1. Config ingestion (inputs to the system)
1. Config translation
1. Config serving (XDS)

### Config Ingestion

Istio reads from over 20 different resources types, and aggregates them together to build the proxy configuration. These resources can be sourced from Kubernetes (via watches), files, or over xDS; Kubernetes is by far the most common usage, though.

Primarily for historical reasons, ingestion is split into a few components.

    return response
  }

  /**
   * Returns a new source that writes bytes to [cacheRequest] as they are read by the source
   * consumer. This is careful to discard bytes left over when the stream is closed; otherwise we
   * may never exhaust the source stream and therefore not complete the cached response.
   */
  @Throws(IOException::class)
  private fun cacheWritingResponse(
    cacheRequest: CacheRequest?,

    request: Request,
    proxyType: Proxy.Type,
  ): Boolean {
    return !request.isHttps && proxyType == Proxy.Type.HTTP
  }

  /**
   * Returns the path to request, like the '/' in 'GET / HTTP/1.1'. Never empty, even if the request
   * URL is. Includes the query component if it exists.
   */
  fun requestPath(url: HttpUrl): String {
    val path = url.encodedPath
    val query = url.encodedQuery

import java.net.InetAddress
import java.net.UnknownHostException
import okhttp3.HttpUrl.Companion.toHttpUrl
import okhttp3.OkHttpClient

/**
 * Temporary registry of known DNS over HTTPS providers.
 *
 * https://github.com/curl/curl/wiki/DNS-over-HTTPS
 */
object DohProviders {
  private fun buildGoogle(bootstrapClient: OkHttpClient): DnsOverHttps {
    return DnsOverHttps.Builder()
      .client(bootstrapClient)

      }
    } else {
      super.getSelectedProtocol(sslSocket)
    }

  companion object {
    val isSupported: Boolean =
      try {
        // Trigger an early exception over a fatal error, prefer a RuntimeException over Error.
        Class.forName("org.openjsse.net.ssl.OpenJSSE", false, javaClass.classLoader)

        true
      } catch (_: ClassNotFoundException) {
        false
      }

 * address, the two URLs identify different resources.
 *
 * ### Port
 *
 * The port used to connect to the web server. By default this is 80 for HTTP and 443 for HTTPS.
 * This class never returns -1 for the port: if no port is explicitly specified in the URL then the
 * scheme's default is used.
 *
 * ### Path
 *

  /**
   * Returns the tag attached with `Object.class` as a key, or null if no tag is attached with
   * that key.
   *
   * Prior to OkHttp 3.11, this method never returned null if no tag was attached. Instead it
   * returned either this request, or the request upon which this request was derived with
   * [newBuilder].
   *

  //
  // Well-known Kubernetes signers are:
  //  1. "kubernetes.io/kube-apiserver-client": issues client certificates that can be used to authenticate to kube-apiserver.
  //   Requests for this signer are never auto-approved by kube-controller-manager, can be issued by the "csrsigning" controller in kube-controller-manager.

    assertThat(hpackReader!!.getAndResetHeaderList()).isEqualTo(headerBlock)
  }

  @Test
  fun literalHeaderFieldNeverIndexedIndexedName() {
    bytesIn.writeByte(0x14) // == Literal never indexed ==
    // Indexed name (idx = 4) -> :path
    bytesIn.writeByte(0x0c) // Literal value (len = 12)
    bytesIn.writeUtf8("/sample/path")
    hpackReader!!.readHeaders()

  }

  /** Returns true if there's another proxy to try. */
  private fun hasNextProxy(): Boolean = nextProxyIndex < proxies.size

  /** Returns the next proxy to try. May be PROXY.NO_PROXY but never null. */
  @Throws(IOException::class)
  private fun nextProxy(): Proxy {
    if (!hasNextProxy()) {
      throw SocketException(
        "No route to ${address.url.host}; exhausted proxy configurations: $proxies",