apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-sidecar-injector{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Release.Namespace }}
  labels:
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Pilot"
    release: {{ .Release.Name }}
data:

apiVersion: release-notes/v2
kind: feature
area: installation
issue: []
releaseNotes:
- |

# Istio Agent

This document describes the internal architecture of Istio agent.

## High Level overview

![High Level overview](docs/overview.svg)

At a high level, the Istio agent acts as an intermediate proxy between Istiod and Envoy. This is done
at two levels. For distributing workload certificates, Envoy will send [SDS](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret)

apiVersion: release-notes/v2
kind: feature
area: security
releaseNotes:
- |
  **Improved** Gateway certificates to be read and distributed from Istiod, rather than in the gateway pods.
  This reduces the permissions required in the gateways, improves performance, and will make certificate reading
  more flexible in the future. This change is fully backwards compatible with the old method, and requires no changes

      # where the init container runs in a fresh environment and there cannot be previous Istio chains
      "${ISTIO_BIN_BASE}/pilot-agent" istio-clean-iptables

      # Update iptables, based on config file
      "${ISTIO_BIN_BASE}/pilot-agent" istio-iptables
    fi
fi

EXEC_USER=${EXEC_USER:-istio-proxy}
if [ "${ISTIO_INBOUND_INTERCEPTION_MODE}" = "TPROXY" ] ; then

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
  - 31772
releaseNotes:
- |

	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	"istio.io/api/security/v1beta1"
	"istio.io/istio/pilot/pkg/features"
	securityModel "istio.io/istio/pilot/pkg/security/model"
	"istio.io/istio/pkg/config/constants"
	"istio.io/istio/pkg/env"
	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/security"
	"istio.io/istio/security/pkg/cmd"
	"istio.io/istio/security/pkg/pki/ca"
	"istio.io/istio/security/pkg/pki/ra"

          },
          "expr": "sum(container_memory_working_set_bytes{namespace!=\"istio-system\",container=\"istio-proxy\"}) / count(container_memory_working_set_bytes{namespace!=\"istio-system\",container=\"istio-proxy\"})",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "per istio proxy",
          "refId": "B"
        }
      ],
      "title": "Memory Usage",

apiVersion: release-notes/v2
kind: feature
area: telemetry
releaseNotes:
- |

    "id": "sidecar~127.0.1.1~echo.test~cluster.local",
    "metadata": {
      "INSTANCE_IPS": "127.0.1.1",
      "PILOT_SAN": [
        "istiod.istio-system.svc"
      ],
      "GENERATOR": "grpc",
      "NAMESPACE": "test"
    },
    "localisty": {},
    "UserAgentVersionType": "istiov1"
  },
  "certificate_providers": {
    "default": {
      "plugin_name": "file_watcher",
      "config": {