issue:
  - 46555
# releaseNotes is a markdown listing of any user facing changes. This will appear in the
# release notes.
releaseNotes:
- |
  **Fixed** attempting to reach multi-network endpoints that are unreachable due to `DestinationRule` TLS mode

		services = append(services, proxy.SidecarScope.ServicesForHostname(host.Name(dr.Host))...)
	} else {
		dr := cfg.Spec.(*networking.DestinationRule)
		// Destinationrule was updated. Find matching services from updated destinationrule.
		services = append(services, proxy.SidecarScope.ServicesForHostname(host.Name(dr.Host))...)

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - 44986
releaseNotes:
  - |

apiVersion: release-notes/v2
kind: bug-fix
area: security
releaseNotes:
  - |

	if push == nil {
		return nil, nil
	}
	mergedDR := node.SidecarScope.DestinationRule(model.TrafficDirectionOutbound, node, svc.Hostname)
	destinationRule := mergedDR.GetRule()
	if destinationRule == nil {
		return nil, nil
	}
	rule := destinationRule.Spec.(*networking.DestinationRule)
	consistentHash := rule.GetTrafficPolicy().GetLoadBalancer().GetConsistentHash()

    is enabled by default. This means SNI will be set automatically based on the downstream HTTP host/authority header if `DestinationRule` does not explicitly set the same.

        subset: "vistio"
  - name: "legacy-by-default"
    route:
    - destination:
        host: "multiversion"
        subset: "vlegacy"
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: "multiversion"
  annotations:
    test-suite: "automtls-partial-sidecar-dr-no-tls"
spec:
  host: "multiversion"
  subsets:
  - name: "vistio"
    labels:
      version: "vistio"

apiVersion: release-notes/v2
kind: feature
area: traffic-management

releaseNotes:
- |
  **Added** warning validation messages when a DestinationRule specifies failover policies but does not provide an OutlierDetection policy.

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: originate-mtls-for-egress-gateway
spec:
  host: {{ .EgressGatewayServiceName | default "istio-egressgateway" }}.{{ .EgressGatewayServiceNamespace | default "istio-system" }}.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

spec:
  mtls:
    mode: STRICT
---
# Corresponding destination rule to configure client side to use mutual TLS when talking to
# any service (host) in the mesh.
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: default
  namespace: istio-config
spec:
  host: "*.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
# Services and configs in ns1 namespace