// (eg: they are part of the interface of tensorflow_serving):
// https://github.com/tensorflow/serving/blob/e0d247b2e4050713194b8fad0be24a0636df7209/tensorflow_serving/apis/predict.proto#L21
// https://github.com/tensorflow/serving/blob/e0d247b2e4050713194b8fad0be24a0636df7209/tensorflow_serving/apis/predict.proto#L39
// The name of each input/output is stored in the corresponding tf::Argument in

	// "kubernetes.io/kubelet-serving" issues serving certificates that kubelets use to serve TLS endpoints,
	// which kube-apiserver can connect to securely.
	// Never auto-approved by kube-controller-manager.
	// Can be issued by the "csrsigning" controller in kube-controller-manager.
	KubeletServingSignerName = "kubernetes.io/kubelet-serving"
)

// ExtraValue masks the value so protobuf can generate

			.APIServer.CertSANs is an optional parameter for adding DNS names and IPs to the API Server serving cert SAN
			.Etcd.Local.ServerCertSANs is an optional parameter for adding DNS names and IPs to the etcd serving cert SAN
			.Etcd.Local.PeerCertSANs is an optional parameter for adding DNS names and IPs to the etcd peer cert SAN

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - 50478
releaseNotes:
  - |
    **Fixed** a behavioral change in Istio 1.20 that caused merging of ServiceEntries with the same hostname and port names

	KubeAPIServerClientKubeletSignerName = "kubernetes.io/kube-apiserver-client-kubelet"

	// Signs serving certificates that are honored as a valid kubelet serving
	// certificate by the kube-apiserver, but has no other guarantees.
	KubeletServingSignerName = "kubernetes.io/kubelet-serving"

	// Has no guarantees for trust at all. Some distributions may honor these

	// If this is an alpha tag, don't remove by default, but allow the option.
	// If the cluster-admin has requested serving one more release, allow it.
	if e.isAlpha && e.strictRemovedHandlingInAlpha { // don't serve in alpha if we want strict handling
		return false
	}
	if e.isAlpha { // alphas are allowed to continue serving expired betas while we clean up the test
		return true
	}

    factory: KotlinCompositeProviderFactory<P>,
    crossinline mergeTargets: (List<T>) -> P,
): P {
    // We should flatten providers before merging so that the merger has access to all individual providers, and also after merging because
    // composite providers may be created by the merger.
    return factory.createFlattened(factory.flatten(this).mergeOnly<_, T> { mergeTargets(it) })

issue:
  - 36916


# releaseNotes is a markdown listing of any user facing changes. This will appear in the
# release notes.
releaseNotes:
- |
  **Improved** Pilot will now load its DNS serving certificate from well known locations:
  ```
  /var/run/secrets/istiod/tls/tls.crt
  /var/run/secrets/istiod/tls/tls.key
  /var/run/secrets/istiod/ca/root-cert.pem
  ```

	"istio.io/istio/pkg/util/sets"
)

// This function merges one or more destination rules for a given host string
// into a single destination rule. Note that it does not perform inheritance style merging.
// IOW, given three dest rules (*.foo.com, *.foo.com, *.com) without selectors, calling this function for
// each config will result in a final dest rule set (*.foo.com, and *.com).
//
// The following is the merge logic:

    code: IST0150
    level: Warning
    description: "Proxy may prevent tcp named ports and unmatched traffic for ports serving TCP protocol from being forwarded correctly for ExternalName services."
    template: "Port name for ExternalName service is invalid. Proxy may prevent tcp named ports and unmatched traffic for ports serving TCP protocol from being forwarded correctly"

  - name: "EnvoyFilterUsesRelativeOperation"
    code: IST0151