spiffe://cluster.local/ns/istio-system/sa/istiod         Leaf     Available        true           e5dfb59150b2ba7f108d93dcec5aa613     2033-03-22T13:04:57Z     2023-03-21T13:02:57Z
spiffe://cluster.local/ns/istio-system/sa/istiod         Root     Available        false          8a516645c40ce76c2c0d27ab4e2461c1     2022-03-18T13:04:49Z     2022-03-21T13:04:49Z

* If a socket is found, istio-agent will not start its own SDS Server and Envoy will be configured to use that socket as its source of cryptographic material.

            "name": "ROOTCA",
            "validation_context": {
              "trusted_ca": {
              },
              "custom_validator_config": {
                "name": "envoy.tls.cert_validator.spiffe",
                "typed_config": {
                  "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.SPIFFECertValidatorConfig",
                  "trust_domains": [
                    {

      ]
    },
    {
      "identity": "spiffe://cluster.local/ns/istio-system/sa/ztunnel",
      "state": "Initializing",
      "certChain": []
    },
    {
      "identity": "spiffe://cluster.local/ns/istio-system/sa/another-sa",
      "state": "Unavailable: the identity is no longer needed",
      "certChain": []
    },
    {
      "identity": "spiffe://cluster.local/ns/istio-system/sa/istiod",

                          "match_subject_alt_names": [
                            {
                              "exact": "spiffe://cluster.local/ns/default/sa/bookinfo-productpage"
                            },
                            {
                              "exact": "spiffe://cluster.local/ns/default/sa/default"
                            }
                          ]
                        },

Once the connection is established we return a 200 HTTP code, and bi-directionally copy data to/from the tunnel to the destination.

## Certificates

Ztunnel certificates are based on the standard Istio SPIFFE format: `spiffe://<trust domain>/ns/<ns>/sa/<sa>`.

However, the identities of the certificates will be of the actual user workloads, not Ztunnel's own identity.

	// so skip determining this information, because usually it will be not included in the certificate.
	if trustDomain == "" {
		for _, uri := range cert.URIs {
			if uri.Scheme == "spiffe" {
				trustDomain = uri.Host
			}
		}
	}

	today := time.Now()
	return SecretMeta{
		SerialNumber: fmt.Sprintf("%x", cert.SerialNumber),
		NotAfter:     cert.NotAfter.Format(time.RFC3339),

10.244.0.195:9080                                HEALTHY                  outbound|9080||reviews.default.svc.cluster.local
./var/run/secrets/workload-spiffe-uds/socket     HEALTHY                  sds-grpc
10.244.0.188:11800                               HEALTHY                  outbound|11800||skywalking-oap.skywalking.svc.cluster.local

                         {
                          "filter_state": {
                           "key": "io.istio.peer_principal",
                           "string_match": {
                            "exact": "spiffe://cluster.local/ns/default/sa/sleep"
                           }
                          }
                         }
                        ]
                       }
                      },

/pkg/queue/                                                      @istio/wg-networking-maintainers
/pkg/security/                                                   @istio/wg-security-maintainers @istio/wg-environments-maintainers
/pkg/spiffe/                                                     @istio/wg-security-maintainers
/pkg/test/                                                       @istio/wg-test-and-release-maintainers