Istio 1.29.6

This maintenance release focuses on critical stability fixes for Ambient mesh, AWS VPC CNI integrations, and multi-network routing. It also addresses several memory leaks in the control plane and ensures smoother upgrade paths for sidecars.

Resolve Kubelet probe failures with AWS VPC CNI security groups — Users running Istio in AWS environments using VPC CNI and 'Security Groups for Pods' will no longer experience intermittent kubelet health check failures, ensuring better application availability.

Fix ingress and waypoint semantics in multi-network environments — Prevents traffic blackholes or routing errors in complex multi-network setups that use both Waypoint proxies and Ingress gateways.

Fix ambient pod connectivity loss after node or kubelet restarts — Addresses a critical reliability issue where Ambient mode networking rules could be lost after a node or kubelet restart, which previously caused traffic drops for pods on that node.

Fix memory leaks in KRT and pod resync logic — Prevents memory exhaustion in the Istio control plane (istiod) by fixing leaks in internal indexing and pod resync logic, especially in large or volatile clusters.

Report InvalidFilter for HTTPRoute headers with invalid characters — Improves compliance with the Gateway API spec and simplifies debugging by correctly reporting invalid characters in HTTP headers as a 'InvalidFilter' status rather than failing silently or generically.