apiVersion: release-notes/v2
kind: feature
area: traffic-management

releaseNotes:
- |

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - 34944

releaseNotes:
- |

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - 44986
releaseNotes:
  - |

apiVersion: release-notes/v2
kind: bug-fix
area: security
releaseNotes:
  - |

	if push == nil {
		return nil, nil
	}
	mergedDR := node.SidecarScope.DestinationRule(model.TrafficDirectionOutbound, node, svc.Hostname)
	destinationRule := mergedDR.GetRule()
	if destinationRule == nil {
		return nil, nil
	}
	rule := destinationRule.Spec.(*networking.DestinationRule)
	consistentHash := rule.GetTrafficPolicy().GetLoadBalancer().GetConsistentHash()

    is enabled by default. This means SNI will be set automatically based on the downstream HTTP host/authority header if `DestinationRule` does not explicitly set the same.

        subset: "vistio"
  - name: "legacy-by-default"
    route:
    - destination:
        host: "multiversion"
        subset: "vlegacy"
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: "multiversion"
  annotations:
    test-suite: "automtls-partial-sidecar-dr-no-tls"
spec:
  host: "multiversion"
  subsets:
  - name: "vistio"
    labels:
      version: "vistio"

apiVersion: release-notes/v2
kind: feature
area: traffic-management

releaseNotes:
- |
  **Added** warning validation messages when a DestinationRule specifies failover policies but does not provide an OutlierDetection policy.

spec:
  mtls:
    mode: STRICT
---
# Corresponding destination rule to configure client side to use mutual TLS when talking to
# any service (host) in the mesh.
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: default
  namespace: istio-config
spec:
  host: "*.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
# Services and configs in ns1 namespace

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: originate-mtls-for-egress-gateway
spec:
  host: {{ .EgressGatewayServiceName | default "istio-egressgateway" }}.{{ .EgressGatewayServiceNamespace | default "istio-system" }}.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL