////
Module included in the following assemblies:
* service_mesh/v2x/servicemesh-release-notes.adoc
////

:_mod-docs-content-type: REFERENCE
[id="ossm-release-2-6-0_{context}"]
= {SMProductName} version 2.6.0

////
*Feature* – Describe the new functionality available to the customer. For enhancements, try to describe as specifically as possible where the customer will see changes.
*Reason* – If known, include why has the enhancement been implemented (use case, performance, technology, etc.). For example, showcases integration of X with Y, demonstrates Z API feature, includes latest framework bug fixes. There may not have been a 'problem' previously, but system behavior may have changed.
*Result* – If changed, describe the current user experience
////

This release of {SMProductName} updates the {SMProductName} Operator version to 2.6.0, and includes the following `ServiceMeshControlPlane` resource version updates: 2.6.0, 2.5.3 and 2.4.9.
This release adds new features, addresses Common Vulnerabilities and Exposures (CVEs), and is supported on {product-title} 4.14 and later.

This release ends maintenance support for {SMProductName} version 2.3. If you are using {SMProductShortName} version 2.3, you should update to a supported version.

//FIPS messaging verified with Matt Werner, CS, OCP on 06/27/2024 via Slack. It is also the same FIPS messaging currently used by Serverless.
//Per Scott Dodson on 07/15/204 via Slack, confirmed that RHEL 2.9 has been submitted for FIPS validation. Admonition updated accordingly.
//Per Kirsten Newcomer on 07/16/2024 via Slack, FIPS messaging for Service Mesh has been changed. Jamie (PM) has agreed with change.
[IMPORTANT]
====
{SMProductName} is designed for FIPS. {SMProductShortName} uses the RHEL cryptographic libraries that have been submitted to NIST for FIPS 140-2/140-3 Validation on the x86_64, ppc64le, and s390x architectures.
For more information about the NIST validation program, see link:https://csrc.nist.gov/Projects/cryptographic-module-validation-program/validated-modules[Cryptographic Module Validation Program]. For the latest NIST status for the individual versions of RHEL cryptographic libraries that have been submitted for validation, see link:https://access.redhat.com/articles/compliance_activities_and_gov_standards#fips-140-2-and-fips-140-3-2[Compliance Activities and Government Standards].
====

[id="component-versions-ossm-2-6-0_{context}"]
== Component updates

//Component versions updated 07/25/2024.
//Component tables for 2.5.3 and 2.4.9 updated 07/25/2024

|===
|Component |Version

|Istio
|1.20.8

|Envoy Proxy
|1.28.5

|Kiali
|1.73.9
|===

[id="istio-1-20-support-ossm-2-6-0_{context}"]
== Istio 1.20 support
//Jamie
//OSSM 2.6 supports both Istio 1.19 and Istio 1.20 but only include Istio 1.20.
//Listing 2 items that are supported instead of only what is not supported.

Service Mesh 2.6 is based on Istio 1.20, which provides new features and product enhancements, including:

* Native sidecars are supported on {product-title} 4.16 or later.
+
.Example `ServiceMeshControlPlane` resource
[source,yaml]
----
apiVersion: maistra.io/v2
kind: ServiceMeshControlPlane
metadata:
  name: basic
spec:
  runtime:
    components:
      pilot:
        container:
          env:
            ENABLE_NATIVE_SIDECARS: "true"
----

* Traffic mirroring in Istio 1.20 now supports multiple destinations. This feature enables the mirroring of traffic to various endpoints, allowing for simultaneous observation across different service versions or configurations.

While {SMProductName} supports many Istio 1.20 features, the following exceptions should be noted:

//List what is NOT SUPPORTED --> same as 2.5 so copied from 2.5 entry
* Ambient mesh is not supported
* QuickAssist Technology (QAT) PrivateKeyProvider in Istio is not supported

[id="istio-kiali-bundle-image-name-changes-ossm-2-6-0_{context}"]
== Istio and Kiali bundle image name changes
//This content may need to be removed for 2.6 as per Dev via Slack, name change may need to be reversed.
//Filip. Approve 07/11/2024
This release updates the Istio bundle image name and the Kiali bundle image name to better align with Red Hat naming conventions.

* Istio bundle image name: `openshift-service-mesh/istio-operator-bundle`
* Kiali bundle image name: `openshift-service-mesh/kiali-operator-bundle`

[id="integration-otel-tempo-ossm-2-6-0_{context}"]
== Integration with {TempoName} and {OTELName}
//Yuanlin
This release introduces a generally available integration of the tracing extension provider(s) {TempoName} and {OTELName}.

