apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
releaseNotes:
  - |

You will also want to update the sample YAMLs

## Building official images

Set `HUB=docker.io/istio` for official image builds.

        buildFile << """
            // prevent assembly and c compile tasks from running in parallel
            // this is because we don't want the c compile tasks to accidentally use
            // the decorated tool provider we set up for testing the parallelism
            tasks.withType(CCompile) { mustRunAfter tasks.withType(Assemble) }
        """

        when:

      * Ports not declared as `HTTP` would match *all* traffic on that port, making it easy to accidentally send all traffic on a port to the wrong place.
      * Because the destination DNS name is treated as opaque, we cannot apply Istio policies to it as expected. For example, if I point

	"internal/stringslite"
	"unsafe"
)

// clone makes a copy of value, and may update string values found in value
// with a cloned version of those strings. The purpose of explicitly cloning
// strings is to avoid accidentally giving a large string a long lifetime.
//
// Note that this will clone strings in structs and arrays found in value,
// and will clone value if it itself is a string. It will not, however, clone

        buildFile << """
            // prevent windows resource and cpp compile tasks from running in parallel
            // this is because we don't want the cpp compile tasks to accidentally use 
            // the decorated tool provider we set up for testing the parallelism
            tasks.withType(CppCompile) { mustRunAfter tasks.withType(WindowsResourceCompile) }
        """

        when:

set -o errexit
set -o nounset
set -o pipefail

KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
source "${KUBE_ROOT}/hack/lib/init.sh"

kube::golang::setup_env

# Nuke old files so we don't accidentally carry stuff forward.
rm -f staging/src/k8s.io/api/testdata/HEAD/*.{yaml,json,pb}
rm -f staging/src/k8s.io/apiextensions-apiserver/pkg/apis/testdata/HEAD/*.{yaml,json,pb}

import java.nio.file.LinkOption;
import java.nio.file.attribute.BasicFileAttributes;

/**
 * Represents the Symlink facilities available on JDK 7 or better on Windows.
 * <p>
 * This subclass is used so that we don't accidentally start creating Symlinks
 * on Windows where it is often not safe to assume that a normal user will
 * have permission to use them.
 */
public class WindowsJdk7Symlink extends Jdk7Symlink {

			continue
		}

		// Remove resources that serving kinds that are removed.
		// We do this here so that we don't accidentally serve versions without resources or openapi information that for kinds we don't serve.
		// This is a spot above the construction of individual storage handlers so that no sig accidentally forgets to check.

# Note: this file gets sourced in utilities/setup.sh, which has "set -u"
# (error on undefined variables). This ensures that (a) every TFCI variable
# has an explicit default value, and (b) no script can accidentally use a
# variable that doesn't exist. Please keep this list in alphabetical order.
#
# Find usage in scripts with e.g.:
#   cd ci/official
#   ls *.sh utilities/*.sh | xargs grep -H --color=always TFCI_ARG_HERE