apiVersion: release-notes/v2
kind: feature
area: istioctl
issue:
  - 23892
releaseNotes:
- |
  **Added** `istioctl x injector list` command to show which namespaces have Istio sidecar injection

apiVersion: release-notes/v2
kind: bug-fix
area: telemetry
issue: [46977]
releaseNotes:
  - |

	// First, check if we're root separately from the other preflight checks and fail fast
	if err := preflight.RunRootCheckOnly(data.IgnorePreflightErrors()); err != nil {
		return err
	}

	// If this is a control-plane node, pull the basic images
	if data.IsControlPlaneNode() {
		// Update the InitConfiguration used for RunPullImagesCheck with ImagePullPolicy and ImagePullSerial
		// that come from UpgradeNodeConfiguration.

releaseNotes:
  - |-
    **Added** support for istio CA to handle node authorization for CSRs with impersonate identity from remote clusters.

func NewKubeConfigPhase() workflow.Phase {
	return workflow.Phase{
		Name:  "kubeconfig",
		Short: "Generate all kubeconfig files necessary to establish the control plane and the admin kubeconfig file",
		Long:  cmdutil.MacroCommandLongDescription,
		Phases: []workflow.Phase{
			{
				Name:           "all",

// limitations under the License.

package xds

import (
	"fmt"

	core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
	status "github.com/envoyproxy/go-control-plane/envoy/service/status/v3"

	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pilot/pkg/util/protoconv"
	v3 "istio.io/istio/pilot/pkg/xds/v3"
)

		"A list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.",
	)
}

// AddControlPlanExtraArgsFlags adds the ExtraArgs flags for control plane components
func AddControlPlanExtraArgsFlags(fs *pflag.FlagSet, apiServerExtraArgs, controllerManagerExtraArgs, schedulerExtraArgs *map[string]string) {
	// TODO: https://github.com/kubernetes/kubeadm/issues/1601

# The remote profile is used to configure a mesh cluster without a locally deployed control plane.
# Only the injector mutating webhook configuration is installed.
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    base:
      enabled: false
    pilot:
      enabled: false
    ingressGateways:
    - name: istio-ingressgateway
      enabled: false
    istiodRemote:

apiVersion: release-notes/v2
kind: feature
area: traffic-management

releaseNotes:
- |
  **Updated** the control plane to read `EndpointSlice` insead of `Endpoints`
  for service discovery for Kubernetes 1.21 or later. To switch back to the old

Install for a remote cluster using an external control plane.

The templates in this directory are copies of base and istio-discovery templates.