}

// Spec to control the desired behavior of daemon set rolling update.
message RollingUpdateDaemonSet {
  // The maximum number of DaemonSet pods that can be unavailable during the
  // update. Value can be an absolute number (ex: 5) or a percentage of total
  // number of DaemonSet pods at the start of the update (ex: 10%). Absolute
  // number is calculated from percentage by rounding up.
  // This cannot be 0 if MaxSurge is 0

- In sidecar mode, the CNI plugin can configure sidecar networking for pods when they are scheduled by the container runtime, using iptables. The CNI handling the netns setup replaces the current Istio approach using a `NET_ADMIN` privileged `initContainers` container, `istio-init`, injected in the pods along with `istio-proxy` sidecars. This removes the need for a privileged, `NET_ADMIN` container in the Istio users'...

1. If the destination has a waypoint proxy, we must send to it to the waypoint (using HBONE).
   When we do this, we will want to preserve the original destination Service IP, as the waypoint can do a better job picking a backend pod than we can.

  C2_DOCKER_IP=$(docker inspect -f "{{ .NetworkSettings.Networks.kind.IPAddress }}" "${C2_NODE}")
  if [ "${POD_TO_POD_AND_SERVICE_CONNECTIVITY}" -eq 1 ]; then
    # Set up routing rules for inter-cluster direct pod to pod & service communication
    C1_POD_CIDR=$(KUBECONFIG="${C1_KUBECONFIG}" kubectl get node -ojsonpath='{.items[0].spec.podCIDR}')

  // port 443. Field is left optional to allow TLS routing based on SNI
  // hostname alone. If the SNI host in a listener conflicts with the "Host"
  // header field used by an IngressRule, the SNI host is used for termination
  // and value of the Host header is used for routing.
  // +optional
  optional string secretName = 2;

  // port 443. Field is left optional to allow TLS routing based on SNI
  // hostname alone. If the SNI host in a listener conflicts with the "Host"
  // header field used by an IngressRule, the SNI host is used for termination
  // and value of the "Host" header is used for routing.
  // +optional
  optional string secretName = 2;
}

  // SecretName is the name of the secret used to terminate SSL traffic on 443.
  // Field is left optional to allow SSL routing based on SNI hostname alone.
  // If the SNI host in a listener conflicts with the "Host" header field used
  // by an IngressRule, the SNI host is used for termination and value of the
  // Host header is used for routing.
  // +optional
  optional string secretName = 2;
}

}

// Spec to control the desired behavior of daemon set rolling update.
message RollingUpdateDaemonSet {
  // The maximum number of DaemonSet pods that can be unavailable during the
  // update. Value can be an absolute number (ex: 5) or a percentage of total
  // number of DaemonSet pods at the start of the update (ex: 10%). Absolute
  // number is calculated from percentage by rounding up.
  // This cannot be 0 if MaxSurge is 0

# Architecture of Istiod

This document describes the high level architecture of the Istio control plane, Istiod.
Istiod is structured as a modular monolith, housing a wide range of functionality from certificate signing, proxy configuration (XDS), traditional Kubernetes controllers, and more.

## Proxy Configuration

  optional int64 revision = 1;
}

// Spec to control the desired behavior of rolling update.
message RollingUpdateDeployment {
  // The maximum number of pods that can be unavailable during the update.
  // Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
  // Absolute number is calculated from percentage by rounding down.
  // This can not be 0 if MaxSurge is 0.
  // Defaults to 25%.