"istio.io/istio/pkg/config/analysis/analyzers/authz"
	"istio.io/istio/pkg/config/analysis/analyzers/deployment"
	"istio.io/istio/pkg/config/analysis/analyzers/deprecation"
	"istio.io/istio/pkg/config/analysis/analyzers/destinationrule"
	"istio.io/istio/pkg/config/analysis/analyzers/envoyfilter"
	"istio.io/istio/pkg/config/analysis/analyzers/externalcontrolplane"
	"istio.io/istio/pkg/config/analysis/analyzers/gateway"

issue:
  - 46555
# releaseNotes is a markdown listing of any user facing changes. This will appear in the
# release notes.
releaseNotes:
- |
  **Fixed** attempting to reach multi-network endpoints that are unreachable due to `DestinationRule` TLS mode

apiVersion: release-notes/v2
kind: bug-fix
area: security
releaseNotes:
  - |

    is enabled by default. This means SNI will be set automatically based on the downstream HTTP host/authority header if `DestinationRule` does not explicitly set the same.

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
- |
  **Added** support for outbound traffic Proxy Protocol. By specifying proxyProtocol in a DestinationRule.trafficPolicy,

          weight: 100
      headers:
        request:
          add:
            x-egress-test: "handled-by-egress-gateway"
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: test-egress
  namespace: {{ .From.NamespaceName }}
spec:

		}},
		Ports: []discoveryv1.EndpointPort{{Name: ptr.Of("http"), Port: ptr.Of(int32(80))}},
	}
	dr := config.Config{
		Meta: config.Meta{
			GroupVersionKind: gvk.DestinationRule,
			Name:             "dr",
			Namespace:        "test",
		},
		Spec: &networking.DestinationRule{
			Host: "example.default.svc.cluster.local",
			TrafficPolicy: &networking.TrafficPolicy{Tls: &networking.ClientTLSSettings{

	// Path for Port in ServiceEntry.
	// Required parameters: port index.
	ServiceEntryPort = "{.spec.ports[%d].name}"

	// Path for DestinationRule tls certificate.
	// Required parameters: none.
	DestinationRuleTLSCert = "{.spec.trafficPolicy.tls.caCertificates}"

	// Path for DestinationRule port-level tls certificate.
	// Required parameters: portLevelSettings index.

spec:
  hosts:
  - {{.Destination}}
  http:
  - route:
    - destination:
        host: {{.Destination}}
        subset: my-subset
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: {{.Destination}}
spec:
  host: {{.Destination}}
  subsets:
  - name: my-subset
    labels:
      subset: my-subset`
			t.ConfigIstio().Eval(apps.Namespace.Name(), map[string]string{

      * `VirtualServices` that match on an `ExternalName` service will generally no longer match. Instead, the match should be rewritten to the referenced service.
      * `DestinationRule` can no longer apply to `ExternalName` services. Instead, create rules where the `host` references service.
      
      These changes are off-by-default in this release, but will be on-by-default in the near future.