![CA Flow](docs/ca.svg)

A single SDS request from Envoy goes through a few different layers in istio-agent.

1. First, the request is handled by the SDS server. This is mostly just an intermediate translation layer exposing
   the `SecretManager` to Envoy, without much business logic. For each resource requested by Envoy, the SDS server
   will call `SecretManager.GenerateSecret(resourceName)`

  // +required
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 4;

  // The reason for the condition's last transition.
  // +required
  optional string reason = 5;

  // A human readable message indicating details about the transition.
  // +required
  optional string message = 6;
}

// A list of StorageVersions.
message StorageVersionList {
  // Standard list metadata.

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time lastTransitionTime = 4;

  // Unique, one-word, CamelCase reason for the condition's last transition.
  // +optional
  optional string reason = 5;

  // Human-readable message indicating details about last transition.
  // +optional
  optional string message = 6;
}

// CarpList is a list of Carps.
message CarpList {
  // Standard list metadata.

  // group=certificates.k8s.io resource=signers resourceName=<the signer name>
  // verb=attest.
  //
  // If signerName is not empty, then the ClusterTrustBundle object must be
  // named with the signer name as a prefix (translating slashes to colons).
  // For example, for the signer name `example.com/foo`, valid
  // ClusterTrustBundle object names include `example.com:foo:abc` and
  // `example.com:foo:v1`.
  //

  no-extends: 2
  no-ids: 0
  no-invalid-hex: 2
  no-important: 0
  no-mergeable-selectors: 2
  no-misspelled-properties: 2
  no-qualifying-elements: 0
  no-trailing-whitespace: 2
  no-trailing-zero: 2
  no-transition-all: 0
  no-url-domains: 2
  no-url-protocols: 2
  no-warn: 2
  one-declaration-per-line: 2
  placeholder-in-extend: 2
  placeholder-name-format: 2
  property-sort-order: 0
  property-units: 2