apiVersion: release-notes/v2
kind: bug-fix
area: security
issue:
- 31297
releaseNotes:
- |

apiVersion: v1
clusters:
- cluster:
    insecure-skip-tls-verify: true
    server: https://10.96.0.1:443
  name: local
contexts:
- context:
    cluster: local
    user: istio-cni
  name: istio-cni-context
current-context: istio-cni-context
kind: Config
preferences: {}
users:
- name: istio-cni
  user:

apiVersion: release-notes/v2
kind: bug-fix
area: security
releaseNotes:
- |
  **Improved** TLS configuration on sidecar server side inbound paths to enforce TLSv2 version along with recommended cipher suites.

#$ Used in:
#$ - site-src/guides/tls.md
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: wildcard-tls-gateway
spec:
  gatewayClassName: acme-lb
  listeners:
  - name: foo-https
    protocol: HTTPS
    port: 443
    hostname: foo.example.com
    tls:
      certificateRefs:
      - kind: Secret
        group: ""
        name: foo-example-com-cert
  - name: wildcard-https
    protocol: HTTPS

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls
  namespace: bar
spec:
  rules:
    - host: foo.org
      http:
        paths:
          - backend:
              service:
                name: httpbin
                port:
                  number: 80
            path: /*
  tls:
    - hosts:

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: originate-tls-for-external-svc
spec:
  host: {{ .EgressGatewayServiceName | default "istio-egressgateway" }}.{{ .EgressGatewayServiceNamespace | default "istio-system" }}.svc.cluster.local
  subsets:
  - name: originate-tls-for-plain-traffic
    trafficPolicy:
      tls:
        mode: SIMPLE
        sni: external.{{ .externalNamespace }}.svc.cluster.local

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
releaseNotes:
- |

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
  - https://github.com/istio/istio/issues/36271
releaseNotes:
  - |

#$ Used in:
#$ - site-src/v1alpha2/guides/tls.md
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: cross-namespace-tls-gateway
  namespace: gateway-api-example-ns1
spec:
  gatewayClassName: acme-lb
  listeners:
  - name: https
    protocol: HTTPS
    port: 443
    hostname: "*.example.com"
    tls:
      certificateRefs:
      - kind: Secret
        group: ""
        name: wildcard-example-com-cert

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  annotations:
    internal.istio.io/route-semantics: ingress
  creationTimestamp: null
  name: foo-org-tls-istio-autogenerated-k8s-ingress
  namespace: bar
spec:
  gateways:
  - istio-system/tls-istio-autogenerated-k8s-ingress-bar
  hosts:
  - foo.org
  http:
  - route:
    - destination:
        host: httpbin.bar.svc.mydomain
        port: