apiVersion: release-notes/v2
kind: feature
area: security
issue:
- https://github.com/istio/api/pull/1933
docs:
- '[usage] https://istio.io/latest/docs/tasks/security/authorization/authz-dry-run/'
- '[design] https://docs.google.com/document/d/1xQdZsEgJ3Ld2qebfT3EJkg2COTtCR1TqBVojmnvI78g'
releaseNotes:
- |

          annotationClass.getDeclaringClass(),
          returnType.getComponentType());
    }
  }

  // This is public so that tests for Feature enums we haven't yet imagined
  // can reuse it.
  public static <E extends Enum<?> & Feature<?>> void assertGoodFeatureEnum(
      Class<E> featureEnumClass) {
    final Class<?>[] classes = featureEnumClass.getDeclaredClasses();
    for (Class<?> containedClass : classes) {

	"os"
	"os/exec"
	"testing"
)

func MustHaveDebugOptionsSupport(t *testing.T) {
	if !DebugOptions {
		t.Skipf("skipping test: cpu feature options not supported by OS")
	}
}

func MustSupportFeatureDetection(t *testing.T) {
	// TODO: add platforms that do not have CPU feature detection support.
}

func runDebugOptionsTest(t *testing.T, test string, options string) {
	MustHaveDebugOptionsSupport(t)

apiVersion: release-notes/v2
kind: feature
area: istioctl
releaseNotes:
- |

    }

    @Override
    public Iterable<E> order(List<E> insertionOrder) {
      return gen.order(insertionOrder);
    }
  }

  private static Set<Feature<?>> computeReserializedCollectionFeatures(Set<Feature<?>> features) {
    Set<Feature<?>> derivedFeatures = new HashSet<>(features);
    derivedFeatures.remove(SERIALIZABLE);
    derivedFeatures.remove(SERIALIZABLE_INCLUDING_VIEWS);
    return derivedFeatures;
  }

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
- |

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
   - |
     **Added** the ability to perform automatic SAN validation based on the downstream HTTP host/authority header
     when `ENABLE_AUTO_SNI` and `VERIFY_CERTIFICATE_AT_CLIENT` feature flags are enabled.
docs:
   - https://docs.google.com/document/d/1pTUl-Ng3nXAWJb7UGJtalftznpxQEfID/

apiVersion: release-notes/v2
kind: feature
area: security
releaseNotes:
- |
  **Added** support for migration and concurrent use of regular K8S tokens as well as new K8S tokens with audience. This feature is enabled by
  default, can be disabled by REQUIRE_3P_TOKEN environment variable in Istiod, which will require new tokens with audience. The

   * but one.
   */
  REJECTS_DUPLICATES_AT_CREATION,

  GENERAL_PURPOSE(SUPPORTS_PUT, SUPPORTS_REMOVE);

  private final Set<Feature<? super Map>> implied;

  MapFeature(Feature<? super Map>... implied) {
    this.implied = Helpers.copyToSet(implied);
  }

  @Override
  public Set<Feature<? super Map>> getImpliedFeatures() {
    return implied;
  }

  @Retention(RetentionPolicy.RUNTIME)
  @Inherited

// 1. Enable CSIMigrationXX for the plugin
// 2. Unregister the in-tree plugin by setting the InTreePluginXXUnregister feature gate
func (pm PluginManager) IsMigrationCompleteForPlugin(pluginName string) bool {
	// CSIMigration feature and plugin specific InTreePluginUnregister feature flags should
	// be enabled for plugin specific migration completion to be take effect
	if !pm.IsMigrationEnabledForPlugin(pluginName) {