apiVersion: release-notes/v2
kind: feature
area: security
issue:
  - https://github.com/istio/api/issues/2285
releaseNotes:
  - |

    parentRef:
      name: gateway
      namespace: istio-system
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TLSRoute
metadata:
  creationTimestamp: null
  name: tls
  namespace: default
spec: null
status:
  parents:
  - conditions:
    - lastTransitionTime: fake
      message: Route was valid
      reason: Accepted
      status: "True"
      type: Accepted

    port: 443
    protocol: HTTPS
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            kubernetes.io/metadata.name: "cert"
    tls:
      mode: Terminate
      certificateRefs:
      - name: cert
        namespace: cert
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-cert
  namespace: cert

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: tls-redirect
spec:
  parentRefs:
  - name: example-gateway
    sectionName: http
  hostnames:
  - foo.example.com
  - bar.example.com
  rules:
  - filters:
    - type: RequestRedirect
      requestRedirect:
        scheme: https

        "DuplicateExtensionServer-TLS-TLS1": "TODO: first pass, this should be fixed",
        "DuplicateExtensionClient-TLS-TLS1": "TODO: first pass, this should be fixed",
        "UnsolicitedServerNameAck-TLS-TLS1": "TODO: first pass, this should be fixed",
        "TicketSessionIDLength-33-TLS-TLS1": "TODO: first pass, this should be fixed",
        "DuplicateExtensionServer-TLS-TLS11": "TODO: first pass, this should be fixed",

				// On ELF ARM, the thread pointer is 8 bytes before
				// the start of the thread-local data block, so add 8
				// to the actual TLS offset (r->sym->value).
				// This 8 seems to be a fundamental constant of
				// ELF on ARM (or maybe Glibc on ARM); it is not
				// related to the fact that our own TLS storage happens
				// to take up 8 bytes.
				o = 8 + ldr.SymValue(rs)

apiVersion: release-notes/v2
kind: feature
area: security
issue:
  - 38528
releaseNotes:
- |

  namespace: istio-system
spec:
  servers:
  - hosts:
    - cert/cert1.domain.example
    port:
      name: default
      number: 443
      protocol: HTTPS
    tls:
      credentialName: kubernetes-gateway://cert/cert
      mode: SIMPLE
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: HTTPRoute/http.cert

Prashanth Balasubramanian <******@****.***> 1461527218 -0700

kind: PeerAuthentication
metadata:
  name: "default"
  annotations:
    test-suite: "automtls-partial-sidecar-dr-no-tls"
spec:
  mtls:
    mode: STRICT
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: "multiversion-route"
  annotations:
    test-suite: "automtls-partial-sidecar-dr-no-tls"
spec:
  hosts:
  - "multiversion"
  http:
  - name: "vistio-route"
    match:
    - uri: