apiVersion: v1
kind: ServiceAccount
metadata:
  name: konnectivity-agent
  namespace: kube-system
  labels:
    kubernetes.io/cluster-service: "true"

apiVersion: release-notes/v2
kind: feature
area: istioctl
issue:
  - 28231

releaseNotes:
- |
  **Fixed** user-agent in all istio binaries to include version.

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue: [22274]
releaseNotes:
- |
  **Added** The Istio sidecar agent will offer HTTP endpoint localhost:15009/debug/<typeurl>.  GET requests
  to that URL will be resolved by sending an xDS discovery "event" to istiod.  This can be disabled by setting

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
- 39598
releaseNotes:
- |

metadata:
  creationTimestamp: null
  name: grpc
spec:
  selector:
    matchLabels:
      app: grpc
  strategy: {}
  template:
    metadata:
      annotations:
        inject.istio.io/templates: grpc-agent
        istio.io/rev: default
        kubectl.kubernetes.io/default-container: traffic
        kubectl.kubernetes.io/default-logs-container: traffic
        prometheus.io/path: /stats/prometheus

kind: bug-fix
area: traffic-management
issue:
- 36390

releaseNotes:
- |
  **Improved** istio-agent health probe rewrite to not re-use connections, mirring Kubernetes' probing behavior.

upgradeNotes:
- title: Health Probes will no longer re-use connections
  content: |
    Health probes using the istio-agent [health probe rewrite](https://istio.io/latest/docs/ops/configuration/mesh/app-health-check/) will

apiVersion: release-notes/v2
kind: feature
area: networking
issue:
- 26826
releaseNotes:
- |
  **Added** Experimental DNS resolution in the Istio agent to better support use cases like service entries
  with TCP services without VIPs, multicluster DNS resolution, and DNS resolution of Kubernetes services
  from VM sidecars. This feature is disabled by default and can be enabled by setting the following in the

apiVersion: release-notes/v2
kind: feature
area: networking
issue: []
releaseNotes:
- |
  **Updated** XDS connections from Envoy will be proxied through the Istio sidecar agent. Doing so allows
  for consolidation of multiple connections from a pod to Istiod into a single connection, in addition to
  other planned future improvements. This feature (and change) is transparent to users and is enabled by default.

                    // This agent should be loaded via the custom system ClassLoader
                    assert ClassLoader.getSystemClassLoader() instanceof MySystemClassLoader : "systemClassLoader is not an instanceof MySystemClassLoader";

//go:build agent
// +build agent

// Code generated by pkg/config/schema/codegen/tools/collections.main.go. DO NOT EDIT.

package collections

import (
	"istio.io/istio/pkg/config/schema/collection"
	"istio.io/istio/pkg/config/schema/resource"
	"istio.io/istio/pkg/config/validation"

	"reflect"

	istioioapiextensionsv1alpha1 "istio.io/api/extensions/v1alpha1"
	istioioapimeshv1alpha1 "istio.io/api/mesh/v1alpha1"