Merge branch 'master' into feat/local-splide-threejs

Author: AritraDey-Dev

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
   "name": "istio build-tools",
-  "image": "gcr.io/istio-testing/build-tools:master-8d2a100a81731715ea16de11e8c9f23b2ddb3948",
+  "image": "gcr.io/istio-testing/build-tools:master-267d17ce87eaf154c1a6bc2bc743b9a27a12d551",
   "privileged": true,
   "remoteEnv": {
     "USE_GKE_GCLOUD_AUTH_PLUGIN": "True",

Makefile.core.mk

@@ -139,13 +139,13 @@ archive-version:
 netlify_install:
 	@npm init -y
 	@npm install --omit=dev --global \
-	    sass@v1.52.1 \
-	    typescript@v4.7.2 \
-	    svgstore-cli@v1.3.2 \
-		@babel/core@v7.18.2 \
-		@babel/cli@v7.17.10 \
+	    sass@v1.89.1 \
+	    typescript@v5.8.3 \
+	    svgstore-cli@v2.0.1 \
+		@babel/core@v7.27.4 \
+		@babel/cli@v7.27.2 \
 		@babel/traverse@7.25.9 \
-		@babel/preset-env@v7.18.2
+		@babel/preset-env@v7.27.2
 	@npm install --omit=dev --save-dev \
 		babel-preset-minify@v0.5.2
 	@npm install --save \

Makefile.overrides.mk

@@ -13,7 +13,11 @@
 # limitations under the License.
 
 # expose port 1313 from the container in order to support 'make serve' which runs a Hugo web server
+ifeq ($(filter serve,$(MAKECMDGOALS)),serve)
 CONTAINER_OPTIONS = -p 1313:1313 ${ADDITIONAL_CONTAINER_OPTIONS}
+else
+CONTAINER_OPTIONS = ${ADDITIONAL_CONTAINER_OPTIONS}
+endif
 
 # this repo is on the container plan by default
 BUILD_WITH_CONTAINER ?= 1

common/.commonfiles.sha

@@ -1 +1 @@
-5cc5ed563d6dff7b2ef302b4bddb57d4b4d462ef
+fa13a39d16201a043415263f1ce8ddfec1d69442

common/scripts/setup_env.sh

@@ -75,7 +75,7 @@ fi
 TOOLS_REGISTRY_PROVIDER=${TOOLS_REGISTRY_PROVIDER:-gcr.io}
 PROJECT_ID=${PROJECT_ID:-istio-testing}
 if [[ "${IMAGE_VERSION:-}" == "" ]]; then
-  IMAGE_VERSION=master-8d2a100a81731715ea16de11e8c9f23b2ddb3948
+  IMAGE_VERSION=master-267d17ce87eaf154c1a6bc2bc743b9a27a12d551
 fi
 if [[ "${IMAGE_NAME:-}" == "" ]]; then
   IMAGE_NAME=build-tools

content/en/docs/examples/bookinfo/test.sh

@@ -52,8 +52,8 @@ else
     _verify_like snip_determine_the_ingress_ip_and_port_2 "$snip_determine_the_ingress_ip_and_port_2_out"
 
     # give config some time to propagate
-    _wait_for_istio gateway default bookinfo-gateway
-    _wait_for_istio virtualservice default bookinfo
+    _wait_for_resource gateway default bookinfo-gateway
+    _wait_for_resource virtualservice default bookinfo
 
