apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management

issue:
  - https://github.com/kubernetes-sigs/gateway-api/issues/2309

releaseNotes:
- |
  **Fixed** Istio's Gateway API implementation to adhere to the Gateway API
  requirement that a `group: ""` field must be set for a `parentRef` of `kind: Service`.
  Istio previously tolerated the missing group for Service-kind parent references. This

					suite.GatewayHTTPConformanceProfileName,
					suite.GatewayTLSConformanceProfileName,
					suite.GatewayGRPCConformanceProfileName,
					suite.MeshHTTPConformanceProfileName,
				),
				Implementation: confv1.Implementation{
					Organization: "istio",
					Project:      "istio",
					URL:          "https://istio.io/",
					Version:      istioVersion,
					Contact:      []string{"@istio/maintainers"},
				},

)

// Controller is an implementation of ConfigStoreController.
type Controller struct {
	monitor     Monitor
	configStore model.ConfigStore
	hasSynced   func() bool

	// If meshConfig.DiscoverySelectors are specified, the namespacesFilter tracks the namespaces this controller watches.
	namespacesFilter func(obj interface{}) bool
}

// NewController return an implementation of ConfigStoreController

)

// NewHandler returns an http.Handler that wraps h, intercepting any h2c
// traffic. See h2c.NewHandler for details.
// Unlike the normal handler, this handler prevents h2c Upgrades, which are not safe in Go's implementation;
// see https://github.com/golang/go/issues/56352.
// This means we allow only HTTP/1.1 or HTTP/2 prior knowledge.
func NewHandler(h http.Handler, s *http2.Server) http.Handler {
	return denyH2cUpgrade(h2c.NewHandler(h, s))

		copyBuffered(pw, conn, log.WithLabels("name", "conn to pipe"))

		wg.Wait()
		log.Infof("stream closed in %v", time.Since(t0))
	}()

	return nil
}

// TLSDialWithDialer is an implementation of tls.DialWithDialer that accepts a generic Dialer
func TLSDialWithDialer(dialer Dialer, network, addr string, config *tls.Config) (*tls.Conn, error) {
	return tlsDial(context.Background(), dialer, network, addr, config)
}

releaseNotes:
  - |
    **Improved** the ordering of HTTP and TCP envoy filters to improve consistency
upgradeNotes:
  - title: "Envoy filter ordering"
    content: |
      This change impacts internal implementation of how Envoy "filters" are ordered. These filters run in order to implement various functionality.
      
      The ordering is now consistent across inbound, outbound and gateway proxy modes, as well as HTTP and TCP protocols:

# PeerAuthentication Implementation in Ambient

func NewSDSWriter(w io.Writer, format Format) SDSWriter {
	return &sdsWriter{
		w:      w,
		output: format,
	}
}

// sdsWriter is provided concrete implementation of SDSWriter
type sdsWriter struct {
	w      io.Writer
	output Format
}

// PrintSecretItems uses the user supplied output format to determine how to display the diffed secrets

#include "plugin.h"

#ifndef INJECTION_VERSION
#error INJECTION_VERSION must be defined
#endif // INJECTION_VERSION

#define xstr(s) str(s)
#define str(s) #s

// Boilderplate code to register the extension implementation.
static RegisterContextFactory register_HeaderInjector(CONTEXT_FACTORY(HeaderInjectorContext),
                                               ROOT_FACTORY(HeaderInjectorRootContext));

	}

	return s
}

type schemaImpl struct {
	resource     resource.Schema
	name         config.GroupVersionKind
	variableName string
}

// String interface method implementation.
func (s *schemaImpl) String() string {
	return fmt.Sprintf("[Schema](%s, %q, %s)", s.name, s.resource.ProtoPackage(), s.resource.Proto())
}

func (s *schemaImpl) VariableName() string {
	return s.variableName
}