Eoin Fennessy <******@****.***> 1715615475 +0100

				PrivateKey:  file.AsStringOrFail(t, path.Join(env.IstioSrc, "tests/testdata/certs/dns/key.pem")),
				CaCert:      file.AsStringOrFail(t, path.Join(env.IstioSrc, "tests/testdata/certs/dns/root-cert.pem")),
				Crl:         file.AsStringOrFail(t, path.Join(env.IstioSrc, "tests/testdata/certs/ca.crl")),
			}, false, apps.Ns2.Namespace.Name())

issue:
  - 36916


# releaseNotes is a markdown listing of any user facing changes. This will appear in the
# release notes.
releaseNotes:
- |
  **Improved** Pilot will now load its DNS serving certificate from well known locations:
  ```
  /var/run/secrets/istiod/tls/tls.crt
  /var/run/secrets/istiod/tls/tls.key
  /var/run/secrets/istiod/ca/root-cert.pem
  ```

Eoin Fennessy <******@****.***> 1715615475 +0100

Eoin Fennessy <******@****.***> 1715615475 +0100

John Howard <******@****.***> 1607394502 -0800

Eoin Fennessy <******@****.***> 1715615475 +0100

// foo.ns1, foo.ns1.svc, foo.ns1.svc.cluster.local and should not generate a virtual host called "foo" for
// foo.ns1 service.
// So given foo.ns1.svc.cluster.local and ns2.svc.cluster.local, this function will return
// foo.ns1, and svc.cluster.local.
// When given foo.ns2.svc.cluster.local and ns2.svc.cluster.local, this function will return
// foo, ns2.svc.cluster.local.

Eoin Fennessy <******@****.***> 1715615475 +0100

		}
	}
	for index, namespacedName := range apps.Ns2.All.NamespacedNames() {
		switch {
		case namespacedName.Name == "external-service":
			externalService = apps.Ns2.All[index]
		}
	}
	return nil
}

func mustReadCert(f string) string {
	b, err := os.ReadFile(path.Join(env.IstioSrc, "tests/testdata/certs/dns", f))
	if err != nil {
		log.Fatalf("failed to read %v: %v", f, err)
	}