- [Community and Governance Issues](https://github.com/istio/community/issues)

For security vulnerabilities, please don't report a bug (which is public) and instead follow

## Step 2. Update the istioctl/Operator values

If you are modifying the `gateway` chart, you can stop here.
All other charts, however, are exposed by `istioctl` and need to follow the steps below.

The charts in the `manifests` directory are used in istioctl to generate an installation manifest.

  // +optional
  optional string type = 1;

  // Rolling update config params. Present only if type = "RollingUpdate".
  // ---
  // TODO: Update this to follow our convention for oneOf, whatever we decide it
  // to be. Same as Deployment `strategy.rollingUpdate`.
  // See https://github.com/kubernetes/kubernetes/issues/35345
  // +optional

    # This does not apply to gateway pods as they typically need a different
    # set of DNS settings than the normal application pods (e.g., in
    # multicluster scenarios).
    # NOTE: If using templates, follow the pattern in the commented example below.
    #podDNSSearchNamespaces:
    #- global
    #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"

				continue
			}
			if ap := p["appProtocol"]; ap != nil {
				if protocol.Parse(ap.(string)).IsUnsupported() {
					errs = multierror.Append(errs, fmt.Errorf("service %q doesn't follow Istio protocol selection. "+
						"This is not recommended, See "+url.ProtocolSelection, fmt.Sprintf("%s/%s/:", un.GetName(), un.GetNamespace())))
				}
			} else {
				if p["name"] == nil {

| `Traceparent` | (Experimental) This maintains tracing information. Note this is tracing of *connections*, and is not correlated to tracing of user's own HTTP requests. However, this is useful to follow a connection across ztunnels.                                 |

## Traffic routing

Based on the three [redirection](#redirection) paths, the ztunnel has three primary types of traffic it handles.

### Outbound

Some parameters will temporarily exist both the component configuration and legacy Helm APIs - for example, K8s
resources. However, the Istio community recommends using the first API as it is more consistent, is validated,
and will naturally follow the graduation process for APIs while the same parameters in the configuration API are planned
for deprecation.

install istio-gateway istio/gateway`, resources will be named `istio-gateway` and the `selector` labels set to: ```yaml app: istio-gateway istio: gateway # the release name with leading istio- prefix stripped ``` If your existing installation doesn't follow these names, you can override them. For example, if you have resources named `my-custom-gateway` with `selector` labels `foo=bar,istio=ingressgateway`: ```yaml name: my-custom-gateway # Override the name to match existing resources labels: app: ""...

  // The container for which to stream logs. Defaults to only container if there is one container in the pod.
  // +optional
  optional string container = 1;

  // Follow the log stream of the pod. Defaults to false.
  // +optional
  optional bool follow = 2;

  // Return previous terminated container logs. Defaults to false.
  // +optional
  optional bool previous = 3;

  // +optional
  optional string type = 1;

  // Rolling update config params. Present only if type = "RollingUpdate".
  // ---
  // TODO: Update this to follow our convention for oneOf, whatever we decide it
  // to be. Same as Deployment `strategy.rollingUpdate`.
  // See https://github.com/kubernetes/kubernetes/issues/35345
  // +optional