apiVersion: release-notes/v2
kind: feature
area: installation
issue:
  - 43655
releaseNotes:
  - |

Eoin Fennessy <******@****.***> 1715615475 +0100

- 48814
releaseNotes:
- |

}

func TestInboundNetworkFilterStatPrefix(t *testing.T) {
	cases := []struct {
		name               string
		statPattern        string
		expectedStatPrefix string
	}{
		{
			"no pattern",
			"",
			"inbound|8888||",
		},
		{
			"service only pattern",
			"%SERVICE%",
			"v0.default.example.org",
		},
	}

	services := []*model.Service{
		buildService("test.com", "10.10.0.0/24", protocol.TCP, tnow),
	}

For inbound requests, the new [Request.Pattern] field contains the [ServeMux]
pattern (if any) that matched the request. This field is not set when

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
- 28269
releaseNotes:
- |
  **Fixed** when a node has multiple IP addresses (e.g., a VM in the mesh expansion scenario),
  Istio Proxy will now bind `inbound` listeners to the first applicable address in the list

			ApplicationProtocols: mtlsTCPWithMxcALPNs,
			// If client sends mTLS traffic, transport protocol will be set by the TLS inspector
			TransportProtocol: xdsfilters.TLSTransportProtocol,
			Protocol:          networking.ListenerProtocolTCP,
			TLS:               true,
		},
		{
			// client side traffic could not be identified by the outbound listener, sent over plaintext

	"k8s.io/apiextensions-apiserver/pkg/apiserver/schema/cel/model"
	"k8s.io/apimachinery/pkg/util/validation/field"
	"k8s.io/apiserver/pkg/cel"
)

// unbounded uses nil to represent an unbounded cardinality value.
var unbounded *uint64 = nil

// CELSchemaContext keeps track of data used by x-kubernetes-validations rules for a specific schema node.
type CELSchemaContext struct {

            "name": "outbound|9080|v1|productpage.default.svc.cluster.local",
            "type": "EDS",
            "eds_cluster_config": {
              "eds_config": {
                "ads": {},
                "initial_fetch_timeout": "0s",
                "resource_api_version": "V3"
              },
              "service_name": "outbound|9080|v1|productpage.default.svc.cluster.local"
            },

 - `kubeadm`: a separate "super-admin.conf" file is now deployed. The User in `admin.conf` is now bound to a new RBAC Group `kubeadm:cluster-admins` that has `cluster-admin` `ClusterRole` access. The User in `super-admin.conf` is now bound to the `system:masters` built-in super-powers / break-glass Group that can bypass RBAC. Before this change, the default `admin.conf` was bound to `system:masters` Group, which was undesired. Executing `kubeadm init phase kubeconfig all` or just `kubeadm...