prevent traffic coming from out-of-mesh locations from potential polluting the `destination_service` dimension in
  metrics with junk data (and exploding metrics cardinality). With this change, it is possible that users relying on
  host headers for labeling the destination service for inbound traffic from out-of-mesh workloads will see that traffic

    // (We're relying on callers to call this method only with an edge that's in the graph.)
    return requireNonNull(outEdgeMap.get(edge));
  }

  @Override
  public N removeInEdge(E edge, boolean isSelfLoop) {
    if (isSelfLoop) {
      checkNonNegative(--selfLoopCount);
    }
    N previousNode = inEdgeMap.remove(edge);

  public Set<E> inEdges() {
    return incidentEdges();
  }

  @Override
  public Set<E> outEdges() {
    return incidentEdges();
  }

  @Override
  public N adjacentNode(E edge) {
    // We're relying on callers to call this method only with an edge that's in the graph.
    return requireNonNull(incidentEdgeMap.get(edge));
  }

  @Override
  @CheckForNull
  public N removeInEdge(E edge, boolean isSelfLoop) {

    // (We're relying on callers to call this method only with an edge that's in the graph.)
    return requireNonNull(outEdgeMap.get(edge));
  }

  @Override
  public N removeInEdge(E edge, boolean isSelfLoop) {
    if (isSelfLoop) {
      checkNonNegative(--selfLoopCount);
    }
    N previousNode = inEdgeMap.remove(edge);

  public Set<E> inEdges() {
    return incidentEdges();
  }

  @Override
  public Set<E> outEdges() {
    return incidentEdges();
  }

  @Override
  public N adjacentNode(E edge) {
    // We're relying on callers to call this method only with an edge that's in the graph.
    return requireNonNull(incidentEdgeMap.get(edge));
  }

  @Override
  @CheckForNull
  public N removeInEdge(E edge, boolean isSelfLoop) {

kind: bug-fix
area: installation
issue:
  - 29364
releaseNotes:
  - |
    **Fixed** Newer control plane installations were removing permissions for `rbac.istio.io` from `istiod`, causing

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - 47341
releaseNotes:
- |

kind: ServiceEntry
metadata:
  name: valid-service-entry
spec:
  hosts:
  - eu.bookinfo.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  endpoints:
  # Rather than relying on an external host that might become unreachable (causing test failures)
  # we can mock the external endpoint using service t which has no sidecar.
  - address: t.istio-system.svc.cluster.local # TODO: this is brittle
    ports:

apiVersion: release-notes/v2
kind: bug-fix
area: istioctl
releaseNotes:
- |

kind: ServiceEntry
metadata:
  name: valid-service-entry
spec:
  hosts:
  - eu.bookinfo.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  endpoints:
  # Rather than relying on an external host that might become unreachable (causing test failures)
  # we can mock the external endpoint using service t which has no sidecar.
  - address: t.istio-system.svc.cluster.local # TODO: this is brittle
    ports: