# Architecture of Istiod

This document describes the high level architecture of the Istio control plane, Istiod.
Istiod is structured as a modular monolith, housing a wide range of functionality from certificate signing, proxy configuration (XDS), traditional Kubernetes controllers, and more.

## Proxy Configuration

```console
kubectl create namespace istio-system
helm install istiod istio/istiod --namespace istio-system
```

## Uninstalling the Chart

To uninstall/delete the `istiod` deployment:

```console
helm delete istiod --namespace istio-system
```

## Configuration

To view support configuration options and documentation, run:

```console
helm show values istio/istiod
```

### Profiles

At a high level, the Istio agent acts as an intermediate proxy between Istiod and Envoy. This is done
at two levels. For distributing workload certificates, Envoy will send [SDS](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret)
requests to the agent, causing the agent to submit a CSR to the configured CA (generally Istiod). For other configuration,

spiffe://cluster.local/ns/istio-system/sa/istiod         Leaf     Available        true           e5dfb59150b2ba7f108d93dcec5aa613     2033-03-22T13:04:57Z     2023-03-21T13:02:57Z
spiffe://cluster.local/ns/istio-system/sa/istiod         Root     Available        false          8a516645c40ce76c2c0d27ab4e2461c1     2022-03-18T13:04:49Z     2022-03-21T13:04:49Z

httpbin            httpbin-65975d4c6f-jr69n                             10.244.1.10 ambient-worker        None                                TCP
istio-system       istiod-8c7b98fc4-mwjfp                               10.244.2.49 ambient-worker2       None                                TCP
istio-system       istiod-test-6bdfb786d-s58pj                          10.244.1.34 ambient-worker        None                                TCP

10.10.10.11 istiod-rev-1.istio-system.svc...

NAME       CLUSTER      CDS       LDS        EDS        RDS          ECDS         ISTIOD      VERSION
proxy1     cluster1     STALE     SYNCED     SYNCED     NOT SENT     NOT SENT     istiod1     1.20

	cp manifests/charts/istio-control/istio-discovery/templates/reader-clusterrole.yaml manifests/charts/istiod-remote/templates
	cp manifests/charts/istio-control/istio-discovery/templates/reader-clusterrolebinding.yaml manifests/charts/istiod-remote/templates

	# external istiod config cluster charts
	cp manifests/charts/istio-control/istio-discovery/files/injection-template.yaml manifests/charts/istiod-remote/files

NAME       CLUSTER      CDS          LDS         EDS         RDS          ECDS         ISTIOD      VERSION
proxy1     cluster1     STALE        SYNCED      SYNCED      NOT SENT     SYNCED       istiod1     1.20
proxy2     cluster2     STALE        SYNCED      STALE       SYNCED       STALE        istiod2     1.19
proxy3     cluster3     NOT SENT     ERROR       STALE       NOT SENT     NOT SENT     istiod3     1.20

```console
helm install istio-cni -n kube-system manifests/charts/istio-cni --set profile=openshift
```

3) `istio-control/istio-discovery` chart installs a revision of istiod.

```console