apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
  - 39110
releaseNotes:
  - |

apiVersion: release-notes/v2
kind: bug-fix
area: installation
releaseNotes:
- |

Helpful references:

* link:https://github.com/apache/ant/blob/master/src/main/org/apache/tools/ant/util/ProxySetup.java[ProxySetup.java in the Ant codebase^]
* link:https://docs.oracle.com/javase/8/docs/technotes/guides/net/proxies.html[JDK 8 Proxies^]

=== NTLM Authentication

If your proxy requires NTLM authentication, you may need to provide the authentication domain as well as the username and password.

          |||
        ),
      ],


      workloadManager: [
        self.query(
          'Active Proxies ({{pod}})',
          |||
            sum by (pod) (workload_manager_active_proxy_count{%(podLabels)s})
          |||
        ),
        self.query(
          'Pending Proxies ({{pod}})',
          |||
            sum by (pod) (workload_manager_pending_proxy_count{%(podLabels)s})
          |||

    -->
  </pluginGroups>

  <!-- TODO Since when can proxies be selected as depicted? -->
  <!-- proxies
   | This is a list of proxies which can be used on this machine to connect to the network.
   | Unless otherwise specified (by system property or command-line switch), the first proxy
   | specification in this list marked as active will be used.
   |-->
  <proxies>
    <!-- proxy

releaseNotes:
  - |

releaseNotes:
- |
  **Improved** request JWT authentication to use the upstream Envoy JWT filter
  instead of the custom Istio Proxy filter. Because the new upstream JWT filter
  capabilities are needed, the feature is gated for the proxies that support
  them. Note that a custom Envoy or Wasm filter that used `istio_authn` dynamic
  metadata key  needs to be updated to use `envoy.filters.http.jwt_authn`

               "legendFormat": "Active Proxies ({{pod}})"
            },
            {
               "datasource": {
                  "type": "prometheus",
                  "uid": "$datasource"
               },
               "expr": "sum by (pod) (workload_manager_pending_proxy_count{pod=~\"ztunnel-.*\"})",
               "legendFormat": "Pending Proxies ({{pod}})"
            }
         ],

			setUpUdsOK := true
			if s.grpcWorkloadListener == nil {
				if s.grpcWorkloadListener, err = uds.NewListener(security.WorkloadIdentitySocketPath); err != nil {
					sdsServiceLog.Errorf("SDS grpc server for workload proxies failed to set up UDS: %v", err)
					setUpUdsOK = false
				}
			}
			if s.grpcWorkloadListener != nil {

import java.lang.annotation.Target;

/**
 * Annotation used to mark TAPI model interfaces. On the client side such interfaces
 * are instantiated via Java dynamic proxies, and we use this annotation when we want
 * these proxies to have richer behaviour than just implementing the base interface.
 * <p>
 * For example. Let's say the TAPI model interface is {@code Animal}, but which also