apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
  - |
    **Deprecated** the use of the `.global` stub domain for multi-primary
    (formerly "replicated control planes") multicluster configurations. The new
    onboarding flow uses a simpler configuration which allows services across
    the mesh to be accessed via `*.cluster.local`. There were several
    limitations with `.global`, such as poor load balancing when using

    + row.withPanels([
      panels.timeSeries.simple('Pilot Versions', queries.istioBuild, 'Version number of each running instance'),
    ]),
  ], panelHeight=5)
  + grid.makeGrid([
    row.new('Resource Usage')
    + row.withPanels([
      panels.timeSeries.bytes('Memory Usage', queries.goMemoryUsage, 'Memory usage of each running instance'),

    |||
      `makeGrid` returns an array of `panels` organized in a grid with equal width
      and `panelHeight`. Row panels are used as "linebreaks", if a Row panel is collapsed,
      then all panels below it will be folded into the row.

      Optional `startY` can be provided to place generated grid above or below existing panels.
    |||,
    args=[
      d.arg('panels', d.T.array),
      d.arg('panelHeight', d.T.number),

      panels.timeSeries.connections('Connections', queries.connections, 'Connections opened and closed per instance'),
      panels.timeSeries.bytesRate('Bytes Transmitted', queries.bytes, 'Bytes sent and recieved per instance'),
      panels.timeSeries.dns('DNS Request', queries.dns, 'DNS queries recieved per instance'),
    ]),
    row.new('Operations')
    + row.withPanels([
      panels.timeSeries.base(
        'XDS', queries.ztunnelXdsConnections, |||

apiVersion: release-notes/v2
kind: bug-fix
area: installation
releaseNotes:
- |

apiVersion: release-notes/v2
kind: bug-fix
area: installation
issue:
  - 29364
releaseNotes:
  - |
    **Fixed** Newer control plane installations were removing permissions for `rbac.istio.io` from `istiod`, causing

    best practices, incorporating recent updates to onboarding tooling. In
    particular, the multi-primary configuration (formerly known as
    "replicated control planes") no longer relies on manually configuring the
    `.global` stub domain, preferring instead to use `*.svc.cluster.local` for

	//
	// Deprecated: All new tests should support multiple clusters.
	RequiresSingleCluster() Test
	// RequiresLocalControlPlane ensures that clusters are using locally-deployed control planes.
	//
	// Deprecated: Tests should not make assumptions regarding control plane topology.
	RequiresLocalControlPlane() Test
	// RequiresSingleNetwork ensures that clusters are in the same network
	//

|PROV_CERT|certificates to be used for mTLS communication with control plane only; NOT for workload mTLS|
|OUTPUT_CERT|write all fetched certificates to some directory. Used to support applications that need certificates (Prometheus) as well as rotating mTLS control plane authentication.|

    pivots = urlPivots();

    // Get places where pivots occur.
    let places = [];
    for (let pivot of pivots) {
      const src = stacks.Sources[pivot];
      for (let p of src.Places) {
        places.push(p);
      }
    }

    const width = chart.clientWidth;
    elems.clear();
    actionTarget = null;
    const [pos, neg] = totalValue(places);
    const total = pos + neg;