istio.io/rev: default
        kubectl.kubernetes.io/default-container: traffic
        kubectl.kubernetes.io/default-logs-container: traffic
        prometheus.io/path: /stats/prometheus
        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"
        proxy.istio.io/overrides: '{"containers":[{"name":"traffic","image":"fake.docker.io/google-samples/traffic-go-gke:1.0","resources":{},"readinessProbe":{"httpGet":{"port":80}}}]}'

	clientEarlyTrafficLabel       = "c e traffic"
	clientHandshakeTrafficLabel   = "c hs traffic"
	serverHandshakeTrafficLabel   = "s hs traffic"
	clientApplicationTrafficLabel = "c ap traffic"
	serverApplicationTrafficLabel = "s ap traffic"
	exporterLabel                 = "exp master"
	resumptionLabel               = "res master"
	trafficUpdateLabel            = "traffic upd"
)

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
- 48212
releaseNotes:
- |

    service IPs. (We *must* do this in `prerouting`, because the choice of endpoint IP may
    affect whether the packet then gets routed along the input path or the forward path.)

  - We do the DNAT for outbound traffic in `output`: this covers traffic coming from
    host-network processes to all types of service IPs. Regardless of the final
    destination, the traffic will take the "output path". (In the case where a

understand. Under the old waypoint logic all types of traffic, both addressed to a service as well as addressed to a workload, were treated similarly because there wasn't a good way to properly associate a waypoint to a service. With the new attachment this limitation has been resolved. This includes adding a distinction between service addressed and workload addressed traffic. Annotating a service, or service-like kind, will redirect traffic which is service addressed to your waypoint. Likewise...

  annotations:
    # annotations are set by default by istio-cni, will be ignored to avoid validation errors
    sidecar.istio.io/interceptionMode: REDIRECT
    traffic.sidecar.istio.io/excludeInboundPorts: "15020"
    traffic.sidecar.istio.io/includeInboundPorts: '*'
    traffic.sidecar.istio.io/includeOutboundIPRanges: '*'
    gateway.istio.io/controller-version: "5"
spec:
  containers:
    - name: "grafana-test"

  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}

Next steps:
  * Deploy an HTTP Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management

issue:
  - 51377

releaseNotes:
- |

#   tests, but included for completeness.
kind: feature

# area describes the area that this change affects.
# Valid values are:
# - traffic-management
# - security
# - telemetry
# - installation
# - istioctl
# - documentation
area: traffic-management

# issue is a list of GitHub issues resolved in this note.
# If issue is not in the current repo, specify its full URL instead.
issue:
- 50933

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
- |
  **Added** support for outbound traffic Proxy Protocol. By specifying proxyProtocol in a DestinationRule.trafficPolicy,