apiVersion: release-notes/v2
kind: feature
area: installation
issue:
  - 48746
releaseNotes:
  - |
    **Fixed** an issue causing Istio CNI to stop functioning on minimal/locked down nodes (such as no `sh` binary).
    The new logic runs with no external dependencies, and will attempt to continue if errors are encountered (which could be caused by things like SELinux rules).

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
releaseNotes:
- |

[!fuzz] skip
[short] skip
env GOCACHE=$WORK/cache

# FuzzA attempts to cause the mutator to create duplicate inputs that generate
# new coverage. Previously this would trigger a corner case when the fuzzer
# had an execution limit, causing it to deadlock and sit in the coordinator
# loop indefinitely, failing to exit once the limit had been exhausted.

go test -fuzz=FuzzA -fuzztime=100x -parallel=1

-- go.mod --
module m

go 1.16

  - eu.bookinfo.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  endpoints:
  # Rather than relying on an external host that might become unreachable (causing test failures)
  # we can mock the external endpoint using service t which has no sidecar.
  - address: t.istio-system.svc.cluster.local # TODO: this is brittle
    ports:

  - eu.bookinfo.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  endpoints:
  # Rather than relying on an external host that might become unreachable (causing test failures)
  # we can mock the external endpoint using service t which has no sidecar.
  - address: t.istio-system.svc.cluster.local # TODO: this is brittle
    ports:

            return super.getOrDefault(Objects.requireNonNull(key), defaultValue)
        }

        @Override
        protected Map<String, String> delegate() {
            // Groovy ends up calling get() to obtain innerMap if there's no explicit qualifier, causing stack overflow.
            return AccessTrackingEnvMapTest.this.innerMap
        }
    }

// Add policy conditionals.
const (
	policyCondEqual         = "eq"
	policyCondStartsWith    = "starts-with"
	policyCondContentLength = "content-length-range"
)

// toString - Safely convert interface to string without causing panic.
func toString(val interface{}) string {
	switch v := val.(type) {
	case string:
		return v
	default:
		return ""
	}
}

// toLowerString - safely convert interface to lower string

        "taskReport"            | []
        "propertyReport"        | []
        "htmlDependencyReport"  | []
        // projectReport depends on the other ones, and task order may not be preserved,
        // causing equality comparison between first and second outputs to fail
        //"projectReport"         | []
    }

    def setup() {
        executer.requireIsolatedDaemons()
    }

    def "file system watching picks up changes causing a continuous build to rebuild"() {
        given:
        // Do not drop the VFS in the first build, since there is only one continuous build invocation.

     * In this case, the failure can be synthetic to provide the stack trace for the problem origin.
     * <p>
     * The failure can also be omitted due to limits. Its absence does not mean there was no exception causing the problem.
     */
    @Nullable
    Failure getFailure();

    /**
     * Returns an exception that can be thrown when this problem should result in an error.
     *