apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
releaseNotes:
  - |
    **Fixed** auto-passthrough gateways not getting XDS pushes on service updates 

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - https://github.com/istio/istio/issues/44439
releaseNotes:
  - |

apiVersion: release-notes/v2
kind: bug-fix
area: security
releaseNotes:
  - |
    **Fixed** an issue where gateways cannot fetch JWKS from `jwksUri` in RequestAuthentication 

	kind.Secret,
	kind.Telemetry,
	kind.WasmPlugin,
	kind.ProxyConfig,
	kind.DNSName,

	kind.KubernetesGateway,
)

// Map all configs that impact CDS for gateways when `PILOT_FILTER_GATEWAY_CLUSTER_CONFIG = true`.
var pushCdsGatewayConfig = func() sets.Set[kind.Kind] {
	s := sets.New(
		kind.VirtualService,
		kind.Gateway,

		kind.KubernetesGateway,
		kind.HTTPRoute,
		kind.TCPRoute,

)

// Define experimental features here.
var (
	// FilterGatewayClusterConfig controls if a subset of clusters(only those required) should be pushed to gateways
	FilterGatewayClusterConfig = env.Register("PILOT_FILTER_GATEWAY_CLUSTER_CONFIG", false,
		"If enabled, Pilot will send only clusters that referenced in gateway virtual services attached to gateway").Get()

	SendUnhealthyEndpoints = atomic.NewBool(env.Register(

			if got != tt.want {
				t.Fatalf("Got needs push = %v, expected %v", got, tt.want)
			}
		})
	}

	// test for gateway proxy dependencies with PILOT_FILTER_GATEWAY_CLUSTER_CONFIG enabled.
	test.SetForTest(t, &features.FilterGatewayClusterConfig, true)
	test.SetForTest(t, &features.JwksFetchMode, jwt.Envoy)

	const (
		fooSvc       = "foo"
		extensionSvc = "extension"

	delegates map[ConfigKey][]ConfigKey

	// This contains destination hosts of virtual services, keyed by gateway's namespace/name,
	// only used when PILOT_FILTER_GATEWAY_CLUSTER_CONFIG is enabled
	destinationsByGateway map[string]sets.String

	// Map of VS hostname -> referenced hostnames
	referencedDestinations map[string]sets.String
}