<img src="/img/deployment/https/https01.svg">

### Рукопожатие TLS

В дальнейшем браузер будет взаимодействовать с этим IP-адресом через **port 443** (общепринятый номер порта для HTTPS).

Первым шагом будет установление соединения между клиентом (браузером) и сервером и выбор криптографического ключа (для шифрования).

<img src="/img/deployment/https/https02.svg">

        {{- end }}
        - name: ISTIO_META_WORKLOAD_NAME
          value: {{.DeploymentName|quote}}
        - name: ISTIO_META_OWNER
          value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}"
        {{- if .Values.global.meshID }}
        - name: ISTIO_META_MESH_ID
          value: "{{ .Values.global.meshID }}"

		ObjectMeta: metav1.ObjectMeta{Name: saRolePrefix + "deployment-controller"},
		Rules: []rbacv1.PolicyRule{
			rbacv1helpers.NewRule("get", "list", "watch", "update").Groups(extensionsGroup, appsGroup).Resources("deployments").RuleOrDie(),
			rbacv1helpers.NewRule("update").Groups(extensionsGroup, appsGroup).Resources("deployments/status").RuleOrDie(),

	// are assigned and all Instances are ready to communicate with each other.
	Build() (echo.Instances, error)
	BuildOrFail(t test.Failer) echo.Instances
}

var _ Builder = &builder{}

// New builder for echo deployments.
func New(ctx resource.Context, clusters ...cluster.Cluster) Builder {
	// use all workload clusters unless otherwise specified
	if len(clusters) == 0 {
		clusters = ctx.Clusters()
	}
	b := &builder{

	// Description: The resulting pods of a service mesh deployment can't be associated with multiple services using the same port but different protocols.
	DeploymentAssociatedToMultipleServices = diag.NewMessageType(diag.Warning, "IST0116", "This deployment %s is associated with multiple services using port %d but different protocols: %v")

<img src="/img/deployment/https/https01.svg">

### TLS Handshake Start

The browser would then communicate with that IP address on **port 443** (the HTTPS port).

The first part of the communication is just to establish the connection between the client and the server and to decide the cryptographic keys they will use, etc.

<img src="/img/deployment/https/https02.svg">

		{"Values.grafana.enabled", "the samples/addons/ deployments", false},
		{"Values.tracing.enabled", "the samples/addons/ deployments", false},
		{"Values.kiali.enabled", "the samples/addons/ deployments", false},
		{"Values.prometheus.enabled", "the samples/addons/ deployments", false},
		{"AddonComponents.grafana.Enabled", "the samples/addons/ deployments", false},

<img src="/img/deployment/https/https01.svg">

### TLS-Handshake-Start

Der Browser kommuniziert dann mit dieser IP-Adresse über **Port 443** (den HTTPS-Port).

Der erste Teil der Kommunikation besteht lediglich darin, die Verbindung zwischen dem Client und dem Server herzustellen und die zu verwendenden kryptografischen Schlüssel usw. zu vereinbaren.

<img src="/img/deployment/https/https02.svg">

			// if dual stack is enabled, a dual stack echo config should be added
			if !t.Settings().EnableDualStack {
				// Create a custom echo deployment in NS1 with subsets that allows us to test the
				// migration of a workload to istio (from no sidecar to sidecar).
				migrationApp = deployment.New(t).
					WithClusters(t.Clusters()...).WithConfig(echo.Config{
					Namespace:      echo1NS,
					Service:        migrationServiceName,

	// Generate the patch.  At runtime, the webhook would actually generate the patch against the
	// pod configuration. But since our input files are deployments, rather than actual pod instances,
	// we have to apply the patch to the template portion of the deployment only.
	templateJSON := convertToJSON(inputPod, t)
	got := webhook.inject(&kube.AdmissionReview{
		Request: &kube.AdmissionRequest{
			Object: runtime.RawExtension{
				Raw: templateJSON,