* Be lightweight enough to not limit adoption.
  * This puts a much tighter budget on CPU, memory, latency, and throughput requirements than traditional Istio sidecars.

Ztunnel was not designed to be a feature-rich data plane.
Quite the opposite - an *aggressively* small feature set is the key feature that makes ztunnel viable.

The ambient CNI agent is the only place where ambient network config and pod redirection machinery happens.

three main components:

- [MeshConfig](https://github.com/istio/api/blob/master/mesh/v1alpha1/config.proto) for runtime config consumed directly by Istio
control plane components.
- [Component configuration API](https://github.com/istio/api/blob/00671adacbea20f941cb20cce021bc63cbad1840/operator/v1alpha1/operator.proto#L42-L93), for managing

    - [list](../operator/cmd/mesh/profile-list.go): the list subcommand is used to list available Istio configuration profiles.
- [upgrade](../operator/cmd/mesh/upgrade.go): performs an in-place upgrade of the Istio control plane with eligibility checks.

## Migration tools

# Architecture of Istiod

This document describes the high level architecture of the Istio control plane, Istiod.
Istiod is structured as a modular monolith, housing a wide range of functionality from certificate signing, proxy configuration (XDS), traditional Kubernetes controllers, and more.

## Proxy Configuration

  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Describes the ResourceClaim that is to be generated.
  //
  // This field is immutable. A ResourceClaim will get created by the
  // control plane for a Pod when needed and then not get updated
  // anymore.
  optional ResourceClaimTemplateSpec spec = 2;
}

// ResourceClaimTemplateList is a collection of claim templates.
message ResourceClaimTemplateList {

    plan0.tcpConnectDelayNanos = 280.ms

    val plan1 = routePlanner.addPlan()
    plan1.tcpConnectDelayNanos = 10.ms // Connect at time = 260 ms.
    plan1.tlsConnectDelayNanos = 10.ms // Connect at time = 270 ms.
    plan1.tlsConnectThrowable = IOException("boom!")

    val plan2 = plan1.createConnectTlsNextPlan()
    plan2.tcpConnectDelayNanos = 270.ms // Connect at time = 540 ms.

    val plan3 = plan0.createRetry()

  private var routeSelector: RouteSelector? = null
  private var nextRouteToTry: Route? = null

  override val deferredPlans = ArrayDeque<Plan>()

  override fun isCanceled(): Boolean = connectionUser.isCanceled()

  @Throws(IOException::class)
  override fun plan(): Plan {
    val reuseCallConnection = planReuseCallConnection()
    if (reuseCallConnection != null) return reuseCallConnection

## Développement

Si vous avez déjà cloné le dépôt et que vous savez que vous devez vous plonger dans le code, voici quelques directives pour mettre en place votre environnement.

### Environnement virtuel avec `venv`

Vous pouvez créer un environnement virtuel dans un répertoire en utilisant le module `venv` de Python :

<div class="termy">

```console

    routePlanner.defaultConnectionIdleAtNanos = expireSooner

    // Turn it into an http/2 connection that supports 5 concurrent streams
    // which can satisfy a larger policy
    val connection = routePlanner.plans.first().connection
    val http2Connection = connectHttp2(peer, connection, 5)
    setPolicy(pool, address, ConnectionPool.AddressPolicy(5))
    assertThat(pool.connectionCount()).isEqualTo(1)