apiVersion: release-notes/v2
kind: feature
area: installation
issue:
  - 30013

releaseNotes:
- |
  **Improved** the sidecar injector to better utilize pod labels to determine if injection is required.
upgradeNotes:
- title: Sidecar Injector Changes
  content: |
    The logic to determine if a pod requires sideacr injection or not has been updated to make use of

)

// Analyzer checks conditions related to Istio sidecar injection.
type Analyzer struct{}

var _ analysis.Analyzer = &Analyzer{}

// We assume that enablement is via an istio-injection=enabled or istio.io/rev namespace label
// In theory, there can be alternatives using Mutatingwebhookconfiguration, but they're very uncommon
// See https://istio.io/docs/ops/troubleshooting/injection/ for more info.
var (

# Namespace 'enabled-namespace' has istio injection enabled, so will be enforced.
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: enabled-namespace
---
# Details-v1-pod-old is out of date and should get a warning.
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: details
  name: details-v1-pod-old
  namespace: enabled-namespace
spec:
  containers:

# Broken config in a yaml config file
#

# Namespace is explicitly enabled
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio-injection: enabled
  name: default
---
# Namespace doesn't have the injection label, but is labeled for ambient
apiVersion: v1
kind: Namespace
metadata:
  labels:
    istio.io/dataplane-mode: ambient
  name: ambient
---
# Namespace is explicitly disabled, Should not generate warning!

        path: /inject
        port: 443
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: rev.namespace.sidecar-injector.istio.io
    namespaceSelector:
      matchExpressions:
        - key: istio.io/rev
          operator: In
          values:
            - default
        - key: istio-injection
          operator: DoesNotExist
    objectSelector:
      matchExpressions:
        - key: sidecar.istio.io/inject

	"istio.io/istio/pkg/config/schema/gvk"
	"istio.io/istio/pkg/slices"
)

// ImageAnalyzer checks the image of auto-injection configured with the running proxies on pods.
type ImageAnalyzer struct{}

var _ analysis.Analyzer = &ImageAnalyzer{}

// injectionConfigMap is a snippet of the sidecar injection ConfigMap
type injectionConfigMap struct {
	Global global `json:"global"`
}

type global struct {

        path: /inject
        port: 443
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: rev.namespace.sidecar-injector.istio.io
    namespaceSelector:
      matchExpressions:
        - key: istio.io/rev
          operator: In
          values:
            - 1-16
        - key: istio-injection
          operator: DoesNotExist
    objectSelector:
      matchExpressions:
        - key: sidecar.istio.io/inject

# Injected namespace.
apiVersion: v1
kind: Namespace
metadata:
  name: injected
  labels:
    istio-injection: enabled
---
# Non-injected namespace.
apiVersion: v1
kind: Namespace
metadata:
  name: non-injected
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
  name: istio-sidecar-injector
webhooks:
  - admissionReviewVersions:
      - v1beta1
    clientConfig:

apiVersion: release-notes/v2
kind: feature
area: istioctl
issue:
  - 23892
releaseNotes:
- |
  **Added** `istioctl x injector list` command to show which namespaces have Istio sidecar injection

		name     string
		pod      *corev1.Pod
		expected bool
	}{
		{
			name: "Injection disabled by annotation",
			pod: &corev1.Pod{
				ObjectMeta: metav1.ObjectMeta{
					Annotations: map[string]string{
						annotation.SidecarInject.Name: "false",
					},
				},
			},
			expected: true,
		},
		{
			name: "Injection enabled by annotation",
			pod: &corev1.Pod{
				ObjectMeta: metav1.ObjectMeta{