live wire
▸AI · vLLM Recipes maps Muse Spark Open to single-node Blackwell and AMD deployment (Oct. 16)vLLM▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸AI · vLLM Recipes maps Muse Spark Open to single-node Blackwell and AMD deployment (Oct. 16)vLLM▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security
upstreambeat.ai
releasePLATFORM

OpenShift Service Mesh 3.4 adds nftables, FIPS 140-3 and inference routing

The release prepares meshes for RHEL 10, expands Gateway API support and gives operators a path to mix sidecar and ambient workloads.

Service Mesh compares legacy traffic handling with nftables and AI routing.
AI-generated illustration
By The News Desk· Sep 21, 2026the quick take — two AI hosts go live when you do

Red Hat OpenShift Service Mesh 3.4 is generally available for OpenShift Container Platform 4.20 and later, with changes aimed at the RHEL 10 transition, stricter compliance requirements and newer traffic-management patterns. The release notes also add a direct bridge to AI-serving infrastructure through Gateway API Inference Extension support.

What changed

Service Mesh 3.4 introduces native nftables support for both sidecar and ambient modes. That matters because RHEL 10 and RHEL CoreOS 10 remove the legacy iptables framework that the mesh previously used to redirect traffic through proxies. Operators must enable values.global.nativeNftables=true when installing or updating the control plane; ambient-mode nodes may also require a reboot during migration, according to the Red Hat documentation.

The release also supports FIPS 140-3 on FIPS-enabled OpenShift clusters in sidecar and ambient modes. Red Hat says this maintains compliance as FIPS 140-2 expires on September 21, 2026, and adds TLS 1.3 for mesh traffic while retaining TLS 1.2 as the minimum version. The same release notes describe coexistence of sidecar and ambient workloads in separate namespaces, providing an incremental migration path where ambient mode does not yet cover every workload.

Why AI platform teams should notice

Service Mesh 3.4 supports Gateway API 1.5.1, including stable ListenerSet, TLSRoute, HTTPRoute CORS, client-certificate validation and multi-domain certificate selection. It also supports Gateway API Inference Extension 1.4.0 for routing and load balancing across GPU-backed model-serving workloads, tying the mesh release directly to OpenShift AI deployment patterns documented by Red Hat.

Several defaults change beneath those headline features. Debug-endpoint authorization is enabled by default, Envoy metrics compression is enabled by default, and ambient workloads now use DNS proxying by default. Existing ambient pods do not automatically pick up the new DNS redirection after an upgrade; Red Hat says operators must restart those pods or configure Istio CNI reconciliation at startup. Circuit-breaker metrics tracking is disabled by default to reduce proxy memory use, with an environment variable available to restore it.

What operators should do

Before upgrading, platform teams should verify that their OpenShift version supports Service Mesh 3.4, decide whether their RHEL 10 transition requires native nftables, and test tools that depend on Istio debug endpoints. Teams adopting ambient mode should plan for pod restarts and review the documented coexistence limitations. AI platform teams can separately evaluate whether Inference Extension routing should replace bespoke gateway logic for model endpoints. Those checks follow directly from the configuration and compatibility changes in the 3.4 release notes.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk