## Certificate Rotation

The agent also handles rotating certificates near expiration. It does so by triggering a callback from the `SecretManager` to the SDS server
when a certificate is near expiration (configurable by `SECRET_GRACE_PERIOD_RATIO`, defaulting to half of the expiration). If the SDS server
is still interested in this certificate (ie, Envoy is still connected and requesting the certificate), the SDS server will send another request

  //  4. Required, permitted, or forbidden key usages / extended key usages.
  //  5. Expiration/certificate lifetime: whether it is fixed by the signer, configurable by the admin.
  //  6. Whether or not requests for CA certificates are allowed.
  optional string signerName = 7;

  // expirationSeconds is the requested duration of validity of the issued

  istioctl experimental config list`,
	}
	configCmd.AddCommand(listCommand())
	return configCmd
}

func listCommand() *cobra.Command {
	listCmd := &cobra.Command{
		Use:   "list",
		Short: "List istio configurable defaults",
		Args:  cobra.ExactArgs(0),
		RunE: func(c *cobra.Command, _ []string) error {
			root.Scope.Debugf("Config file %q", root.IstioConfig)
			return runList(c.OutOrStdout())
		},
	}
	return listCmd
}

* Correctness at startup; with the sequencing above, items are only processed once all informers are synced. This means queries will not return stale data at startup.
* Deduping of identical events
* Automatic retrying of failed events (configurable)

The above logic is critical to handle correctly to ensure correctness of a controller.
The [Example Controller](../../pkg/kube/controllers/example_test.go) is a key reference point for any controller development;

	registerStringParameter(constants.LogLevel, "warn", "Fallback value for log level in CNI config file, if not specified in helm template")

	// Not configurable in CNI helm charts
	registerStringParameter(constants.MountedCNINetDir, "/host/etc/cni/net.d", "Directory on the container where CNI networks are installed")

  // because the local default config is always assumed good.
  // You should not make assumptions about the node's method of determining config stability
  // and correctness, as this may change or become configurable in the future.
  // +optional
  optional NodeConfigSource lastKnownGood = 3;

  // Error describes any problems reconciling the Spec.ConfigSource to the Active config.

	if isRevisioned(revision) {
		istiod = fmt.Sprintf("%s-%s", istiod, revision)
	}
	return fmt.Sprintf("%s.%s.svc", istiod, ns)
}

func IstiodAddr(ns, revision string) string {
	// TODO make port configurable
	return fmt.Sprintf("%s:%d", IstiodHost(ns, revision), 15012)
}

// Returns a map with each k,v entry on a new line
func mapToString(m map[string]string) string {
	lines := []string{}
	for k, v := range m {