Policy Platform
Constant policy churn due to "All Workloads" with "Use Workload Subnets" (E-102250)
When either the provider or consumer of a rule is set to "all workloads" and the "use workload subnets" option was enabled for that side of the rule, the PCE did get into a state where VENs are almost always in "Active (Syncing)".
This issue is resolved.
Rule coverage for endpoints is timing-dependent (E-96488)
Workload -> workload rule coverage queries checked to verify that workloads were on the same network before returning any rules between them. This was very confusing with endpoints, because endpoint network membership changes frequently, which broke the explorer/illumination-driven policy-checking workflow. This issue is resolved.