ECDS NAME                                                     TYPE
istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP      
istio.io/telemetry/stats/prometheus/sidecar/Inbound/TCP       
istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP     
istio.io/telemetry/stats/prometheus/sidecar/Outbound/TCP      
default.display-metadata                                      envoy.extensions.filters.http.wasm.v3.Wasm

				cfg.OutboundIPRangesInclude = "10.0.0.0/8"
			},
		},
		{
			"inbound-ports-include",
			func(cfg *config.Config) {
				cfg.InboundPortsInclude = "32000,31000"
			},
		},
		{
			"inbound-ports-wildcard",
			func(cfg *config.Config) {
				cfg.InboundPortsInclude = "*"
			},
		},
		{
			"inbound-ports-tproxy",
			func(cfg *config.Config) {
				cfg.InboundPortsInclude = "32000,31000"

	flag.BindEnv(fs, constants.LocalExcludePorts, "d",
		"Comma separated list of inbound ports to be excluded from redirection to Envoy (optional). "+
			"Only applies when all inbound traffic (i.e. \"*\") is being redirected.",
		&cfg.InboundPortsExclude)

	flag.BindEnv(fs, constants.ExcludeInterfaces, "c",
		"Comma separated list of NIC (optional). Neither inbound nor outbound traffic will be captured.",
		&cfg.ExcludeInterfaces)

                "name": "istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP"
            },
            "lastUpdated": "2023-12-23T13:46:00.701Z"
        },
        {
            "ecdsFilter": {
                "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                "name": "istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP"
            },
            "lastUpdated": "2023-12-23T13:46:00.708Z"

      
      The ordering is now consistent across inbound, outbound and gateway proxy modes, as well as HTTP and TCP protocols:
      
      * Metadata Exchange
      * CUSTOM Authz
      * WASM Authn
      * Authn
      * WASM Authz
      * Authz
      * WASM Stats
      * Stats
      * WASM unspecified
      
      This changes the following areas:
      * Inbound TCP filters now place Metadata Exchange before Authn.

                    },
                    "last_updated": "2023-12-23T13:46:00.701Z"
                },
                {
                    "ecds_filter": {
                        "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                        "name": "istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP"
                    },

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - 31095
releaseNotes:
  - |

    '@type': type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig
    name: istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP
  lastUpdated: "2023-12-23T13:46:00.701Z"
- ecdsFilter:
    '@type': type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig
    name: istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP
  lastUpdated: "2023-12-23T13:46:00.708Z"
- ecdsFilter:

	Connections WorkloadConnections `json:"connections,omitempty"`
	Info        WorkloadInfo        `json:"info"`
}

type WorkloadConnections struct {
	Inbound  []InboundConnection  `json:"inbound"`
	Outbound []OutboundConnection `json:"outbound"`
}

type WorkloadInfo struct {
	Name           string `json:"name"`
	Namespace      string `json:"namespace"`
	TrustDomain    string `json:"trustDomain"`

  # process should be kept alive after an occasional reload.
  drainDuration: 2s
  #
  # The mode used to redirect inbound connections to Envoy. This setting
  # has no effect on outbound traffic: iptables REDIRECT is always used for
  # outbound connections.
  # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
  # The "REDIRECT" mode loses source addresses during redirection.