* Is this turned on by default?
        * How many users are affected by this change?

## Feature implementation

Release managers will continue to have a final say in what gets merged or not, unless directed by the TOC. See the next
section if the implementation is done, but a bug is being addressed.

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // handler specifies the underlying runtime and configuration that the CRI
  // implementation will use to handle pods of this class. The possible values
  // are specific to the node & CRI configuration.  It is assumed that all
  // handlers are available on every node, and handlers of the same name are

func GetFromStructPath(node any, path string) (any, bool, error) {
	return getFromStructPath(node, util.PathFromString(path))
}

// getFromStructPath is the internal implementation of GetFromStructPath which recurses through a tree of Go structs
// given a path. It terminates when the end of the path is reached or a path element does not exist.

					suite.GatewayHTTPConformanceProfileName,
					suite.GatewayTLSConformanceProfileName,
					suite.GatewayGRPCConformanceProfileName,
					suite.MeshHTTPConformanceProfileName,
				),
				Implementation: confv1.Implementation{
					Organization: "istio",
					Project:      "istio",
					URL:          "https://istio.io/",
					Version:      istioVersion,
					Contact:      []string{"@istio/maintainers"},
				},

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management

issue:
  - https://github.com/kubernetes-sigs/gateway-api/issues/2309

releaseNotes:
- |
  **Fixed** Istio's Gateway API implementation to adhere to the Gateway API
  requirement that a `group: ""` field must be set for a `parentRef` of `kind: Service`.
  Istio previously tolerated the missing group for Service-kind parent references. This

* The Gateway Class controller is a simple controller that just writes a default `GatewayClass` object describing our implementation.

)

// Controller is an implementation of ConfigStoreController.
type Controller struct {
	monitor     Monitor
	configStore model.ConfigStore
	hasSynced   func() bool

	// If meshConfig.DiscoverySelectors are specified, the namespacesFilter tracks the namespaces this controller watches.
	namespacesFilter func(obj interface{}) bool
}

// NewController return an implementation of ConfigStoreController

)

// NewHandler returns an http.Handler that wraps h, intercepting any h2c
// traffic. See h2c.NewHandler for details.
// Unlike the normal handler, this handler prevents h2c Upgrades, which are not safe in Go's implementation;
// see https://github.com/golang/go/issues/56352.
// This means we allow only HTTP/1.1 or HTTP/2 prior knowledge.
func NewHandler(h http.Handler, s *http2.Server) http.Handler {
	return denyH2cUpgrade(h2c.NewHandler(h, s))

		copyBuffered(pw, conn, log.WithLabels("name", "conn to pipe"))

		wg.Wait()
		log.Infof("stream closed in %v", time.Since(t0))
	}()

	return nil
}

// TLSDialWithDialer is an implementation of tls.DialWithDialer that accepts a generic Dialer
func TLSDialWithDialer(dialer Dialer, network, addr string, config *tls.Config) (*tls.Conn, error) {
	return tlsDial(context.Background(), dialer, network, addr, config)
}

releaseNotes:
  - |
    **Improved** the ordering of HTTP and TCP envoy filters to improve consistency
upgradeNotes:
  - title: "Envoy filter ordering"
    content: |
      This change impacts internal implementation of how Envoy "filters" are ordered. These filters run in order to implement various functionality.
      
      The ordering is now consistent across inbound, outbound and gateway proxy modes, as well as HTTP and TCP protocols: