

Build, test, and tooling

Dependency	Used for
`google.golang.org/grpc`	All gRPC server/client work
`google.golang.org/protobuf`	Standard proto marshalling
`github.com/planetscale/vtprotobuf`	Optimized proto marshalling for hot paths
`github.com/google/cel-go`	CEL evaluation in `AuthorizationPolicy` and analyzers
`github.com/Masterminds/sprig/v3`	Template functions in injection / Helm
`github.com/prometheus/client_golang`	Metrics
`go.opentelemetry.io/...`	Tracing
`github.com/AdaLogics/go-fuzz-headers`	Fuzz test inputs

What's not a Go dependency but is critical

Envoy — built and shipped as the istio-proxy image. Source: istio/proxy (a wrapper around upstream Envoy). The Istio image SHA is pinned in istio.deps.
Ztunnel — the Rust per-node proxy in istio/ztunnel. Image SHA pinned in istio.deps.
Helm charts — vendored under manifests/charts/. Generated outputs are regenerated by make refresh-templates.

What depends on `istio/istio`

Other repos in the istio org

istio/release-builder — builds release tarballs from this repo + sister repos.
istio/installer — historical; mostly merged into this repo's manifests/.
istio/tools — performance benchmarks consume the build artifacts.
istio/istio.io — the docs site; references this repo for examples.

Downstream consumers

Vendor / rebuild targets:

Cloud providers building managed Istio offerings (Google Anthos / GKE, Azure AKS Service Mesh, AWS App Mesh's Istio integration, Solo.io Gloo Mesh).
Other service-mesh projects wrapping or extending Istio (Tetrate Service Bridge, IBM Cloud Service Mesh).

Most consume the released Helm charts or istioctl install; only a handful build from source.

Boundary protocols

This is what crosses module / process boundaries:

Protocol	Where defined	Used between
Envoy xDS v3	`github.com/envoyproxy/go-control-plane/envoy`	istiod ↔ Envoy (sidecars + gateways + waypoints)
Workload API	`pkg/workloadapi/workload.proto`	istiod ↔ ztunnel
ZDS	`pkg/zdsapi/`	istio-cni ↔ ztunnel
IstioCertificateService	`security/proto/providers/google/...` and (for production) Istio's own proto	istiod CA ↔ pilot-agent
HBONE	`pkg/hbone/`	ztunnel ↔ ztunnel, ztunnel ↔ waypoint

Cross-process compatibility is maintained via:

Envoy xDS — istiod negotiates the version in the DiscoveryRequest.type_url. Backwards-compat across Envoy minor versions is the upstream's responsibility.
Workload API — Istiod and ztunnel are released together, but the proto is versioned. Adding fields is forward-compatible; removing fields requires a deprecation cycle.
ZDS — same release cycle as ztunnel; not user-visible.

Pinning and updates

go.mod — bumped via make update-deps (uses go get + go mod tidy). CI's dep-bot opens PRs.
istio.deps — JSON file in the repo root listing pinned SHAs for sister repos and Envoy. Updated by release engineering.
manifests/zzz_profile.yaml and chart values.yaml — image references are edited at release time by the build pipeline.