# Istio Agent

This document describes the internal architecture of Istio agent.

## High Level overview

![High Level overview](docs/overview.svg)

At a high level, the Istio agent acts as an intermediate proxy between Istiod and Envoy. This is done
at two levels. For distributing workload certificates, Envoy will send [SDS](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret)

    if (configuredLoggers.add(logger)) {
      logger.useParentHandlers = false
      // log based on levels at startup to avoid logging each frame
      logger.level =
        when {
          Log.isLoggable(tag, Log.DEBUG) -> Level.FINE
          Log.isLoggable(tag, Log.INFO) -> Level.INFO
          else -> Level.WARNING
        }
      logger.addHandler(AndroidLogHandler)
    }
  }

        pj--trigger-->c
    end
```

At a high level, each client job will find the correct generator for the request, generate the required configuration, and send it.

#### Optimizations

A naive implementation would simply regenerate all resources, of all subscribed types, for each client, on any configuration change. However, this scales poorly. As a result, we have many levels of optimizations to avoid doing this work.

import org.jetbrains.kotlin.analysis.low.level.api.fir.compile.isForeignValue
import org.jetbrains.kotlin.analysis.low.level.api.fir.providers.jvmClassNameIfDeserialized
import org.jetbrains.kotlin.analysis.low.level.api.fir.sessions.llFirSession
import org.jetbrains.kotlin.analysis.low.level.api.fir.util.getContainingFile
import org.jetbrains.kotlin.analysis.low.level.api.fir.util.originalDeclaration

  @Deprecated(
    message = "moved to val",
    replaceWith = ReplaceWith(expression = "noCache"),
    level = DeprecationLevel.ERROR,
  )
  fun noCache(): Boolean = noCache

  @JvmName("-deprecated_noStore")
  @Deprecated(
    message = "moved to val",
    replaceWith = ReplaceWith(expression = "noStore"),
    level = DeprecationLevel.ERROR,
  )
  fun noStore(): Boolean = noStore

  @JvmName("-deprecated_maxAgeSeconds")

    message = "moved to val",
    replaceWith = ReplaceWith(expression = "tlsVersion"),
    level = DeprecationLevel.ERROR,
  )
  fun tlsVersion(): TlsVersion = tlsVersion

  @JvmName("-deprecated_cipherSuite")
  @Deprecated(
    message = "moved to val",
    replaceWith = ReplaceWith(expression = "cipherSuite"),
    level = DeprecationLevel.ERROR,
  )
  fun cipherSuite(): CipherSuite = cipherSuite

import org.jetbrains.kotlin.analysis.api.lifetime.withValidityAssertion
import org.jetbrains.kotlin.analysis.low.level.api.fir.api.DiagnosticCheckerFilter
import org.jetbrains.kotlin.analysis.low.level.api.fir.api.collectDiagnosticsForFile
import org.jetbrains.kotlin.analysis.low.level.api.fir.api.getDiagnostics
import org.jetbrains.kotlin.psi.KtElement
import org.jetbrains.kotlin.psi.KtFile

{
  "cniVersion": "0.3.1",
  "name": "istio-cni",
  "type": "istio-cni",
  "log_level": "__LOG_LEVEL__",
  "kubernetes": {
      "kubeconfig": "__KUBECONFIG_FILENAME__",
      "cni_bin_dir": "/path/cni/bin"
  }

import org.jetbrains.kotlin.analysis.api.fir.KtFirAnalysisSession
import org.jetbrains.kotlin.analysis.api.lifetime.KtLifetimeToken
import org.jetbrains.kotlin.analysis.low.level.api.fir.util.originalDeclaration
import org.jetbrains.kotlin.analysis.low.level.api.fir.util.originalKtFile
import org.jetbrains.kotlin.psi.KtDeclaration
import org.jetbrains.kotlin.psi.KtFile

internal class KtFirOriginalPsiProvider(

    {
      "etcd_endpoints": "http://10.110.0.136:6666",
      "ipam": {
        "type": "calico-ipam"
      },
      "kubernetes": {
        "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
      },
      "log_level": "info",
      "mtu": 1500,
      "policy": {
        "type": "k8s"
      },
      "type": "calico"
    },
    {
      "capabilities": {
        "portMappings": true
      },
      "snat": true,