proxy:
    git: https://github.com/istio/proxy
    auto: deps
  client-go:
    git: https://github.com/istio/client-go
    branch: master
  test-infra:
    git: https://github.com/istio/test-infra
    branch: master
  tools:
    git: https://github.com/istio/tools
    branch: master
  release-builder:
    git: https://github.com/istio/release-builder
    sha: ${BUILDER_SHA}
  ztunnel:

         fi
      fi
    done
    echo "$latest_tag"
}

function get_istio_addons() {
    branches=$(curl --silent "${ISTIO_HELM_CHART}?ref=${1}" | grep '"name": *' | tr -d '", ')
    for branch in ${branches}; do
        REPO=${branch##name:}
        curl --silent "${ISTIO_GITHUB}/${1}/install/kubernetes/helm/istio/charts/${REPO}/values.yaml" -o temp.file
        
        HUB=$(grep -E 'hub: |repository: ' temp.file | awk '{print $2 $4}')

# issue is a list of GitHub issues resolved in this note.
issue:
  - 46555
# releaseNotes is a markdown listing of any user facing changes. This will appear in the
# release notes.
releaseNotes:
- |
  **Fixed** attempting to reach multi-network endpoints that are unreachable due to `DestinationRule` TLS mode

	@rm -fr licenses
	@license-lint --mirror

TMP := $(shell mktemp -d -u)
UPDATE_BRANCH ?= "master"

BUILD_TOOLS_ORG ?= "istio"

update-common:
	@mkdir -p $(TMP)
	@git clone -q --depth 1 --single-branch --branch $(UPDATE_BRANCH) https://github.com/$(BUILD_TOOLS_ORG)/common-files $(TMP)/common-files
	@cd $(TMP)/common-files ; git rev-parse HEAD >files/common/.commonfiles.sha
	@rm -fr common

// reducing the # of rules we need.
//
// BUT netlink lib doesn't support adding things to `list:set` types yet, and current tagged release
// doesn't support creating `list:set` types yet (is in main branch tho).
// So this will actually create 2 underlying ipsets, one for v4 and one for v6
func NewIPSet(name string, v6 bool, deps NetlinkIpsetDeps) (IPSet, error) {
	var err error
	set := IPSet{

		if len(adscon.GetHTTPListeners()) != 3 {
			t.Error("HTTP listeners, expecting 3 got", len(adscon.GetHTTPListeners()), xdstest.MapKeys(adscon.GetHTTPListeners()))
		}

		// s1tcp:2000 outbound, bind=true (to reach other instances of the service)
		// s1:5005 outbound, bind=true
		// :443 - https external, bind=false
		// 10.11.0.1_7070, bind=true -> inbound|2000|s1 - on port 7070, fwd to 37070
		// virtual

		lnode, rnode = nil, nil
		// update in the batch (set key, value to default to the next loadChildren is correct)
		batch[2*iBatch+1] = nil
		batch[2*iBatch+2] = nil
	}

	// Split the keys array so each branch can be updated in parallel
	// Does this require that keys are sorted?  Yes, see Update()
	lkeys, rkeys := s.splitKeys(keys, s.trieHeight-height)
	splitIndex := len(lkeys)

			func() (string, error) { return "instanceTemplate", nil },
			func() (string, error) { return "createdBy", nil },
			map[string]string{},
			map[string]string{},
		},
		{
			"unable to reach compute metadata",
			func() bool { return true },
			func() (string, error) { return "", errors.New("error") },
			func() (string, error) { return "", errors.New("error") },

	// Description: Address for the ingress gateway on the external control plane is not valid
	InvalidExternalControlPlaneConfig = diag.NewMessageType(diag.Warning, "IST0163", "The hostname (%s) that was provided for the webhook (%s) to reach the ingress gateway on the external control plane cluster %s. Traffic may not flow properly.")

	// ExternalControlPlaneAddressIsNotAHostname defines a diag.MessageType for message "ExternalControlPlaneAddressIsNotAHostname".

If it is allowed, we will forward to the target destination.

#### Hairpin

In the case that the destination has a waypoint, that waypoint must have been bypassed to reach the inbound passthrough codepath.
How we handle this is [under discussion](https://docs.google.com/document/d/1uM1c3zzoehiijh1ZpZuJ1-SzuVVupenv8r5yuCaFshs/edit#heading=h.dwbqvwmg6ud3).

### Inbound