area: security

releaseNotes:
- |
  **Added** An environment variable METRICS_LOCALHOST_ACCESS_ONLY for disabling 
  metrics endpoint from outside of the pod, to allow only localhost access. User can use set this with command
  `--set values.pilot.env.METRICS_LOCALHOST_ACCESS_ONLY=true` for Control plane and  

package features

import (
	"istio.io/istio/pkg/env"
)

// Define common telemetry feature flags shared among the Istio components.
var (
	MetricsLocalhostAccessOnly = env.Register("METRICS_LOCALHOST_ACCESS_ONLY", false,
		"This will disable metrics endpoint from outside of the pod, allowing only localhost access.").Get()

}

func MetricsLocalhostAccessOnly(proxyMetadata map[string]string) Instance {
	value, ok := proxyMetadata["METRICS_LOCALHOST_ACCESS_ONLY"]
	if ok && value == "true" {
		return newOption("metrics_localhost_access_only", true)
	}
	return newOption("metrics_localhost_access_only", false)
}

func DeferredClusterCreation(deferred bool) Instance {
	return newOption("deferred_cluster_creation", deferred)
}

          }]
        }
      }
      {{ end }}
    ],
    "listeners":[
      {
        "address": {
          "socket_address": {
            "protocol": "TCP",
            {{- if .metrics_localhost_access_only }}
            "address": "{{ .localhost }}",
            {{ else }}
            "address": "{{ .wildcard }}",
            {{ end }}
            "port_value": {{ .envoy_prometheus_port }}
          }