apiVersion: release-notes/v2
kind: feature
area: traffic-management
issues:
- 35263
releaseNotes:
- |
  **Improved** the default `PILOT_MAX_REQUESTS_PER_SECOND`, which limits the number of **new** XDS connections per second,

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
- 37989
- 37974

releaseNotes:
- |
  **Improved** XDS generation to send less resource when possible, sometimes omitting a response entirely.

apiVersion: release-notes/v2
kind: feature
area: networking
issue: []
releaseNotes:
- |
  **Updated** XDS connections from Envoy will be proxied through the Istio sidecar agent. Doing so allows
  for consolidation of multiple connections from a pod to Istiod into a single connection, in addition to
  other planned future improvements. This feature (and change) is transparent to users and is enabled by default.

	generators[v3.ClusterType] = &xds.CdsGenerator{ConfigGenerator: cg}
	generators[v3.ListenerType] = &xds.LdsGenerator{ConfigGenerator: cg}
	generators[v3.RouteType] = &xds.RdsGenerator{ConfigGenerator: cg}
	generators[v3.EndpointType] = edsGen
	ecdsGen := &xds.EcdsGenerator{ConfigGenerator: cg}
	if env.CredentialsController != nil {
		generators[v3.SecretType] = xds.NewSecretGen(env.CredentialsController, s.Cache, clusterID, env.Mesh())

)

// CentralControlPlaneOptions holds options common to all subcommands
// that invoke Istiod via xDS REST endpoint
type CentralControlPlaneOptions struct {
	// Xds is XDS endpoint, e.g. localhost:15010.
	Xds string

	// XdsPodLabel is a Kubernetes label on the Istiod pods
	XdsPodLabel string

	// XdsPodPort is a port exposing XDS (typically 15010 or 15012)
	XdsPodPort int

	// CertDir is the local directory containing certificates

// See the License for the specific language governing permissions and
// limitations under the License.

package match

import (
	xds "github.com/cncf/xds/go/xds/core/v3"
	matcher "github.com/cncf/xds/go/xds/type/matcher/v3"
	network "github.com/envoyproxy/go-control-plane/envoy/extensions/matching/common_inputs/network/v3"
	wrappers "google.golang.org/protobuf/types/known/wrapperspb"

    row.new('Push Information')
    + row.withPanels([
      panels.timeSeries.xdsPushes(
        'XDS Pushes', queries.xdsPushes, |||
          Rate of XDS push operations, by type. This is incremented on a per-proxy basis.
        |||
      ),
      panels.timeSeries.base(
        'Events', queries.pilotEvents, |||
          Size of each xDS push.
        |||
      ),
      panels.timeSeries.base(

	w.Lock()
	defer w.Unlock()
	w.watch = &xds.WatchedResource{TypeUrl: typeURL, ResourceNames: names}
}

func (w *Watch) UpdateWatchedResource(_ string, f func(*xds.WatchedResource) *xds.WatchedResource) {
	w.Lock()
	defer w.Unlock()
	w.watch = f(w.watch)
}

func (w *Watch) GetID() string {
	// This always maps to the same local Envoy instance.
	return ""
}

  istioctl ps --xds-address istio.example.com:15012 --cert-dir ~/.istio-certs

  # Retrieve proxy status information via XDS from specific control plane in multi-control plane in-cluster configuration
  # (Select a specific control plane in an in-cluster canary Istio configuration.)
  istioctl ps --xds-label istio.io/rev=default
`,
		Aliases: []string{"ps"},

		}
		err = fw.Start()
		if err != nil {
			return nil, err
		}
		defer fw.Close()
		xdsOpts.Xds = fw.Address()
		// Use plaintext.
		response, err := xds.GetXdsResponse(dr, istioNamespace, tokenServiceAccount, xdsOpts, []grpc.DialOption{})
		if err != nil {
			return nil, fmt.Errorf("could not get XDS from the agent pod %q: %v", pod.Name, err)
		}
		for _, resource := range response.GetResources() {