### Default CA Flow through istio-agent

![CA Flow](docs/ca.svg)

A single SDS request from Envoy goes through a few different layers in istio-agent.

1. First, the request is handled by the SDS server. This is mostly just an intermediate translation layer exposing
   the `SecretManager` to Envoy, without much business logic. For each resource requested by Envoy, the SDS server

gcBitsArenas,
  netpollInit,
  profBlock,
  profInsert,
  profMemFuture,
  spanSetSpine,
  fin,
  root
# Anything that can grow the stack can acquire STACKGROW.
# (Most higher layers imply STACKGROW, like MALLOC.)
< STACKGROW
# Below STACKGROW is the stack allocator/copying implementation.
< gscan;
gscan < stackpool;
gscan < stackLarge;

	labels map[string]*ast.LabeledStmt // allocated lazily
}

// insert records a new label declaration for the current block.
// The label must not have been declared before in any block.
func (b *block) insert(s *ast.LabeledStmt) {
	name := s.Label.Name
	if debug {
		assert(b.gotoTarget(name) == nil)
	}
	labels := b.labels
	if labels == nil {
		labels = make(map[string]*ast.LabeledStmt)

Arko Dasgupta <******@****.***> 1644279450 +0530

		if value, ok := labels[key]; ok {
			return value, true
		}
	}
	return "", false
}

func HasCanonicalServiceName(labels map[string]string) bool {
	_, ok := lookupLabelValue(labels, nameLabels...)
	return ok
}

func HasCanonicalServiceRevision(labels map[string]string) bool {
	_, ok := lookupLabelValue(labels, revisionLabels...)
	return ok
}

func canonicalServiceRevision(labels map[string]string) string {

See the License for the specific language governing permissions and
limitations under the License.
*/

package labels

import (
	"fmt"
	"sort"
	"strings"

	"k8s.io/apimachinery/pkg/util/validation/field"
)

// Labels allows you to present labels independently from their storage.
type Labels interface {
	// Has returns whether the provided label exists.
	Has(label string) (exists bool)

		continue L2 /* ERROR "invalid continue label L2" */
		continue L3
		goto L1
		goto L2
		goto L3
	}
}

// Blank labels are never declared.

func f4() {
_:
_: // multiple blank labels are ok
	goto _ /* ERROR "label _ not declared" */
}

func f5() {
_:
	for {
		break _ /* ERROR "invalid break label _" */

	}
	if labels == nil {
		labels = make(map[string]string)
	}
	labels[labelKey] = labelValue
	return labels
}

// Clones the given selector and returns a new selector with the given key and value added.
// Returns the given selector, if labelKey is empty.
func CloneSelectorAndAddLabel(selector *metav1.LabelSelector, labelKey, labelValue string) *metav1.LabelSelector {
	if labelKey == "" {
		// Don't need to add a label.

	labels map[string]*syntax.LabeledStmt // allocated lazily
}

// insert records a new label declaration for the current block.
// The label must not have been declared before in any block.
func (b *block) insert(s *syntax.LabeledStmt) {
	name := s.Label.Value
	if debug {
		assert(b.gotoTarget(name) == nil)
	}
	labels := b.labels
	if labels == nil {

{
  "labels": {
    "critical": {
      "name": "type:critical",
      "colour": "#E84137",
      "description": "critical questions"
    },
    "question": {
      "name": "type:question",
      "colour": "#EDEDED",
      "description": "general questions"
    },
    "feature": {
      "name": "type:feature_request",
      "colour": "#43952A",
      "description": "feature request"
    },
    "invalid_question": {