event = truncate(event)
			size, err = b.calcSize(event)
		}
		if err != nil {
			errors = append(errors, err)
			impacted = append(impacted, event)
			continue
		}
		if size > b.c.MaxEventSize {
			errors = append(errors, fmt.Errorf("event is too large even after truncating"))
			impacted = append(impacted, event)
			continue
		}

		if len(batch) > 0 && batchSize+size > b.c.MaxBatchSize {

func HandlePluginError(plugin string, err error, impacted ...*auditinternal.Event) {
	// Count the error.
	errorCounter.WithLabelValues(plugin).Add(float64(len(impacted)))

	// Log the audit events to the debug log.
	msg := fmt.Sprintf("Error in audit plugin '%s' affecting %d audit events: %v\nImpacted events:\n",
		plugin, len(impacted), err)
	for _, ev := range impacted {
		msg = msg + EventString(ev) + "\n"
	}

    The two authentication methods output but `istioctl create-remote-secret` (`oidc` and `token`), are not impacted.
    As a result, only users that are creating custom kubeconfig files will be impacted.

    A new environment variable, `PILOT_INSECURE_MULTICLUSTER_KUBECONFIG_OPTIONS`, is added to Istiod to enable the methods that were removed.

metadata:
  name: "default"
spec:
  host: "*"
  trafficPolicy:
    tls:
      mode: {{ .TLSMode }}
---
# Apply a local policy to the system namespace to turn this off
# Otherwise, the eastwest gateway will be impacted
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "eastwest-opt-out"
spec:
  exportTo: [.]
  host: "*"
  trafficPolicy:
    loadBalancer:

metadata:
  name: passthrough
spec:
  host: "*"
  trafficPolicy:
    loadBalancer:
      simple: PASSTHROUGH
---
# Apply a local policy to the system namespace to turn this off
# Otherwise, the eastwest gateway will be impacted
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "eastwest-opt-out"
  annotations:
    test-suite: "beta-mtls-on"
spec:
  exportTo: [.]
  host: "*"
  trafficPolicy:

	// determine if a namespace update could have impacted any Gateways. See namespaceEvent.
	ReferencedNamespaceKeys sets.String

	// ResourceReferences stores all resources referenced by gateway-api resources. This allows us to quickly
	// determine if a resource update could have impacted any Gateways.
	// key: referenced resources(e.g. secrets), value: gateway-api resources(e.g. gateways)

      This default setting has been removed; users will need to explicitly configure where to send traces moving forward.

      `istioctl x precheck --from-version=1.21` can automatically detect if you may be impacted by this change.

      If you previously had tracing enabled implicitly, you can enable it by doing one of:
      * Installing with `--set compatibilityVersion=1.21`.

    Found managed gateway: default/gateway
    {{< /text >}}

    If you see "Found managed gateway", you may be impacted by this change.

    Prior to Istio 1.18, the managed gateway worked by creating a minimal Deployment configuration which
    was fully populated at runtime with Pod injection. To upgrade gateways, users would restart the Pods

    testClassesDirs = sourceSets.test.get().output.classesDirs
    // All test should have this project's "test" source set on their classpath
    classpath += sourceSets.test.get().output

    // These tests should not be impacted by the predictive selection
    extensions.findByType<DevelocityTestConfiguration>()?.apply {
        predictiveTestSelection.enabled = false
    }

    // These tests should always run
    outputs.upToDateWhen { false }

    val latch = CountDownLatch(1)

    override fun runOnce(): Long {
      latch.countDown()
      return -1L
    }
  }

  /** Adds [task] to run in [delayNanos]. Returns true if the coordinator is impacted. */
  internal fun scheduleAndDecide(
    task: Task,
    delayNanos: Long,
    recurrence: Boolean,
  ): Boolean {
    task.initQueue(this)

    val now = taskRunner.backend.nanoTime()