{{- end }}
        {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }}
        {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }}
    {{- end }}
      }
    spec:

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
   - |
     **Added** the ability to set credentialName based secret configuration
     at sidecars for egress TLS traffic when WorkloadSelector is specified in `DestinationRule`,
     provided the sidecar has permission to list secrets in the namespace where it resides.
docs:

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
- |
  **Removed** the `PILOT_ENABLE_INBOUND_PASSTHROUGH` setting, which has been enabled-by-default for the past 8 releases.

		`IPv4 CIDR range used to identify outbound traffic on loopback interface intended for application container`)

	OwnerGroupsInclude = env.Register("ISTIO_OUTBOUND_OWNER_GROUPS", "*",
		`Comma separated list of groups whose outgoing traffic is to be redirected to Envoy.
A group can be specified either by name or by a numeric GID.
The wildcard character "*" can be used to configure redirection of traffic from all groups.`)

// serviceExternalChainName returns the name of the KUBE-EXT-XXXX chain for a service, which
// implements "short-circuiting" for internally-originated external-destination traffic when using
// `Local` external traffic policy.  It forwards traffic from local sources to the KUBE-SVC-XXXX
// chain and traffic from external sources to the KUBE-SVL-XXXX chain.
func serviceExternalChainName(servicePortName string, protocol string) utiliptables.Chain {

)

const (
	// BlackHoleCluster to catch traffic from routes with unresolved clusters. Traffic arriving here goes nowhere.
	BlackHoleCluster = "BlackHoleCluster"
	// BlackHole is the name of the virtual host and route name used to block all traffic
	BlackHole = "block_all"
	// PassthroughCluster to forward traffic to the original destination requested. This cluster is used when
	// traffic does not match any listener in envoy.

		},
		{
			name: "HTTPS traffic with passthrough ServerTLS mode",
			server: &v1alpha3.Server{
				Port: &v1alpha3.Port{
					Number:   80,
					Protocol: string(protocol.HTTPS),
					Name:     "https",
				},
				Tls: &v1alpha3.ServerTLSSettings{Mode: v1alpha3.ServerTLSSettings_PASSTHROUGH},
			},
			expected: false,
		},
		{
			name: "HTTP traffic with passthrough ServerTLS mode",

  // If this field is present and contains at least one item, then this rule allows
  // traffic only if the traffic matches at least one port in the list.
  // +optional
  repeated NetworkPolicyPort ports = 1;

  // List of destinations for outgoing traffic of pods selected for this rule.
  // Items in this list are combined using a logical OR operation. If this field is

#   tests, but included for completeness.
kind: bug-fix

# area describes the area that this change affects.
# Valid values are:
# - traffic-management
# - security
# - telemetry
# - installation
# - istioctl
# - documentation
area: traffic-management

# issue is a list of GitHub issues resolved in this note.
# If issue is not in the current repo, specify its full URL instead.
issue:
  - 42675

annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}" traffic.sidecar.istio.io/includeOutboundIPRan: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRan` .Values.global.proxy.includeIPRanges }}" traffic.sidecar.istio.io/excludeOutboundIPRan: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRan` .Values.global.proxy.excludeIPRanges }}" traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.i...