#   tests, but included for completeness.
kind: feature

# area describes the area that this change affects.
# Valid values are:
# - traffic-management
# - security
# - telemetry
# - installation
# - istioctl
# - documentation
area: traffic-management

# issue is a list of GitHub issues resolved in this note.
# If issue is not in the current repo, specify its full URL instead.
issue:
  - 48818

        traffic.sidecar.istio.io/excludeInboundPorts: "15020"
        traffic.sidecar.istio.io/includeInboundPorts: '*'
        traffic.sidecar.istio.io/includeOutboundIPRanges: '*'
      creationTimestamp: null
      labels:
        app: hello
        security.istio.io/tlsMode: istio

	flag.BindEnv(fs, constants.RedirectDNS, "", "Enable capture of dns traffic by istio-agent.", &cfg.RedirectDNS)
	// Allow binding to a different var, for consistency with other components
	flag.AdditionalEnv(fs, constants.RedirectDNS, "ISTIO_META_DNS_CAPTURE")

	flag.BindEnv(fs, constants.CaptureAllDNS, "",
		"Instead of only capturing DNS traffic to DNS server IP, capture all DNS traffic at port 53. This setting is only effective when redirect dns is enabled.",

apiVersion: release-notes/v2
kind: promotion
area: traffic-management
issue:
  - 47949
releaseNotes:
  - |
    **Enabled** [Delta xDS](https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol#incremental-xds) by default. See upgrade notes for more information.
upgradeNotes:
  - title: Delta xDS on by default
    content: |
      In previous versions, Istio used the "State of the world" xDS protocol to configure Envoy.

## Creating East-West Gateway

All configurations rely on a separate gateway deployment that is dedicated to
east-west traffic. This is done to avoid having east-west traffic flooding
the default north-south ingress gateway.

Run the following command to deploy the east-west gateway to a primary cluster:

```bash
export MESH=mesh1
export CLUSTER=cluster1

//
//   - The service's usable Cluster-traffic-policy endpoints (taking topology into account, if
//     relevant). This will be nil if the service does not ever use Cluster traffic policy.
//
//   - The service's usable Local-traffic-policy endpoints (including terminating endpoints, if
//     relevant). This will be nil if the service does not ever use Local traffic policy.
//

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
- |

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
- |

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
- |

	Identifier string
	Comment    string
}

var (
	JumpInbound             = Command{"JumpInbound", "direct all traffic through ISTIO_INBOUND chain"}
	JumpOutbound            = Command{"JumpOutbound", "direct all traffic through ISTIO_OUTBOUND chain"}
	ExcludeInboundPort      = Command{"ExcludeInboundPort", "exclude inbound port from capture"}