apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
releaseNotes:
  - |

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue: []
releaseNotes:
- |

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - 47348
releaseNotes:
  - |

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management

issue:
  - https://github.com/istio/istio/issues/47433

releaseNotes:
- |

apiVersion: release-notes/v2
kind: bug-fix
area: telemetry
issue: [46977]
releaseNotes:
  - |

apiVersion: release-notes/v2
kind: feature
area: installation
issue:
  - 48746
releaseNotes:
  - |
    **Fixed** an issue causing Istio CNI to stop functioning on minimal/locked down nodes (such as no `sh` binary).
    The new logic runs with no external dependencies, and will attempt to continue if errors are encountered (which could be caused by things like SELinux rules).

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
releaseNotes:
- |

// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// Stress test setgid and thread creation. A thread
// can get a SIGSETXID signal early on at thread
// initialization, causing crash. See issue 53374.

package cgotest

/*
#include <sys/types.h>
#include <unistd.h>
*/
import "C"

import (
	"runtime"
	"testing"
)

func testSetgidStress(t *testing.T) {

[!fuzz] skip
[short] skip
env GOCACHE=$WORK/cache

# FuzzA attempts to cause the mutator to create duplicate inputs that generate
# new coverage. Previously this would trigger a corner case when the fuzzer
# had an execution limit, causing it to deadlock and sit in the coordinator
# loop indefinitely, failing to exit once the limit had been exhausted.

go test -fuzz=FuzzA -fuzztime=100x -parallel=1

-- go.mod --
module m

go 1.16

  - eu.bookinfo.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  endpoints:
  # Rather than relying on an external host that might become unreachable (causing test failures)
  # we can mock the external endpoint using service t which has no sidecar.
  - address: t.istio-system.svc.cluster.local # TODO: this is brittle
    ports: