apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
- https://github.com/istio/istio/issues/49878
releaseNotes:
- |

        app: echo
        version: v1
    spec:
      containers:
        - args:
          - --metrics=15014
          - --port
          - "18080"
          - --tcp
          - "19090"
          - --xds-grpc-server=17070
          - --grpc
          - "17070"
          - --grpc
          - "17171"
          - --port
          - "3333"
          - --port
          - "8080"
          - --version

apiVersion: release-notes/v2
kind: feature
area: telemetry
issue: []
releaseNotes:
  - |

			nil,
		},
		// mock type
		{
			&config.MockConfig{Key: "foobar"},
			func(c Spec) Spec {
				c.(*config.MockConfig).Key = "bar"
				return c
			},
			protocmp.Transform(),
		},
		// XDS type, to test golang/proto
		{
			&cluster.Cluster{Name: "foobar"},
			func(c Spec) Spec {
				c.(*cluster.Cluster).Name = "bar"
				return c
			},
			protocmp.Transform(),
		},

// See the License for the specific language governing permissions and
// limitations under the License.

import (
	"testing"

	matcher "github.com/cncf/xds/go/xds/type/matcher/v3"
	"github.com/google/go-cmp/cmp"

	"istio.io/istio/pkg/util/protomarshal"
)

func TestCleanupEmptyMaps(t *testing.T) {
	tc := []struct {
		name  string
		given func() Mapper

apiVersion: release-notes/v2
kind: feature
area: networking
issue:
- https://github.com/istio/istio/issues/25685
releaseNotes:
- |
  **Added** support for backpressure on XDS pushes to avoid overloading Envoy during periods of high configuration

This sample demonstrates Istio's Proxyless gRPC support with a special injection template `grpc-agent`.
The template injects the `istio-proxy` sidecar, but the sidecar will only run `pilot-agent` and not envoy.

See the [gRPC xDS feature status](https://github.com/grpc/grpc/blob/master/doc/grpc_xds_features.md) for more

apiVersion: release-notes/v2
kind: feature
area: telemetry
releaseNotes:
- |
  **Added** xDS workload metadata discovery to TCP metadata exchange filter as a fallback. This requires enabling `PEER_METADATA_DISCOVERY` flag on the proxy, and `PILOT_ENABLE_AMBIENT_CONTROLLERS` on the control plane.

            value: 8090 # OVERRIDDEN
        - kind: Service
          name: istiod
          patches:
          - path: spec.ports.[name:grpc-xds].port

	// TODO for now, we leave mTLS *off* by default:
	// 1. We don't know if the client uses xds.NewClientCredentials; these settings will be ignored if not
	// 2. We cannot reach servers in PERMISSIVE mode; gRPC doesn't allow us to override the alpn to one of Istio's
	// 3. Once we support gRPC servers, we have no good way to detect if a server is implemented with xds.NewGrpcServer and will actually support our config