# istio_pilot-load-dns-cert-known-location-deprecate-flags.yaml
apiVersion: release-notes/v2

# This YAML file describes the format for specifying a release notes entry for Istio.
# This should be filled in for all user facing changes.

# kind describes the type of change that this represents.
# Valid Values are:
# - bug-fix -- Used to specify that this change represents a bug fix.
# - security-fix -- Used to specify that this change represents a vulnerability fix.
# - feature -- Used to specify a new feature that has been added.
# - test -- Used to describe additional testing added. This file is optional for
#   tests, but included for completeness.
kind: feature
# area describes the area that this change affects.
# Valid values are:
# - traffic-management
# - security
# - telemetry
# - installation
# - istioctl
# - documentation
area: security

# issue is a list of GitHub issues resolved in this note.
# If issue is not in the current repo, specify its full URL instead.
issue:
  - 36916


# releaseNotes is a markdown listing of any user facing changes. This will appear in the
# release notes.
releaseNotes:
- |
  **Improved** Pilot will now load its DNS serving certificate from well known locations:
  ```
  /var/run/secrets/istiod/tls/tls.crt
  /var/run/secrets/istiod/tls/tls.key
  /var/run/secrets/istiod/ca/root-cert.pem
  ```
  The CA path will alternatively be loaded from: `/var/run/secrets/tls/ca.crt`
  It also automatically loads any secret called istiod-tls and the istio-root-ca-configmap into those paths.
  This method is preferred to use those well known paths than to set the tls args.
  This will allow for an easier installation process for istio-csr as well as any other external issuer that needs to modify
  the Pilot DNS serving certificate.