You can expose tracing data to the {TempoName} by appending a named element and the `opentelemetry` provider to the `spec.meshConfig.extensionProviders` specification in the `ServiceMehControlPlane` resource. Then, a telemetry custom resource configures Istio proxies to collect trace spans and send them to the OpenTelemetry Collector endpoint.

You can create a {OTELName} instance in a mesh namespace and configure it to send tracing data to a tracing platform backend service.

[id="jaeger-default-setting-change-ossm-2-6-0_{context}"]
== {JaegerName} default setting change
//also included in "Upgrading --> Upgrading 2.5 to 2.6" but added here for increased visibility.
//Dean. Approved 07/11/2024
This release disables {JaegerName} by default for new instances of the `ServiceMeshControlPlane` resource.

When updating existing instances of the `ServiceMeshControlPlane` resource to {SMProductName} version 2.6, {JaegerShortName} remains enabled by default.

{SMProductName} 2.6 is the last release that includes support for {JaegerName} and {es-op}. Both {JaegerShortName} and {es-op} will be removed in the next release. If you are currently using {JaegerShortName} and {es-op}, you need to switch to {TempoName} and {OTELName}.

//Gateway API Update for 2.6 OSSM-5854 subsequently revised by OSSM-8241
//Kubernetes Gateway API and {product-title} Gateway API are the same. It is referenced as {product-title} Gateway API in 2.5 and as {product-title} Gateway API here https://docs.openshift.com/container-platform/4.15/nodes/clusters/nodes-cluster-enabling-features.html so to be consistent, it is also referenced as {product-title} Gateway API for 2.6.
[id="gateway-api-ga-cluster-wide-deployments-ossm-2-6-0_{context}"]
== Gateway API use is generally available for {SMProductName} cluster-wide deployments
This release introduces the General Availability for using the Kubernetes Gateway API version 1.0.0 with {SMProductName} 2.6. This API use is limited to {SMProductName}. The Gateway API custom resource definitions (CRDs) are not supported.

Gateway API is now enabled by default if cluster-wide mode is enabled (`spec.mode: ClusterWide`). It can be enabled even if the custom resource definitions (CRDs) are not installed in the cluster.

[IMPORTANT]
====
Gateway API for multitenant mesh deployments is still in Technology Preview.
====

Refer to the following table to determine which Gateway API version should be installed with the OpenShift {SMProductShortName} version you are using:

|===
|Service Mesh Version | Istio Version | Gateway API Version | Notes

|2.6
|1.20.x
|1.0.0
|N/A

|2.5.x
|1.18.x
|0.6.2
|Use the experimental branch because `ReferenceGrand` is missing in v0.6.2.

|2.4.x
|1.16.x
|0.5.1
|For multitenant mesh deployment, all Gateway API CRDs must be present. Use the experimental branch.
|===

You can disable this feature by setting `PILOT_ENABLE_GATEWAY_API` to `false`:

[source,yaml]
----
apiVersion: maistra.io/v2
kind: ServiceMeshControlPlane
metadata:
  name: basic
spec:
  runtime:
    components:
      pilot:
        container:
          env:
            PILOT_ENABLE_GATEWAY_API: "false"
----

[id="ossm-fixed-issues-2-6-0_{context}"]
== Fixed issues

* https://issues.redhat.com/browse/OSSM-6754[OSSM-6754] Previously, in {product-title} 4.15, when users navigated to a *Service details* page, clicked the *Service Mesh* tab, and refreshed the page, the *Service Mesh details* page remained stuck on Service Mesh content information, even though the active tab was the default *Details* tab. Now, after a refresh, users can navigate through the different tabs of the *Service details* page without issue.

* https://issues.redhat.com/browse/OSSM-2101[OSSM-2101] Previously, the Istio Operator never deleted the `istio-cni-node` DaemonSet and other CNI resources when they were no longer needed. Now, after upgrading the Operator, if there is at least one SMCP installed in the cluster, the Operator reconciles this SMCP, and then deletes all unused CNI installations (even very old CNI versions as early as v2.0).

//kept so make it easier for the next release
//[id="ossm-known-issues-RELEASE_{context}"]
//== Service Mesh Known issues

[id="ossm-kiali-known-issues-2-6-0_{context}"]
== Kiali known issues
// The explanations of these issues have been reviewed/approved in previous releases.
* https://issues.redhat.com/browse/OSSM-6099[OSSM-6099] Installing the OpenShift {SMProductShortName} Console (OSSMC) plugin fails on an IPv6 cluster.
+
Workaround: Install the OSSMC plugin on an IPv4 cluster.