 the patched versions, roles are limited to the bare minimum requirements based on the <a href=/v1.25/docs/setup/additional-setup/cni/#race-condition--mitigation>repair mode selected</a>. Previously, regardless of the configuration all roles were granted, and the roles that were granted were excessive.</p><p>An additional option can further mitigate any potential attacks, by completely removing the need for Istio CNI to have custom RBAC permissions; due to the possible risks associated with this new method,