Upstream added CEL validations for service entry and other CRDs in Istio 1.23. OSSM 2.6 customers might have CRs which are not valid in OSSM 3.0 for example a ServiceEntry with more than 256 hosts. This is blocking the migration and customers must split the hosts between multiple serviceEntry resources.

We need to document in our migration doc:

• warning about this new validation
• how to verify the CRs are not affected
• a workaround - probably splitting between multiple resources - to be verified!!