apiVersion: release-notes/v2
kind: feature
area: security

releaseNotes:
- |
  **Added** An environment variable METRICS_LOCALHOST_ACCESS_ONLY for disabling 
  metrics endpoint from outside of the pod, to allow only localhost access. User can use set this with command
  `--set values.pilot.env.METRICS_LOCALHOST_ACCESS_ONLY=true` for Control plane and  
  `--set meshConfig.defaultConfig.proxyMetadata.METRICS_LOCALHOST_ACCESS_ONLY=true` for proxy while istioctl installation.
