# istio_verify-sa-for-gateway-secrets.yaml
apiVersion: release-notes/v2

# This YAML file describes the format for specifying a release notes entry for Istio.
# This should be filled in for all user facing changes.

# kind describes the type of change that this represents.
# Valid Values are:
# - bug-fix -- Used to specify that this change represents a bug fix.
# - security-fix -- Used to specify that this change represents a vulnerability fix.
# - feature -- Used to specify a new feature that has been added.
# - test -- Used to describe additional testing added. This file is optional for
#   tests, but included for completeness.
kind: security-fix

area: security

issue: []

releaseNotes:
  - |
    **Improved**: For Kubernetes Gateway API gateways, access to referenced TLS secrets
    now requires both namespace and service account match (previously only namespace) or an explicit `ReferenceGrant`.
    Gateways using a hostname address remain namespace-only.