- **Pilot** - Responsible for configuring the proxies at runtime.

    - **Citadel** - Responsible for certificate issuance and rotation.

    - **Galley** - Responsible for validating, ingesting, aggregating, transforming and distributing config within Istio.

- **Operator** - The component provides user friendly options to operate the Istio service mesh.

  // +required
  optional int32 perNodeHostBits = 2;

  // ipv4 defines an IPv4 IP block in CIDR notation(e.g. "10.0.0.0/8").
  // At least one of ipv4 and ipv6 must be specified.
  // This field is immutable.
  // +optional
  optional string ipv4 = 3;

  // ipv6 defines an IPv6 IP block in CIDR notation(e.g. "2001:db8::/64").
  // At least one of ipv4 and ipv6 must be specified.
  // This field is immutable.

      distributed with this file, You can
      obtain one at
      http://mozilla.org/MPL/2.0/.

If it is not possible or desirable to put the notice in a particular file, then
You may include the notice in a location (such as a LICENSE file in a relevant
directory) where a recipient would be likely to look for such a notice.

You may add additional accurate notices of copyright ownership.

  // secret object contains more than one secret, all secrets are passed.
  // +featureGate=CSINodeExpandSecret
  // +optional
  optional SecretReference nodeExpandSecretRef = 10;
}

// Represents a source location of a volume to mount, managed by an external CSI driver
message CSIVolumeSource {
  // driver is the name of the CSI driver that handles this volume.
  // Consult with your admin for the correct name as registered in the cluster.

However, if a request needs a certain identity that we have not fetched yet, it will be immediately requested.

Ztunnel additionally will handle the rotation of these certificates (typically 24hr expiration) as they approach expiry.

## Telemetry

the certificates are persisted to disk, rather than kept in memory like in the standard Kubernetes deployment.

## Certificate Rotation

The agent also handles rotating certificates near expiration. It does so by triggering a callback from the `SecretManager` to the SDS server

  extends-before-declarations: 2
  extends-before-mixins: 2
  final-newline: 2
  force-attribute-nesting: 0
  force-element-nesting: 0
  force-pseudo-nesting: 0
  function-name-format: 2
  hex-length: 0
  hex-notation: 2
  id-name-format: 2
  indentation:
    - 2
    -
      size: 4
  leading-zero:
    - 2
    -
      include: false
  max-file-line-count: 0
  max-file-length: 0
  mixins-before-declarations: 2

	if err != nil {
		return err
	}
	lastUpdatedStr := ""
	if lastUpdated, err := c.envoy.GetLastUpdatedDynamicRouteTime(); err != nil {
		return err
	} else if lastUpdated != nil {
		loc, err := time.LoadLocation(c.location)
		if err != nil {
			loc, _ = time.LoadLocation("UTC")
		}
		lastUpdatedStr = fmt.Sprintf(" (RDS last loaded at %s)", lastUpdated.In(loc).Format(time.RFC1123))
	}
	if text != "" {

}

func (r *RootFlags) configureDefaultNamespace() {
	configAccess := clientcmd.NewDefaultPathOptions()

	kubeconfig := *r.kubeconfig
	if kubeconfig != "" {
		// use specified kubeconfig file for the location of the
		// config to read
		configAccess.GlobalFile = kubeconfig
	}

	// gets existing kubeconfig or returns new empty config
	config, err := configAccess.GetStartingConfig()
	if err != nil {

              drop:
              - ALL
              add:
              # CAP_NET_ADMIN is required to allow ipset and route table access
              - NET_ADMIN
              # CAP_NET_RAW is required to allow iptables mutation of the `nat` table
              - NET_RAW
              # CAP_SYS_ADMIN is required for both ambient and repair, in order to open