     # export the INGRESS_ environment variables
     _set_ingress_environment_variables

content/en/docs/ops/configuration/mesh/app-health-check/test.sh

@@ -38,7 +38,7 @@ snip_liveness_and_readiness_probes_using_the_command_approach_1
 
 snip_liveness_and_readiness_probes_using_the_command_approach_2
 
-_wait_for_istio peerauthentication istio-io-health default
+_wait_for_resource peerauthentication istio-io-health default
 
 snip_liveness_and_readiness_probes_using_the_command_approach_3
 

content/en/docs/ops/configuration/traffic-management/network-topologies/test.sh

@@ -44,8 +44,8 @@ else
     snip_deploy_httpbin_gateway
 
     # wait for for the rules to propagate
-    _wait_for_istio gateway httpbin httpbin-gateway
-    _wait_for_istio virtualservice httpbin httpbin
+    _wait_for_resource gateway httpbin httpbin-gateway
+    _wait_for_resource virtualservice httpbin httpbin
 
     snip_export_gateway_url
 fi

content/en/docs/reference/commands/install-cni/index.html

@@ -626,6 +626,12 @@ <h2 id="envvars">Environment variables</h2>
 <td>If enabled, selector based authorization policies will be enforced as L4 policies in front of the waypoint.</td>
 </tr>
 <tr>
+<td><code>ENABLE_LAZY_SIDECAR_EVALUATION</code></td>
+<td>Boolean</td>
+<td><code>true</code></td>
+<td>If enabled, pilot will only compute sidecar resources when actually used</td>
+</tr>
+<tr>
 <td><code>ENABLE_LEADER_ELECTION</code></td>
 <td>Boolean</td>
 <td><code>true</code></td>
@@ -674,6 +680,12 @@ <h2 id="envvars">Environment variables</h2>
 <td>If set, used Kubernetes native Sidecar container support. Requires SidecarContainer feature flag.</td>
 </tr>
 <tr>
+<td><code>ENABLE_PROXY_FIND_POD_BY_IP</code></td>
+<td>Boolean</td>
+<td><code>false</code></td>
+<td>If enabled, the pod controller will allow finding pods matching proxies by IP if it fails to find them by name.</td>
+</tr>
+<tr>
 <td><code>ENABLE_SELECTOR_BASED_K8S_GATEWAY_POLICY</code></td>
 <td>Boolean</td>
 <td><code>true</code></td>
@@ -692,6 +704,12 @@ <h2 id="envvars">Environment variables</h2>
 <td>If true, will use optimized vtprotobuf based marshaling. Requires a build with -tags=vtprotobuf.</td>
 </tr>
 <tr>
+<td><code>ENVOY_STATUS_PORT_ENABLE_PROXY_PROTOCOL</code></td>
+<td>Boolean</td>
+<td><code>false</code></td>
+<td>If enabled, Envoy will support requests with proxy protocol on its status port</td>
+</tr>
+<tr>
 <td><code>ENVOY_USER</code></td>
 <td>String</td>
 <td><code>istio-proxy</code></td>
@@ -969,7 +987,7 @@ <h2 id="envvars">Environment variables</h2>
 <td><code>PILOT_CONVERT_SIDECAR_SCOPE_CONCURRENCY</code></td>
 <td>Integer</td>
 <td><code>1</code></td>
-<td>Used to adjust the concurrency of SidecarScope conversions. When istiod is deployed on a multi-core CPU server, increasing this value will help to use the CPU to accelerate configuration push, but it also means that istiod will consume more CPU resources.</td>
+<td>Deprecated, superseded by ENABLE_LAZY_SIDECAR_EVALUATION. Used to adjust the concurrency of SidecarScope conversions. When istiod is deployed on a multi-core CPU server, increasing this value will help to use the CPU to accelerate configuration push, but it also means that istiod will consume more CPU resources.</td>
 </tr>
 <tr>
 <td><code>PILOT_DEBOUNCE_AFTER</code></td>
@@ -1044,6 +1062,12 @@ <h2 id="envvars">Environment variables</h2>
 <td>If enabled, pilot will run istio analyzers and write analysis errors to the Status field of any Istio Resources</td>
 </tr>
 <tr>
+<td><code>PILOT_ENABLE_CA_CRL</code></td>
+<td>Boolean</td>
+<td><code>false</code></td>
+<td>If set to true, Istio will watch for ca-crl.pem file in /etc/cacerts directory and will distribute crl data in each namespace in the cluster for proxies to consume. </td>
+</tr>
+<tr>
 <td><code>PILOT_ENABLE_CDS_CACHE</code></td>
 <td>Boolean</td>
 <td><code>true</code></td>

