John Howard <******@****.***> 1682617769 -0700

}

var _ model.XdsResourceGenerator = &LdsGenerator{}

// Map of all configs that do not impact LDS
var skippedLdsConfigs = map[model.NodeType]sets.Set[kind.Kind]{
	model.Router: sets.New(
		// for autopassthrough gateways, we build filterchains per-dr subset
		kind.WorkloadGroup,
		kind.WorkloadEntry,
		kind.Secret,
		kind.ProxyConfig,
		kind.DNSName,
	),
	model.SidecarProxy: sets.New(
		kind.Gateway,

	if event == model.EventDelete {
		gatewaysChanged = len(previousGateways) > 0
		delete(n.gatewaysFromResource, gw.UID)
		return nil
	}

	autoPassthrough := func(l v1beta1.Listener) bool {
		return kube.IsAutoPassthrough(gw.GetLabels(), l)
	}

	base := model.NetworkGateway{
		Network: network.ID(gw.GetLabels()[label.TopologyNetwork.Name]),
		Cluster: n.clusterID,
	}

	verifiedCertificateReferences := sets.New[string]()
	http3AdvertisingRoutes := sets.New[string]()
	tlsHostsByPort := map[uint32]map[string]string{} // port -> host/bind map
	autoPassthrough := false

	log.Debugf("MergeGateways: merging %d gateways", len(gateways))
	for _, gwAndInstance := range gateways {
		gatewayConfig := gwAndInstance.gateway

	RunCase("sniffing", protocolSniffingCases)
	RunCase("selfcall", selfCallsCases)
	RunSkipAmbient("serverfirst", serverFirstTestCases, "Expected success cases time out")
	RunCase("gateway", gatewayCases)
	RunCase("autopassthrough", autoPassthroughCases)
	RunSkipAmbient("loop", trafficLoopCases, "does not error (waypoint -> waypoint)")
	RunSkipAmbient("tls-origination", tlsOriginationCases, "not workload agnostic")

upgradeNotes:
- title: "`AUTO_PASSTHROUGH` Gateway mode"
  content: |
    Previously, gateways were configured with multiple Envoy `cluster` configurations for each Service in the cluster, even those

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - 34944

releaseNotes:
- |

metadata:
  name: cross-network-gateway
spec:
  selector:
    istio: eastwestgateway
  servers:
    - port:
        number: 15443
        name: tls
        protocol: TLS
      tls:
        mode: AUTO_PASSTHROUGH
      hosts:

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
- 33127
releaseNotes:
- |

  namespace: istio-system
spec:
  servers:
  - hosts:
    - istio-system/*.local
    port:
      name: default
      number: 35443
      protocol: TLS
    tls:
      mode: AUTO_PASSTHROUGH
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: TLSRoute/eastwestgateway-grpc.istio-system
    internal.istio.io/route-semantics: gateway