install.istio.io/v1alpha1 kind: IstioOperator spec: components: base: enabled: false pilot: enabled: false ingressGateways: - name: istio-ingressgateway enabled: false istiodRemote: enabled: true values: profile: remote manifests/profiles/preview.yaml # The preview profile contains features that are experimental. # This is intended to explore new features coming to Istio. # Stability, security, and performance are not guaranteed - use at your own risk. apiVersion: install.istio.io/v1alpha1 kind: IstioOperator...

           "typed_config": {
            "@type": "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
            "stat_prefix": "outbound|15021||reviews-istio-waypoint.ambient.svc.cluster.local",
            "cluster": "outbound|15021||reviews-istio-waypoint.ambient.svc.cluster.local"
           }
          }
         ]
        }
       ],
       "traffic_direction": "OUTBOUND",

// rest : 2013-12-19 Punto 2012 Sociedad Anonima Promotora de Inversion de Capital Variable
rest

// restaurant : 2014-07-03 Binky Moon, LLC
restaurant

// review : 2014-11-20 dot Review Limited
review

// reviews : 2013-09-13 Dog Beach, LLC
reviews

// rexroth : 2015-06-18 Robert Bosch GMBH
rexroth

// rich : 2013-11-21 iRegistry GmbH
rich

**How can I mitigate this prior to installing 1.5.5?**

1. Export existing PodSecurityPolicy objects:
  * `kubectl get podsecuritypolicies -o yaml > psp.yaml`
2. Review and delete any PodSecurityPolicy objects you do not want all pod-creating users to be able to use (NOTE: Privileged users that were making use of those policies will also lose access to those policies). For example:

- **Security**
  - Increased pod-level security granularity (eg: Container Image Policies, AppArmor and `sysctl` support)
  - Increased cluster-level security granularity (eg: Access Review API)

## Features