apiVersion: release-notes/v2
kind: feature
area: traffic-management
issues:
- 35263
releaseNotes:
- |
  **Improved** the default `PILOT_MAX_REQUESTS_PER_SECOND`, which limits the number of **new** XDS connections per second,

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
- 37989
- 37974

releaseNotes:
- |
  **Improved** XDS generation to send less resource when possible, sometimes omitting a response entirely.

apiVersion: release-notes/v2
kind: feature
area: networking
issue: []
releaseNotes:
- |
  **Updated** XDS connections from Envoy will be proxied through the Istio sidecar agent. Doing so allows
  for consolidation of multiple connections from a pod to Istiod into a single connection, in addition to
  other planned future improvements. This feature (and change) is transparent to users and is enabled by default.

	generators[v3.ClusterType] = &xds.CdsGenerator{ConfigGenerator: cg}
	generators[v3.ListenerType] = &xds.LdsGenerator{ConfigGenerator: cg}
	generators[v3.RouteType] = &xds.RdsGenerator{ConfigGenerator: cg}
	generators[v3.EndpointType] = edsGen
	ecdsGen := &xds.EcdsGenerator{ConfigGenerator: cg}
	if env.CredentialsController != nil {
		generators[v3.SecretType] = xds.NewSecretGen(env.CredentialsController, s.Cache, clusterID, env.Mesh())

)

// CentralControlPlaneOptions holds options common to all subcommands
// that invoke Istiod via xDS REST endpoint
type CentralControlPlaneOptions struct {
	// Xds is XDS endpoint, e.g. localhost:15010.
	Xds string

	// XdsPodLabel is a Kubernetes label on the Istiod pods
	XdsPodLabel string

	// XdsPodPort is a port exposing XDS (typically 15010 or 15012)
	XdsPodPort int

	// CertDir is the local directory containing certificates

// See the License for the specific language governing permissions and
// limitations under the License.

package match

import (
	xds "github.com/cncf/xds/go/xds/core/v3"
	matcher "github.com/cncf/xds/go/xds/type/matcher/v3"
	network "github.com/envoyproxy/go-control-plane/envoy/extensions/matching/common_inputs/network/v3"
	wrappers "google.golang.org/protobuf/types/known/wrapperspb"

    row.new('Push Information')
    + row.withPanels([
      panels.timeSeries.xdsPushes(
        'XDS Pushes', queries.xdsPushes, |||
          Rate of XDS push operations, by type. This is incremented on a per-proxy basis.
        |||
      ),
      panels.timeSeries.base(
        'Events', queries.pilotEvents, |||
          Size of each xDS push.
        |||
      ),
      panels.timeSeries.base(

  istioctl ps --xds-address istio.example.com:15012 --cert-dir ~/.istio-certs

  # Retrieve proxy status information via XDS from specific control plane in multi-control plane in-cluster configuration
  # (Select a specific control plane in an in-cluster canary Istio configuration.)
  istioctl ps --xds-label istio.io/rev=default
`,
		Aliases: []string{"ps"},

	v3 "istio.io/istio/pilot/pkg/xds/v3"
	"istio.io/istio/pilot/test/xds"
	"istio.io/istio/pkg/config/constants"
	"istio.io/istio/pkg/test/env"
	"istio.io/istio/pkg/test/util/assert"
	"istio.io/istio/pkg/test/util/retry"
)

// Validates basic xds proxy flow by proxying one CDS requests end to end.
func TestDeltaXdsProxyBasicFlow(t *testing.T) {
	proxy := setupXdsProxy(t)
	f := xds.NewFakeDiscoveryServer(t, xds.FakeOptions{})

	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pilot/test/xds"
	"istio.io/istio/pkg/config/schema/collections"
	"istio.io/istio/pkg/config/schema/gvk"
)

// Creates an in-process discovery server, using the same code as Istiod, but
// backed by an in-memory config and endpoint Store.
func initDS(t *testing.T) *xds.FakeDiscoveryServer {
	ds := xds.NewFakeDiscoveryServer(t, xds.FakeOptions{})
	sd := ds.MemRegistry