# istio_ambient-dns-on.yaml
apiVersion: release-notes/v2
kind: feature
area: traffic-management
issues:
    - 1360
releaseNotes:
  - |
    **Promoted** the `cni.ambient.dnsCapture` value to default to `true`.
    This enables the DNS proxying for workloads in ambient mesh by default, improving security, performance, and enabling
    a number of features. This can be disabled explicitly or with `compatibilityVersion=1.24`.
    Note: only new pods will have DNS enabled. To enable for existing pods, pods must be manually restarted, or the iptables reconcilation feature must be enabled with `--set cni.ambient.reconcileIptablesOnStartup=true`.

upgradeNotes:
  - title: Ambient DNS capture on by default
    content: |
        DNS proxying is enabled by default for ambient workloads in this release. Note that only new pods will have DNS enabled, existing pods will not have their DNS traffic captured.
        To enable this feature for existing pods, existing pods must either be manually restarted, or alternatively the iptables reconcilation feature can be enabled when upgrading
        `istio-cni` via `--set cni.ambient.reconcileIptablesOnStartup=true` which will reconcile existing pods automatically on upgrade.