apiVersion: release-notes/v2
kind: feature
area: traffic-management

issue:
  - 40919

releaseNotes:
  - |
    **Added** Allow creating inbound listeners for service ports and sidecar
    and ingress listener both using environment variable
    PILOT_ALLOW_SIDECAR_SERVICE_INBOUND_LISTENER_MERGE.
    This way traffic for service port is not sent via pass-through tcp even
    though its regular http traffic when sidecar ingress listener is defined.

annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}" traffic.sidecar.istio.io/includeOutboundIPRan: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRan` .Values.global.proxy.includeIPRanges }}" traffic.sidecar.istio.io/excludeOutboundIPRan: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRan` .Values.global.proxy.excludeIPRanges }}" traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.i...

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issues:
- 40474
releaseNotes:
- |
  **Fixed** an issue causing traffic to not match (and return a `404`) when using wildcard domain names and including an unexpected port in the `Host` header.
- |
  **Fixed** an issue causing traffic to match an unexpected route when using wildcard domain names and including an port in the `Host` header.
- |

      service, and traffic matching the service was sent to the configured DNS name.
      
      This caused a few issues:
      * Ports are required in Istio, but not in Kubernetes. This can result in broken traffic if ports are not configured as Istio expects, despite them working without Istio.

			},
		},
		{
			Name:     "HTTPS Traffic",
			PortName: "https",
			Expected: Expected{
				Query: prometheus.Query{
					Metric:      "istio_tcp_connections_closed_total",
					Aggregation: "sum",
					Labels: map[string]string{
						"destination_service_name": "BlackHoleCluster",
					},
				},
			},
		},
		{
			Name:     "HTTPS Traffic Conflict",
			PortName: "https-conflict",

            type: object
          spec:
            properties:
              applyOnForward:
                description: ApplyOnForward indicates to apply the rules in this policy
                  on forward traffic.
                type: boolean
              doNotTrack:
                description: DoNotTrack indicates whether packets matched by the rules

	"to":    "List of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.",...

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue: []
releaseNotes:
  - |

      service, and traffic matching the service was sent to the configured DNS name.

      This caused a few issues:
      * Ports are required in Istio, but not in Kubernetes. This can result in broken traffic if ports are not configured as Istio expects, despite them working without Istio.

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
- |