- '[reference] https://istio.io/latest/docs/reference/config/networking/sidecar/#Sidecar-inbound_connection_pool'

releaseNotes:
  - |

    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: has-conflict-1 # Both Sidecars in this namespace omit workload selector, so they are in conflict
  namespace: ns2
spec:
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: has-conflict-2 # Both Sidecars in this namespace omit workload selector, so they are in conflict

area: installation
upgradeNotes:
- title: Proxy Concurrency changes
  content: |
    Previously, the proxy `concurrency` setting, which configures how many worker threads the proxy runs,
    was inconsistently configured between sidecars and different gateway installation mechanisms.
    This often led to gateways running with concurrency based on the number of physical cores on the host machine,

apiVersion: release-notes/v2
kind: feature
area: installation
releaseNotes:
  - |

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
- https://github.com/istio/istio/pull/43152
releaseNotes:
  - |

		// which is used to differentiate between service mesh and legacy traffic.
		//
		// Client sidecar outbound cluster's TLSContext.ALPN must include "istio".
		//
		// Server sidecar filter chain's FilterChainMatch.ApplicationProtocols must
		// include "istio" for the secure traffic, but its TLSContext.ALPN must not
		// include "istio", which would interfere with negotiation of the underlying

releaseNotes:
  - |
    **Added** a new configuration to `ProxyHeaders`, `MetadataExchangeHeaders`. The `IN_MESH` mode ensures `x-envoy-peer-metadata` and `x-envoy-peer-metadata-id`

kind: feature
area: security
releaseNotes:
  - |
    **Added** Certificate Revocation List(CRL) support for peer certificate validation based on file paths specified in 

  cniConfFileName: "istio-cni.conf"
  logLevel: info
  provider: "multus"
pilot:
  cni:
    enabled: true
    provider: "multus"
  variant: distroless
  env:
    PILOT_ENABLE_AMBIENT: "true"
    # Allow sidecars/ingress to send/receive HBONE. This is required for interop.
    PILOT_ENABLE_SENDING_HBONE: "true"
    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
platform: openshift
variant: distroless
seLinuxOptions:

			"match at least one pod, and that there aren't multiple sidecar resources that select overlapping pods",
		Inputs: []config.GroupVersionKind{
			gvk.Sidecar,
			gvk.Pod,
			gvk.Namespace,
		},
	}
}

// Analyze implements Analyzer
func (a *SelectorAnalyzer) Analyze(c analysis.Context) {
	podsToSidecars := make(map[resource.FullName][]*resource.Instance)