apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
  - 27696

releaseNotes:
- |
  **Added** `holdApplicationUntilProxyStarts` can now be set in ProxyConfig, 
  allowing it to be set at the pod level. Should not be used in conjunction with

		// At high QPS (>250 QPS) we will log the same amount as we will log due to exceeding buffer size, rather
		// than the flush interval.
		"--file-flush-interval-msec", "1000",
		"--disable-hot-restart", // We don't use it, so disable it to simplify Envoy's logic
		"--allow-unknown-static-fields",
	}

	startupArgs = append(startupArgs, e.extraArgs...)

	if overrideFname != "" {
		s, err := readBootstrapToJSON(overrideFname)

releaseNotes:
  - |
    **Fixed** an issue where istiod does not retry resolving east-west gateway hostnames on failure.
  - |

The Ext Authz server supports authorization check request using either HTTP (port 8000) or gRPC v2/v3 (port 9000) API and
will allow the request if it includes the header `x-ext-authz: allow` or if the service account of the source workload is `a`.
Note that `a` is just a default value for testing. It can be changed with the flag `-allow_service_account` when running the ext authz server.

## Usage

1. Deploy the Ext Authz service in a dedicated pod:

apiVersion: v2
name: gateway
description: Helm chart for deploying Istio gateways
type: application

# This version is never actually shipped. istio/release-builder will replace it at build-time
# with the appropriate version
version: 1.0.0
appVersion: 1.0.0

sources:
- https://github.com/istio/istio
icon: https://istio.io/latest/favicons/android-192x192.png
keywords:
- istio

  to display memory. This metric only counts memory that *cannot be reclaimed* by the kernel even under memory pressure,
  and therefore more relevant for tracking. It is also consistent with `kubectl top`. The reported values are lower than

See the License for the specific language governing permissions and
limitations under the License.
*/


// This file was autogenerated by go-to-protobuf. Do not edit it manually!

syntax = "proto2";

package k8s.io.api.coordination.v1;

import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
import "k8s.io/apimachinery/pkg/runtime/generated.proto";

    Previously, the given wasm filter itself was passed to Envoy in the case, but it may cause the errors because some fields of Wasm configuration are optional in Istio, but not in Envoy....

metadata:
  name: hello
spec:
  selector:
    matchLabels:
      app: hello
  template:
    metadata:
      annotations:
        # There is no real purpose of setting this multiple times; this just makes sure it doesn't blow
        # up if a user does happen to configure this
        inject.istio.io/templates: sidecar,sidecar,sidecar
      labels:
        app: hello
    spec:
      containers:
      - name: hello

	// Go through all cluster endpoints and add those with the same network as the sidecar
	// to the result. Also count the number of endpoints per each remote network while
	// iterating so that it can be used as the weight for the gateway endpoint
	for _, ep := range endpoints {
		lbEndpoints := &LocalityEndpoints{
			llbEndpoints: endpoint.LocalityLbEndpoints{
				Locality: ep.llbEndpoints.Locality,