apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
  - 39110
releaseNotes:
  - |

apiVersion: release-notes/v2
kind: bug-fix
area: installation
releaseNotes:
- |

Helpful references:

* link:https://github.com/apache/ant/blob/master/src/main/org/apache/tools/ant/util/ProxySetup.java[ProxySetup.java in the Ant codebase^]
* link:https://docs.oracle.com/javase/8/docs/technotes/guides/net/proxies.html[JDK 8 Proxies^]

=== NTLM Authentication

If your proxy requires NTLM authentication, you may need to provide the authentication domain as well as the username and password.

          |||
        ),
      ],


      workloadManager: [
        self.query(
          'Active Proxies ({{pod}})',
          |||
            sum by (pod) (workload_manager_active_proxy_count{%(podLabels)s})
          |||
        ),
        self.query(
          'Pending Proxies ({{pod}})',
          |||
            sum by (pod) (workload_manager_pending_proxy_count{%(podLabels)s})
          |||

releaseNotes:
  - |

releaseNotes:
- |
  **Improved** request JWT authentication to use the upstream Envoy JWT filter
  instead of the custom Istio Proxy filter. Because the new upstream JWT filter
  capabilities are needed, the feature is gated for the proxies that support
  them. Note that a custom Envoy or Wasm filter that used `istio_authn` dynamic
  metadata key  needs to be updated to use `envoy.filters.http.jwt_authn`

			setUpUdsOK := true
			if s.grpcWorkloadListener == nil {
				if s.grpcWorkloadListener, err = uds.NewListener(security.WorkloadIdentitySocketPath); err != nil {
					sdsServiceLog.Errorf("SDS grpc server for workload proxies failed to set up UDS: %v", err)
					setUpUdsOK = false
				}
			}
			if s.grpcWorkloadListener != nil {

import java.lang.annotation.Target;

/**
 * Annotation used to mark TAPI model interfaces. On the client side such interfaces
 * are instantiated via Java dynamic proxies, and we use this annotation when we want
 * these proxies to have richer behaviour than just implementing the base interface.
 * <p>
 * For example. Let's say the TAPI model interface is {@code Animal}, but which also

This repository migrated to modules in v2.0.1 after v2.0.0 was already tagged.
All versions require rsc.io/quote so we can test downgrades.

v2.0.0 is technically part of example.com/latemigrate as v2.0.0+incompatible.
Proxies may serve it as part of the version list for example.com/latemigrate/v2.
'go get' must be able to ignore these versions.

-- .mod --
module example.com/latemigrate
-- .info --

 */
@GwtIncompatible
@J2ktIncompatible
@ElementTypesAreNonnullByDefault
abstract class DummyProxy {

  /**
   * Returns a new proxy for {@code interfaceType}. Proxies of the same interface are equal to each
   * other if the {@link DummyProxy} instance that created the proxies are equal.
   */
  final <T> T newProxy(TypeToken<T> interfaceType) {
    Set<Class<?>> interfaceClasses = Sets.newLinkedHashSet();