## Proxy implementation

In its initial implementations, the ztunnel was actually implemented in 3 different ways: a bespoke Rust implementation, a bespoke Go implementation, and in Envoy.

In the end, [after evaluation](https://docs.google.com/document/d/1c2123cKuYsBDpIon9FFdctWTUIMFweSjgwG7r8l3818/edit), the decision was to move forward with a Rust implementation.

- Configures required iptables, sockets, and packet routing miscellanea within the `ztunnel` and application pod network namespaces to make that happen.

This component accomplishes that in the following ways:

1. By installing a separate, very basic "CNI plugin" binary onto the node to forward low-level pod lifecycle events (CmdAdd/CmdDel/etc) from whatever node-level CNI subsystem is in use to this node agent for processing via socket.

   will call `SecretManager.GenerateSecret(resourceName)`
1. When `GenerateSecret` is called, the `SecretManager` is expected to return a new certificate. This can occur in a few ways.
   1. The most common method (pictured above) is to sign a new certificate by calling the configured CA. Typically, this is Istiod.

  // Required.
  optional string name = 2;
}

// Subject matches the originator of a request, as identified by the request authentication system. There are three
// ways of matching an originator; by user, group, or service account.
// +union
message Subject {
  // `kind` indicates which one of the other fields is non-empty.
  // Required
  // +unionDiscriminator

  // Required.
  optional string name = 2;
}

// Subject matches the originator of a request, as identified by the request authentication system. There are three
// ways of matching an originator; by user, group, or service account.
// +union
message Subject {
  // `kind` indicates which one of the other fields is non-empty.
  // Required
  // +unionDiscriminator

There are a few ways to prevent these:
* Only pass in to the generation logic the cache key itself, so no other unaccounted inputs can be used. Unfortunately, this has not been done for any generators today.
* Be very, very careful.

  optional string uid = 1;

  // Allowed indicates whether or not the admission request was permitted.
  optional bool allowed = 2;

  // Result contains extra details into why an admission request was denied.
  // This field IS NOT consulted in any way if "Allowed" is "true".
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Status status = 3;

WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/


// This file was autogenerated by go-to-protobuf. Do not edit it manually!

syntax = "proto2";

package k8s.io.api.authorization.v1beta1;

import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";

      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct

  optional string reportingInstance = 5;

  // action is what action was taken/failed regarding to the regarding object. It is machine-readable.
  // This field cannot be empty for new Events and it can have at most 128 characters.
  optional string action = 6;

  // reason is why the action was taken. It is human-readable.
  // This field cannot be empty for new Events and it can have at most 128 characters.