apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
releaseNotes:
  - |

kind: bug-fix
area: security
issue:
- 29856
releaseNotes:
- |
  **Fixed** an issue causing a Secret named `<secret>-cacert` to have lower precedence than a Secret named `<secret>` for Gateway Mutual TLS.

// for removed fields are not re-used. DO NOT remove this test for any reason, this ensures that tombstoned
// protobuf field numbers are not accidentally reused by other fields.
func Test_NetworkPolicyRemovedFieldProtobufNumberReservation(t *testing.T) {
	obj := reflect.ValueOf(NetworkPolicy{}).Type()
	for i := 0; i < obj.NumField(); i++ {
		f := obj.Field(i)

You will also want to update the sample YAMLs

## Building official images

Set `HUB=docker.io/istio` for official image builds.

// for removed fields are not re-used. DO NOT remove this test for any reason, this ensures that tombstoned
// protobuf field numbers are not accidentally reused by other fields.
func Test_ServiceSpecRemovedFieldProtobufNumberReservation(t *testing.T) {
	obj := reflect.ValueOf(ServiceSpec{}).Type()
	for i := 0; i < obj.NumField(); i++ {
		f := obj.Field(i)

// for removed fields are not re-used. DO NOT remove this test for any reason, this ensures that tombstoned
// protobuf field numbers are not accidentally reused by other fields.
func Test_NetworkPolicyRemovedFieldProtobufNumberReservation(t *testing.T) {
	obj := reflect.ValueOf(NetworkPolicy{}).Type()
	for i := 0; i < obj.NumField(); i++ {
		f := obj.Field(i)

        buildFile << """
            // prevent assembly and c compile tasks from running in parallel
            // this is because we don't want the c compile tasks to accidentally use
            // the decorated tool provider we set up for testing the parallelism
            tasks.withType(CCompile) { mustRunAfter tasks.withType(Assemble) }
        """

        when:

      * Ports not declared as `HTTP` would match *all* traffic on that port, making it easy to accidentally send all traffic on a port to the wrong place.
      * Because the destination DNS name is treated as opaque, we cannot apply Istio policies to it as expected. For example, if I point

	"internal/stringslite"
	"unsafe"
)

// clone makes a copy of value, and may update string values found in value
// with a cloned version of those strings. The purpose of explicitly cloning
// strings is to avoid accidentally giving a large string a long lifetime.
//
// Note that this will clone strings in structs and arrays found in value,
// and will clone value if it itself is a string. It will not, however, clone

# Regression test for https://golang.org/issue/48511:
# requirement minimization was accidentally replacing previous
# versions of the main module, causing dependencies to be
# spuriously dropping during requirement minimization and
# leading to an infinite loop.

cp go.mod go.mod.orig
go mod tidy
cmp go.mod go.mod.orig

go get -u=patch ./...
cmp go.mod go.mod.want

-- go.mod --
module example.net/m

go 1.16

replace (