labels:
      app: reviews # Multiple sidecars have the same selector, should generate errors for both
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: dupe-2
  namespace: default
spec:
  workloadSelector:
    labels:
      app: reviews # Multiple sidecars have the same selector, should generate errors for both
  egress:
  - hosts:
    - "./*"

  - '[reference] https://istio.io/latest/docs/reference/config/networking/sidecar/#Sidecar-inbound_connection_pool'

releaseNotes:
  - |

    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: has-conflict-1 # Both Sidecars in this namespace omit workload selector, so they are in conflict
  namespace: ns2
spec:
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: has-conflict-2 # Both Sidecars in this namespace omit workload selector, so they are in conflict

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
   - |
     **Added** the ability to set credentialName based secret configuration
     at sidecars for egress TLS traffic when WorkloadSelector is specified in `DestinationRule`,
     provided the sidecar has permission to list secrets in the namespace where it resides.
docs:

area: installation
upgradeNotes:
- title: Proxy Concurrency changes
  content: |
    Previously, the proxy `concurrency` setting, which configures how many worker threads the proxy runs,
    was inconsistently configured between sidecars and different gateway installation mechanisms.
    This often led to gateways running with concurrency based on the number of physical cores on the host machine,

apiVersion: release-notes/v2
kind: feature
area: installation
releaseNotes:
  - |

apiVersion: release-notes/v2
kind: feature
area: installation
releaseNotes:
- |
  **Updated** default value of the feature flag `ENABLE_LEGACY_FSGROUP_INJECTION` to false.

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
- https://github.com/istio/istio/pull/43152
releaseNotes:
  - |

		// which is used to differentiate between service mesh and legacy traffic.
		//
		// Client sidecar outbound cluster's TLSContext.ALPN must include "istio".
		//
		// Server sidecar filter chain's FilterChainMatch.ApplicationProtocols must
		// include "istio" for the secure traffic, but its TLSContext.ALPN must not
		// include "istio", which would interfere with negotiation of the underlying

releaseNotes:
  - |
    **Added** a new configuration to `ProxyHeaders`, `MetadataExchangeHeaders`. The `IN_MESH` mode ensures `x-envoy-peer-metadata` and `x-envoy-peer-metadata-id`