area: security

releaseNotes:
- |
  **Added** An environment variable METRICS_LOCALHOST_ACCESS_ONLY for disabling 
  metrics endpoint from outside of the pod, to allow only localhost access. User can use set this with command
  `--set values.pilot.env.METRICS_LOCALHOST_ACCESS_ONLY=true` for Control plane and  

package features

import (
	"istio.io/istio/pkg/env"
)

// Define common telemetry feature flags shared among the Istio components.
var (
	MetricsLocalhostAccessOnly = env.Register("METRICS_LOCALHOST_ACCESS_ONLY", false,
		"This will disable metrics endpoint from outside of the pod, allowing only localhost access.").Get()

}

func MetricsLocalhostAccessOnly(proxyMetadata map[string]string) Instance {
	value, ok := proxyMetadata["METRICS_LOCALHOST_ACCESS_ONLY"]
	if ok && value == "true" {
		return newOption("metrics_localhost_access_only", true)
	}
	return newOption("metrics_localhost_access_only", false)
}

func DeferredClusterCreation(deferred bool) Instance {
	return newOption("deferred_cluster_creation", deferred)
}