digraph {
    grpc -> ca [label="Send CSR gRPC Request"]
    subgraph cluster_istioagent {
        label = "Istio Agent"
        color="orange"
        sds
        SecretManager -> caClient [label="Sign CSR"]
        caClient -> grpc
        grpc -> TokenProvider [dir=none,label="Fetch JWT",color=purple]
        grpc -> cfiles [dir=none,label="Fetch Cert",color=purple]

        sds -> SecretManager [label="Generate certificate"]

10.244.0.156:9402                                HEALTHY                  outbound|9402||cert-manager-istio-csr-metrics.cert-manager.svc.cluster.local
10.244.0.156:6443                                HEALTHY                  outbound|443||cert-manager-istio-csr.cert-manager.svc.cluster.local

digraph {
    envoy -> sds [dir=both, label="SDS"]
    envoy -> xdsproxy  [dir=both, label="ADS"]

    sds -> ca [label="CSR"]

    xdsproxy -> discovery [dir=both,label="ADS"]

    envoy [shape=hexagon, color=purple]

    subgraph cluster_istioagent {
        label = "Istio Agent"
        color="orange"
        sds
        xdsproxy
    }

    subgraph cluster_istiod {
        label = "Istiod"
        color="lightblue"

	CMP R3, $0, CR0                 // CMP R3,CR0,$0        // 2c230000
	CMPU R3, $0, CR1                // CMPU R3,CR1,$0       // 28a30000
	CMPW R3, $0, CR2                // CMPW R3,CR2,$0       // 2d030000
	CMPW R3, $-32768, CR2           // CMPW R3,CR2,$-32768  // 2d038000
	CMPWU R3, $0, CR3               // CMPWU R3,CR3,$0      // 29830000
	CMPWU R3, $0x8008, CR3          // CMPWU R3,CR3,$32776  // 29838008

        assertContentType("image/vnd.dxf", "extractor/dxf/autocad_R12_LT2.dxf", "autocad_R12_LT2.dxf");

        assertContentType("text/x-csrc", "extractor/program/test.c", "test.c");
        assertContentType("text/x-c++src", "extractor/program/test.cpp", "test.cpp");
        assertContentType("text/x-chdr", "extractor/program/test.h", "test.h");

	VCMPGTSQ V1, V2, V3                     // 10611387
	VCMPGTSQCC V1, V2, V3                   // 10611787
	VCMPGTUQ V1, V2, V3                     // 10611287
	VCMPGTUQCC V1, V2, V3                   // 10611687
	VCMPSQ V1, V2, CR2                      // 11011141
	VCMPUQ V1, V2, CR3                      // 11811101
	VCNTMBB V1, $1, R3                      // 10790e42
	VCNTMBD V1, $1, R3                      // 107f0e42

	MOVQ CR0, (AX)                  // ERROR "invalid instruction"
	MOVQ CR2, (AX)                  // ERROR "invalid instruction"
	MOVQ CR3, (AX)                  // ERROR "invalid instruction"
	MOVQ CR4, (AX)                  // ERROR "invalid instruction"
	MOVQ CR8, (AX)                  // ERROR "invalid instruction"
	MOVQ (AX), CR0                  // ERROR "invalid instruction"
	MOVQ (AX), CR2                  // ERROR "invalid instruction"

at two levels. For distributing workload certificates, Envoy will send [SDS](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret)
requests to the agent, causing the agent to submit a CSR to the configured CA (generally Istiod). For other configuration,
Envoy will send [ADS](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/operations/dynamic_configuration#aggregated-xds-ads)

        "1-alpha2snapshot",
        "1-alpha2",
        "1-alpha-123",
        "1-beta-2",
        "1-beta123",
        "1-m2",
        "1-m11",
        "1-rc",
        "1-cr2",
        "1-rc123",
        "1-SNAPSHOT",
        "1",
        "1-sp",
        "1-sp2",
        "1-sp123",
        "1-abc",
        "1-def",
        "1-pom-1",
        "1-1-snapshot",
        "1-1",

  repeated CertificateSigningRequest items = 2;
}

// CertificateSigningRequestSpec contains the certificate request.
message CertificateSigningRequestSpec {
  // Base64-encoded PKCS#10 CSR data
  // +listType=atomic
  optional bytes request = 1;

  // Requested signer for the request. It is a qualified name in the form:
  // `scope-hostname.io/name`.
  // If empty, it will be defaulted: