anchor.diff:  
   {ProductName} does not automatically inject the sidecar to any pods, but requires you to opt in to injection using an annotation without labeling projects. This method requires fewer privileges and does not conflict with other OpenShift capabilities such as builder pods. To enable automatic injection you specify the `sidecar.istio.io/inject` annotation as described in the Automatic sidecar injection section.
   
  -[id="ossm-rbac_{context}"]
  -== Istio Role Based Access Control features
  -
  -Istio Role Based Access Control (RBAC) provides a mechanism you can use to control access to a service. You can identify subjects by user name or by specifying a set of properties and apply access controls accordingly.
  -
  -The upstream Istio community installation includes options to perform exact header matches, match wildcards in headers, or check for a header containing a specific prefix or suffix.
  -
  -{ProductName} extends the ability to match request headers by using a regular expression. Specify a property key of `request.regex.headers` with a regular expression.
  -
  -.Upstream Istio community matching request headers example
  -[source,yaml]
  -----
  -apiVersion: "rbac.istio.io/v1alpha1"
  -kind: ServiceRoleBinding
  -metadata:
  -  name: httpbin-client-binding
  -  namespace: httpbin
  -spec:
  -  subjects:
  -  - user: "cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account"
  -    properties:
  -      request.headers[<header>]: "value"
  -----
  -
  -.{ProductName} matching request headers by using regular expressions
  -[source,yaml]
  -----
  -apiVersion: "rbac.istio.io/v1alpha1"
  -kind: ServiceRoleBinding
  -metadata:
  -  name: httpbin-client-binding
  -  namespace: httpbin
  -spec:
  -  subjects:
  -  - user: "cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account"
  -    properties:
  -      request.regex.headers[<header>]: "<regular expression>"
  -----
  -
  -
   [id="ossm-openssl_{context}"]
   == OpenSSL
   
   {ProductName} replaces BoringSSL with OpenSSL. OpenSSL is a software library that contains an open source implementation of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. The {ProductName} Proxy binary dynamically links the OpenSSL libraries (libssl and libcrypto) from the underlying Red Hat Enterprise Linux operating system.
  +
  +
  +[id="ossm-external-workloads_{context}"]
  +== External workloads
  +
  +{ProductName} does not support external workloads (virtual machines).
   
   [id="ossm-component-modifications_{context}"]
   == Component modifications
  
positive.code: [id="ossm-cli-tool_{context}"]
  == Command line tool
  
  The command line tool for {ProductName} is oc.  {ProductName}  does not support istioctl.
  
  [id="ossm-automatic-injection_{context}"]
  == Automatic injection
  
negative.code: * Godebug has been removed from all templates
  * The `istio-multi` ServiceAccount and ClusterRoleBinding have been removed, as well as the `istio-reader` ClusterRole.
  
  [id="ossm-envoy-services_{context}"]
  == Envoy services
  
  * {ProductName} does not support QUIC-based services.
  
  [id="ossm-cni_{context}"]
  == Istio Container Network Interface (CNI) plug-in
  