apiVersion: release-notes/v2
kind: bug-fix
area: security
releaseNotes:
- |
  **Improved** TLS configuration on sidecar server side inbound paths to enforce TLSv2 version along with recommended cipher suites.

area: networking
issues:
  - 26861
releaseNotes:
- |
  **Updated** the inbound Envoy cluster name format to reduce 503 errors during Service changes.

upgradeNotes:
- title: Inbound Cluster Name Format
  content: |
    The format of inbound Envoy cluster names has changed. Previously, they included the Service hostname
    and port name, such as `inbound|80|http|httpbin.default.svc.cluster.local`. This lead to issues when multiple

apiVersion: release-notes/v2
kind: bug-fix 
area: networking
releaseNotes:
- |

apiVersion: release-notes/v2
kind: bug-fix
area: networking
issue:
- 29412
releaseNotes:
- |
  **Improved** the `istioctl x workload` command to configure VMs to disable inbound `iptables` capture

}

func (k kubeComponent) ID() resource.ID {
	return k.id
}

func (k kubeComponent) Close() error {
	if k.inbound != nil {
		k.inbound.Close()
	}
	if k.outbound != nil {
		k.outbound.Close()
	}
	return nil
}

// WaypointProxy describes a waypoint proxy deployment
type WaypointProxy interface {
	Namespace() namespace.Instance
	Inbound() string
	Outbound() string
	PodIP() string
}

      "type": 4,
      "connect_timeout": 1000000000,
      "lb_policy": 4,
      "LbConfig": null
    },
    "inbound|7070|tcplocal|s1tcp.none": {
      "name": "inbound|7070|tcplocal|s1tcp.none",
      "connect_timeout": 1000000000,
      "load_assignment": {
        "cluster_name": "inbound|7070|tcplocal|s1tcp.none",
        "endpoints": [
          {
            "lb_endpoints": [
              {

*/

package phases

import (
	"k8s.io/klog/v2"
)

// unmountKubeletDirectory is a NOOP on all but linux.
func unmountKubeletDirectory(kubeletRunDirectory string, flags []string) error {
	klog.Warning("Cannot unmount filesystems on current OS, all mounted file systems will need to be manually unmounted")
	return nil

kind: feature
area: traffic-management
releaseNotes:
- |
  **Removed** the `PILOT_ENABLE_INBOUND_PASSTHROUGH` setting, which has been enabled-by-default for the past 8 releases.

ECDS NAME                                                     TYPE
istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP      
istio.io/telemetry/stats/prometheus/sidecar/Inbound/TCP       
istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP     
istio.io/telemetry/stats/prometheus/sidecar/Outbound/TCP      
default.display-metadata                                      envoy.extensions.filters.http.wasm.v3.Wasm

		{Name: "inbound|9999||mgmtCluster"},
	}
	sidecarInboundOut := []*cluster.Cluster{
		{Name: "cluster1", DnsLookupFamily: cluster.Cluster_V6_ONLY, LbPolicy: cluster.Cluster_RING_HASH},
	}

	sidecarInboundServiceIn := []*cluster.Cluster{
		{Name: "inbound|7443||", DnsLookupFamily: cluster.Cluster_V4_ONLY, LbPolicy: cluster.Cluster_ROUND_ROBIN},
	}