Istio License and 3rd party dependencies


As part of efforts to go Production with istio as Service Mesh, we are trying to work on the Licensing and the 3rd party dependencies.

Istio Version: 1.3.0

I read through this -

Does it mean we can go production with Istio (Apache License 2.0) ?

3rd party dependencies:
I’m trying to get the list of 3rd party libraries or components that istio depends upon. Is this list maintained somewhere ? This is again required as part of us trying to bring-in istio to Production.

Appreciate any quick response on this.


@howardjohn - Would you know answers to these ? If not can you pls point me to the appropriate contact who can help out ?

Please see docker run --entrypoint cat istio/pilot:1.3.4 LICENSES.txt for a complete list of dependencies and their licenses.

In 1.4 we made this more visable, see

Does the above pertain only to pilot's dependencies and licenses ? Or does it apply for all components within istio ?

Thanks @howardjohn for quick responses again.

Hi @howardjohn, another quick question on the version of the library.

Where can I get the version of the library from the license.

For example for this library - I see the following

License Relative To Module Cache:

Does it mean the library version is 0.44.3 ?

Can someone pls address the above question on the library versions please.

Yes that is the version. Feel free to look at the go.mod file from all of our repos to see what dependencies we have

Thanks @howardjohn for the response.