// be one of the following values:
  // * Exact: Matches the URL path exactly.
  // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
  //   done on a path element by element basis. A path element refers is the
  //   list of labels in the path split by the '/' separator. A request is a
  //   match for path p if every p is an element-wise prefix of p of the

// CSIDriver objects are non-namespaced.
message CSIDriver {
  // Standard object metadata.
  // metadata.Name indicates the name of the CSI driver that this object
  // refers to; it MUST be the same name returned by the CSI GetPluginName()
  // call for that driver.
  // The driver name must be 63 characters or less, beginning and ending with

### Inbound

Traffic entering a pod over HBONE will be handled by the "inbound" code path, on port 15008.

Incoming requests have multiple "layers": TLS wrapping HTTP CONNECT that is wrapping the user's connection.

To unwrap the first layer, we terminate TLS.
As part of this, we need to pick the correct certificate to serve on behalf of the destination workload.

  // be one of the following values:
  // * Exact: Matches the URL path exactly.
  // * Prefix: Matches based on a URL path prefix split by '/'. Matching is
  //   done on a path element by element basis. A path element refers is the
  //   list of labels in the path split by the '/' separator. A request is a
  //   match for path p if every p is an element-wise prefix of p of the

  // HPAContainerMetrics is enabled
  optional string type = 1;

  // object refers to a metric describing a single kubernetes object
  // (for example, hits-per-second on an Ingress object).
  // +optional
  optional ObjectMetricSource object = 2;

  // pods refers to a metric describing each pod in the current scale target
  // (for example, transactions-processed-per-second).  The values will be

  // HPAContainerMetrics is enabled
  optional string type = 1;

  // object refers to a metric describing a single kubernetes object
  // (for example, hits-per-second on an Ingress object).
  // +optional
  optional ObjectMetricSource object = 2;

  // pods refers to a metric describing each pod in the current scale target
  // (for example, transactions-processed-per-second).  The values will be

// CSIDriver objects are non-namespaced.
message CSIDriver {
  // Standard object metadata.
  // metadata.Name indicates the name of the CSI driver that this object
  // refers to; it MUST be the same name returned by the CSI GetPluginName()
  // call for that driver.
  // The driver name must be 63 characters or less, beginning and ending with

  // When Node.Spec.ConfigSource is updated, the node checkpoints the associated
  // config payload to local disk, along with a record indicating intended
  // config. The node refers to this record to choose its config checkpoint, and
  // reports this record in Assigned. Assigned only updates in the status after
  // the record has been checkpointed to disk. When the Kubelet is restarted,

immutable snapshot of the current state of the world. It is regenerated (usually partially) on each configuration push (more on this below). Due to being a snapshot, most lookups are lock-free.

`PushContext` is built up by querying the above layers. For some simple use cases, this is as simple as storing something like `configstore.List(SomeType)`; in this case, the only difference from directly exposing the configstore is to snapshot the current state. In other cases, some pre-computations...

![SDS decision flow](docs/sds-flow.svg)

### Default CA Flow through istio-agent

![CA Flow](docs/ca.svg)

A single SDS request from Envoy goes through a few different layers in istio-agent.

1. First, the request is handled by the SDS server. This is mostly just an intermediate translation layer exposing