}
	istiodListenerDump, err := c.istiod.GetDynamicListenerDump(true)
	if err != nil {
		istiodBytes.WriteString(err.Error())
	} else {
		istiod, err := protomarshal.ToJSONWithAnyResolver(istiodListenerDump, "    ", &envoyResolver)
		if err != nil {
			return err
		}
		istiodBytes.WriteString(istiod)
	}
	diff := difflib.UnifiedDiff{
		FromFile: "Istiod Listeners",

	"github.com/spf13/viper"
)

// CentralControlPlaneOptions holds options common to all subcommands
// that invoke Istiod via xDS REST endpoint
type CentralControlPlaneOptions struct {
	// Xds is XDS endpoint, e.g. localhost:15010.
	Xds string

	// XdsPodLabel is a Kubernetes label on the Istiod pods
	XdsPodLabel string

	// XdsPodPort is a port exposing XDS (typically 15010 or 15012)
	XdsPodPort int

	"google.golang.org/grpc"
	v1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	"istio.io/api/label"
	"istio.io/istio/istioctl/pkg/clioptions"
	"istio.io/istio/istioctl/pkg/xds"
	pilotxds "istio.io/istio/pilot/pkg/xds"
	"istio.io/istio/pkg/kube"
	istioversion "istio.io/istio/pkg/version"
)

const (
	// Service account to create tokens in
	tokenServiceAccount = "default"

    {{- if eq .Values.global.pilotCertProvider "istiod" }}
    - mountPath: /var/run/secrets/istio
      name: istiod-ca-cert
    {{- end }}
    - mountPath: /var/lib/istio/data
      name: istio-data
    # SDS channel between istioagent and Envoy
    - mountPath: /etc/istio/proxy
      name: istio-envoy
    - mountPath: /var/run/secrets/tokens
      name: istio-token
    {{- if .Values.global.mountMtlsCerts }}

	xdsstatus "github.com/envoyproxy/go-control-plane/envoy/service/status/v3"

	"istio.io/istio/istioctl/pkg/multixds"
	"istio.io/istio/pilot/pkg/model"
	xdsresource "istio.io/istio/pilot/pkg/xds/v3"
	"istio.io/istio/pkg/log"
)

// XdsStatusWriter enables printing of sync status using multiple xdsapi.DiscoveryResponse Istiod responses
type XdsStatusWriter struct {
	Writer                 io.Writer

# Architecture of Istiod

This document describes the high level architecture of the Istio control plane, Istiod.
Istiod is structured as a modular monolith, housing a wide range of functionality from certificate signing, proxy configuration (XDS), traditional Kubernetes controllers, and more.

## Proxy Configuration

apiVersion: v1
name: istiod-remote
# This version is never actually shipped. istio/release-builder will replace it at build-time
# with the appropriate version
version: 1.0.0
appVersion: 1.0.0
tillerVersion: ">=2.7.2"
description: Helm chart for a remote cluster using an external istio control plane
keywords:
  - istio
  - external-istiod
sources:
  - https://github.com/istio/istio
engine: gotpl

```

3) `istio-control/istio-discovery` chart installs a revision of istiod.

```console
 helm install -n istio-system istiod manifests/charts/istio-control/istio-discovery --set profile=openshift
```

4) `gateways` charts install a load balancer with `ingress` and `egress`.

Ingress secrets and access should be separated from the control plane.

```console

    {{- if eq .Values.global.pilotCertProvider "istiod" }}
    - mountPath: /var/run/secrets/istio
      name: istiod-ca-cert
    {{- end }}
    - mountPath: /var/lib/istio/data
      name: istio-data
    # UDS channel between istioagent and gRPC client for XDS/SDS
    - mountPath: /etc/istio/proxy
      name: istio-xds
    - mountPath: /var/run/secrets/tokens
      name: istio-token
    {{- if .Values.global.mountMtlsCerts }}

metadata:
  generation: 1
  labels:
    app: sidecar-injector
    istio.io/rev: test-dev2
    istio.io/tag: default
    release: istio
  name: istio-revision-tag-default
webhooks:
- admissionReviewVersions:
  - v1beta1
  - v1
  clientConfig:
    service:
      name: istiod-test-dev2
      namespace: istio-system
      path: /inject
      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent