apiVersion: release-notes/v2
kind: bug-fix
area: telemetry
releaseNotes:
- |
  **Updated** Prometheus telemetry behavior for inbound traffic to disable host header fallback by default. This will
  prevent traffic coming from out-of-mesh locations from potential polluting the `destination_service` dimension in
  metrics with junk data (and exploding metrics cardinality). With this change, it is possible that users relying on

  # https://github.com/kubernetes/kubernetes/issues/75561.
  metadata+="disable-address-manager=true,"
  metadata+="serial-port-enable=1,"
  # This enables logging the serial port output.
  # https://cloud.google.com/compute/docs/instances/viewing-serial-port-output
  metadata+="serial-port-logging-enable=true,"
  metadata+="win-version=${WINDOWS_NODE_OS_DISTRIBUTION}"
  echo "${metadata}"
}

      - prefix(istio.io/) # Groups all imports with the specified Prefix.
  gocritic:
    # Disable all checks.
    # Default: false
    disable-all: true
    # Which checks should be enabled in addition to default checks. Since we don't want
    # all of the default checks, we do the disable-all first.
    enabled-checks:
      - appendCombine
      - argOrder
      - assignOp
      - badCond

    echo "Bailing out." >&2
    exit 3
    ;;
esac

file=kubernetes.tar.gz
release=${KUBERNETES_RELEASE:-"release/stable"}

# Validate Kubernetes release version.
# Translate a published version <bucket>/<version> (e.g. "release/stable") to version number.
set_binary_version "${release}"
if [[ -z "${KUBERNETES_SKIP_RELEASE_VALIDATION-}" ]]; then

Sterling Greene <******@****.***> 1717795469 -0400

        """

        buildFile << customTaskCode()

        expect:
        executer.withBuildCacheEnabled()
        succeeds("customTask")
        !localBuildCache.empty
    }

    def "can enable with settings.gradle"() {
        settingsFile << """
            gradle.startParameter.buildCacheEnabled = true
            buildCache {
                local {
                    directory = '$cacheDir'

		}
		if($name =~ /^SYS_CAP_+/ || $name =~ /^SYS___CAP_+/){
			next
		}

		print "	$name = $num;  // $proto\n";

		# We keep Capsicum syscall numbers for FreeBSD
		# 9-STABLE here because we are not sure whether they
		# are mature and stable.
		if($num == 513){
			print " SYS_CAP_NEW = 514 // { int cap_new(int fd, uint64_t rights); }\n";
			print " SYS_CAP_GETRIGHTS = 515 // { int cap_getrights(int fd, \\\n";

            // Can explicitly disable property using system property
            Option.Value<Boolean> option = options.getOption(new InternalFlag(flag.getSystemPropertyName()));
            if (option.isExplicit() || option.get()) {
                return option.get();
            }
        }
        return enabled.contains(flag);
    }

    @Override
    public void enable(FeatureFlag flag) {
        enabled.add(flag);

if [[ ${KUBE_RUN_COPY_OUTPUT} =~ ^[yY]$ ]]; then
  kube::log::status "Output from this container will be rsynced out upon completion. Set KUBE_RUN_COPY_OUTPUT=n to disable."
else
  kube::log::status "Output from this container will NOT be rsynced out upon completion. Set KUBE_RUN_COPY_OUTPUT=y to enable."
fi

kube::build::run_build_command "$@"

if [[ ${KUBE_RUN_COPY_OUTPUT} =~ ^[yY]$ ]]; then
  kube::build::copy_output

	// 1. Both `--admission-control` and `--enable-admission-plugins` are specified
	options := NewAdmissionOptions()
	options.PluginNames = []string{"ServiceAccount"}
	options.GenericAdmission.EnablePlugins = []string{"NodeRestriction"}
	if len(options.Validate()) == 0 {
		t.Errorf("Expect error, but got none")
	}

	// 2. Both `--admission-control` and `--disable-admission-plugins` are specified
	options = NewAdmissionOptions()