apiVersion: release-notes/v2
kind: feature
area: istioctl
issue:
  - 43891
releaseNotes:
  - |

  namespace: istio-system
spec:
  servers:
  - hosts:
    - '*/domain.example'
    port:
      name: default
      number: 34000
      protocol: HTTPS
    tls:
      credentialName: kubernetes-gateway://istio-system/my-cert-http
      mode: SIMPLE
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:
    internal.istio.io/gateway-semantics: gateway

				continue
			}

			secret := ctx.Find(gvk.Secret, resource.NewShortOrFullName(gwNs, cn))
			if secret == nil {
				m := msg.NewReferencedResourceNotFound(r, "credentialName", cn)

				if line, ok := util.ErrorLine(r, fmt.Sprintf(util.CredentialName, i)); ok {
					m.Line = line
				}

				ctx.Report(gvk.Gateway, m)
				continue
			}
			if !isValidSecret(secret) {

spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - foo.org
    port:
      name: https-443-ingress-tls-bar-0
      number: 443
      protocol: HTTPS
    tls:
      credentialName: myingress-cert
      mode: SIMPLE
  - hosts:
    - '*'
    port:
      name: http-80-ingress-tls-bar
      number: 80
      protocol: HTTP

	// Path for selector in Gateway.
	// Required parameters: selector label.
	GatewaySelector = "{.spec.selector.%s}"

	// Path for credentialName.
	// Required parameters: server index.
	CredentialName = "{.spec.servers[%d].tls.credentialName}"

	// Path for Port in ServiceEntry.
	// Required parameters: port index.
	ServiceEntryPort = "{.spec.ports[%d].name}"

apiVersion: release-notes/v2
kind: bug-fix
area: istioctl  
issue:
- 51567
releaseNotes:
- |

	"{.spec.containers[0].image}":                                   1,
	"{.spec.rules[0].from[0].source.namespaces[0]}":                 1,
	"{.spec.selector.test}":                                         1,
	"{.spec.servers[0].tls.credentialName}":                         1,
	"{.networks.test.endpoints[0]}":                                 1,
	"{.spec.trafficPolicy.tls.caCertificates}":                      1,

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
   - |
     **Added** the ability to set credentialName based secret configuration
     at sidecars for egress TLS traffic when WorkloadSelector is specified in `DestinationRule`,
     provided the sidecar has permission to list secrets in the namespace where it resides.
docs:

  namespace: istio-system
spec:
  servers:
  - hosts:
    - cert/cert1.domain.example
    port:
      name: default
      number: 443
      protocol: HTTPS
    tls:
      credentialName: kubernetes-gateway://cert/cert
      mode: SIMPLE
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: HTTPRoute/http.cert

","
":"
"'"
"servers"
"port"
"number"
"protocol"
"name"
"hosts"
"template"
"probe"
"mode"
"tls"
"targetPort"
"httpsRedirect"
"serverCertificate"
"privateKey"
"caCertificates"
"credentialName"
"subjectAltNames"
"verifyCertificateSpki"
"verifyCertificateHash"
"minProtocolVersion"
"maxProtocolVersion"
"cipherSuites"
"trafficPolicy"
"subsets"
"exportTo"
"loadBalancer"
"connectionPool"