/** Sets the [real] address for [requested].  */
  operator fun set(
    requested: InetAddress,
    real: InetSocketAddress,
  ) {
    hostMapping[requested] = real
  }

  override fun createSocket(): Socket {
    return object : Socket() {
      override fun connect(
        endpoint: SocketAddress?,
        timeout: Int,
      ) {
        val requested = (endpoint as InetSocketAddress)

}

// CertificateSigningRequestSpec contains the certificate request.
message CertificateSigningRequestSpec {
  // request contains an x509 certificate signing request encoded in a "CERTIFICATE REQUEST" PEM block.
  // When serialized as JSON or YAML, the data is additionally base64-encoded.
  // +listType=atomic
  optional bytes request = 1;

  // signerName indicates the requested signer, and is a qualified name.
  //

  repeated CertificateSigningRequest items = 2;
}

// CertificateSigningRequestSpec contains the certificate request.
message CertificateSigningRequestSpec {
  // Base64-encoded PKCS#10 CSR data
  // +listType=atomic
  optional bytes request = 1;

  // Requested signer for the request. It is a qualified name in the form:
  // `scope-hostname.io/name`.
  // If empty, it will be defaulted:

message AdmissionRequest {
  // UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
  // otherwise identical (parallel requests, requests when earlier requests did not modify etc)
  // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.

https://github.com/google/guava/wiki/HowToContribute#code-contributions
and
https://github.com/google/guava/blob/master/CONTRIBUTING.md
before sending a pull request.

We generally welcome PRs for fixing trivial bugs or typos, but please refrain
from sending a PR with significant changes unless explicitly requested.

message AdmissionRequest {
  // UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
  // otherwise identical (parallel requests, requests when earlier requests did not modify etc)
  // The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.

  // Spec holds information about the request being evaluated.  spec.namespace must be equal to the namespace
  // you made the request against.  If empty, it is defaulted.
  optional SubjectAccessReviewSpec spec = 2;

  // Status is filled in by the server and indicates whether the request is allowed or not
  // +optional
  optional SubjectAccessReviewStatus status = 3;
}

              println("Requested " + sslSocket.sslParameters.applicationProtocols.joinToString())
              println("Negotiated " + sslSocket.applicationProtocol)
            }
          },
        )
        .build()

    val request =
      Request.Builder()
        .url("https://www.google.com")
        .build()
    client.newCall(request).execute().use { response ->

### Default CA Flow through istio-agent

![CA Flow](docs/ca.svg)

A single SDS request from Envoy goes through a few different layers in istio-agent.

1. First, the request is handled by the SDS server. This is mostly just an intermediate translation layer exposing
   the `SecretManager` to Envoy, without much business logic. For each resource requested by Envoy, the SDS server
   will call `SecretManager.GenerateSecret(resourceName)`

  optional int32 desiredReplicas = 4;

  // currentCPUUtilizationPercentage is the current average CPU utilization over all pods, represented as a percentage of requested CPU,
  // e.g. 70 means that an average pod is using now 70% of its requested CPU.
  // +optional
  optional int32 currentCPUUtilizationPercentage = 5;
}

// MetricSpec specifies how to scale based on a single metric