content/en/docs/reference/commands/istioctl/index.html

@@ -8479,6 +8479,12 @@ <h2 id="envvars">Environment variables</h2>
 <td>If enabled, selector based authorization policies will be enforced as L4 policies in front of the waypoint.</td>
 </tr>
 <tr>
+<td><code>ENABLE_LAZY_SIDECAR_EVALUATION</code></td>
+<td>Boolean</td>
+<td><code>true</code></td>
+<td>If enabled, pilot will only compute sidecar resources when actually used</td>
+</tr>
+<tr>
 <td><code>ENABLE_LEADER_ELECTION</code></td>
 <td>Boolean</td>
 <td><code>true</code></td>
@@ -8533,6 +8539,12 @@ <h2 id="envvars">Environment variables</h2>
 <td>If enabled, readiness probes will keep the connection from pilot-agent to the application alive. This mirrors older Istio versions&#39; behaviors, but not kubelet&#39;s.</td>
 </tr>
 <tr>
+<td><code>ENABLE_PROXY_FIND_POD_BY_IP</code></td>
+<td>Boolean</td>
+<td><code>false</code></td>
+<td>If enabled, the pod controller will allow finding pods matching proxies by IP if it fails to find them by name.</td>
+</tr>
+<tr>
 <td><code>ENABLE_SELECTOR_BASED_K8S_GATEWAY_POLICY</code></td>
 <td>Boolean</td>
 <td><code>true</code></td>
@@ -8551,6 +8563,12 @@ <h2 id="envvars">Environment variables</h2>
 <td>If true, will use optimized vtprotobuf based marshaling. Requires a build with -tags=vtprotobuf.</td>
 </tr>
 <tr>
+<td><code>ENVOY_STATUS_PORT_ENABLE_PROXY_PROTOCOL</code></td>
+<td>Boolean</td>
+<td><code>false</code></td>
+<td>If enabled, Envoy will support requests with proxy protocol on its status port</td>
+</tr>
+<tr>
 <td><code>EXTERNAL_ISTIOD</code></td>
 <td>Boolean</td>
 <td><code>false</code></td>
@@ -8876,7 +8894,7 @@ <h2 id="envvars">Environment variables</h2>
 <td><code>PILOT_CONVERT_SIDECAR_SCOPE_CONCURRENCY</code></td>
 <td>Integer</td>
 <td><code>1</code></td>
-<td>Used to adjust the concurrency of SidecarScope conversions. When istiod is deployed on a multi-core CPU server, increasing this value will help to use the CPU to accelerate configuration push, but it also means that istiod will consume more CPU resources.</td>
+<td>Deprecated, superseded by ENABLE_LAZY_SIDECAR_EVALUATION. Used to adjust the concurrency of SidecarScope conversions. When istiod is deployed on a multi-core CPU server, increasing this value will help to use the CPU to accelerate configuration push, but it also means that istiod will consume more CPU resources.</td>
 </tr>
 <tr>
 <td><code>PILOT_DEBOUNCE_AFTER</code></td>
@@ -8951,6 +8969,12 @@ <h2 id="envvars">Environment variables</h2>
 <td>If enabled, pilot will run istio analyzers and write analysis errors to the Status field of any Istio Resources</td>
 </tr>
 <tr>
+<td><code>PILOT_ENABLE_CA_CRL</code></td>
+<td>Boolean</td>
+<td><code>false</code></td>
+<td>If set to true, Istio will watch for ca-crl.pem file in /etc/cacerts directory and will distribute crl data in each namespace in the cluster for proxies to consume. </td>
+</tr>
+<tr>
 <td><code>PILOT_ENABLE_CDS_CACHE</code></td>
 <td>Boolean</td>
 <td><code>true</code></td>