services = append(services, proxy.SidecarScope.ServicesForHostname(host.Name(dr.Host))...)
	} else {
		dr := cfg.Spec.(*networking.DestinationRule)
		// Destinationrule was updated. Find matching services from updated destinationrule.
		services = append(services, proxy.SidecarScope.ServicesForHostname(host.Name(dr.Host))...)

issue:
  - 46555
# releaseNotes is a markdown listing of any user facing changes. This will appear in the
# release notes.
releaseNotes:
- |
  **Fixed** attempting to reach multi-network endpoints that are unreachable due to `DestinationRule` TLS mode

	}.MustBuild()

	DestinationRule = resource.Builder{
		Identifier: "DestinationRule",
		Group:      "networking.istio.io",
		Kind:       "DestinationRule",
		Plural:     "destinationrules",
		Version:    "v1alpha3",
		VersionAliases: []string{
			"v1beta1",
			"v1",
		},
		Proto: "istio.networking.v1alpha3.DestinationRule", StatusProto: "istio.meta.v1alpha1.IstioStatus",

apiVersion: release-notes/v2
kind: bug-fix
area: security
releaseNotes:
  - |

    is enabled by default. This means SNI will be set automatically based on the downstream HTTP host/authority header if `DestinationRule` does not explicitly set the same.

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
- |
  **Added** support for outbound traffic Proxy Protocol. By specifying proxyProtocol in a DestinationRule.trafficPolicy,

          weight: 100
      headers:
        request:
          add:
            x-egress-test: "handled-by-egress-gateway"
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: test-egress
  namespace: {{ .From.NamespaceName }}
spec:

	case gvk.DestinationRule:
		oldRes := &apiistioioapinetworkingv1alpha3.DestinationRule{
			ObjectMeta: origMeta,
			Spec:       *(orig.Spec.(*istioioapinetworkingv1alpha3.DestinationRule)),
		}
		modRes := &apiistioioapinetworkingv1alpha3.DestinationRule{
			ObjectMeta: modMeta,
			Spec:       *(mod.Spec.(*istioioapinetworkingv1alpha3.DestinationRule)),
		}

		}},
		Ports: []discoveryv1.EndpointPort{{Name: ptr.Of("http"), Port: ptr.Of(int32(80))}},
	}
	dr := config.Config{
		Meta: config.Meta{
			GroupVersionKind: gvk.DestinationRule,
			Name:             "dr",
			Namespace:        "test",
		},
		Spec: &networking.DestinationRule{
			Host: "example.default.svc.cluster.local",
			TrafficPolicy: &networking.TrafficPolicy{Tls: &networking.ClientTLSSettings{

    code: IST0128
    level: Warning
    description: "No caCertificates are set in DestinationRule, this results in no verification of presented server certificate."
    template: "DestinationRule %s in namespace %s has TLS mode set to %s but no caCertificates are set to validate server identity for host: %s"
    args:
      - name: destinationrule
        type: string
      - name: namespace
        type: string
      - name: mode