apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
releaseNotes:
  - |

// for removed fields are not re-used. DO NOT remove this test for any reason, this ensures that tombstoned
// protobuf field numbers are not accidentally reused by other fields.
func Test_NetworkPolicyRemovedFieldProtobufNumberReservation(t *testing.T) {
	obj := reflect.ValueOf(NetworkPolicy{}).Type()
	for i := 0; i < obj.NumField(); i++ {
		f := obj.Field(i)

You will also want to update the sample YAMLs

## Building official images

Set `HUB=docker.io/istio` for official image builds.

// for removed fields are not re-used. DO NOT remove this test for any reason, this ensures that tombstoned
// protobuf field numbers are not accidentally reused by other fields.
func Test_NetworkPolicyRemovedFieldProtobufNumberReservation(t *testing.T) {
	obj := reflect.ValueOf(NetworkPolicy{}).Type()
	for i := 0; i < obj.NumField(); i++ {
		f := obj.Field(i)

        buildFile << """
            // prevent assembly and c compile tasks from running in parallel
            // this is because we don't want the c compile tasks to accidentally use
            // the decorated tool provider we set up for testing the parallelism
            tasks.withType(CCompile) { mustRunAfter tasks.withType(Assemble) }
        """

        when:

      * Ports not declared as `HTTP` would match *all* traffic on that port, making it easy to accidentally send all traffic on a port to the wrong place.
      * Because the destination DNS name is treated as opaque, we cannot apply Istio policies to it as expected. For example, if I point

	"internal/stringslite"
	"unsafe"
)

// clone makes a copy of value, and may update string values found in value
// with a cloned version of those strings. The purpose of explicitly cloning
// strings is to avoid accidentally giving a large string a long lifetime.
//
// Note that this will clone strings in structs and arrays found in value,
// and will clone value if it itself is a string. It will not, however, clone

        buildFile << """
            // prevent windows resource and cpp compile tasks from running in parallel
            // this is because we don't want the cpp compile tasks to accidentally use 
            // the decorated tool provider we set up for testing the parallelism
            tasks.withType(CppCompile) { mustRunAfter tasks.withType(WindowsResourceCompile) }
        """

        when:

set -o errexit
set -o nounset
set -o pipefail

KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
source "${KUBE_ROOT}/hack/lib/init.sh"

kube::golang::setup_env

# Nuke old files so we don't accidentally carry stuff forward.
rm -f staging/src/k8s.io/api/testdata/HEAD/*.{yaml,json,pb}
rm -f staging/src/k8s.io/apiextensions-apiserver/pkg/apis/testdata/HEAD/*.{yaml,json,pb}

[GOOS:windows] [!exec:cmd.exe] go clean -modcache
! exists $GOPATH/pkg/mod

# The directories in the module cache should by default be unwritable,
# so that tests and tools will not accidentally add extraneous files to them.
# Windows does not respect FILE_ATTRIBUTE_READONLY on directories, according
# to MSDN, so there we disable testing whether the directory itself is
# unwritable.
go get rsc.io/quote@latest