}

    /**
     * Sets the HTTP proxy that will be used by connections created by this client. This takes
     * precedence over [proxySelector], which is only honored when this proxy is null (which it is
     * by default). To disable proxy use completely, call `proxy(Proxy.NO_PROXY)`.
     */
    fun proxy(proxy: Proxy?) =
      apply {
        if (proxy != this.proxy) {
          this.routeDatabase = null
        }

  @Throws(IOException::class)
  private fun connectSocket() {
    val rawSocket =
      when (route.proxy.type()) {
        Proxy.Type.DIRECT, Proxy.Type.HTTP -> route.address.socketFactory.createSocket()!!
        else -> Socket(route.proxy)
      }
    this.rawSocket = rawSocket

    // Handle the race where cancel() precedes connectSocket(). We don't want to miss a cancel.

    * これは、同じTLS Termination Proxyが証明書の更新処理も行う場合に非常に便利な理由の1つです。
    * そうでなければ、TLS Termination Proxyを一時的に停止し、証明書を取得するために更新プログラムを起動し、TLS Termination Proxyで証明書を設定し、TLS Termination Proxyを再起動しなければならないかもしれません。TLS Termination Proxyが停止している間はアプリが利用できなくなるため、これは理想的ではありません。


アプリを提供しながらこのような更新処理を行うことは、アプリケーション・サーバー（Uvicornなど）でTLS証明書を直接使用するのではなく、TLS Termination Proxyを使用して**HTTPSを処理する別のシステム**を用意したくなる主な理由の1つです。

## まとめ

      annotations:
        prometheus.io/path: /stats/prometheus
        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"
        proxy.istio.io/config: '{ "holdApplicationUntilProxyStarts": true }'
        sidecar.istio.io/status: '{"initContainers":["istio-init"],"containers":["istio-proxy"],"volumes":null,"imagePullSecrets":null,"revision":"default"}'
      creationTimestamp: null
      labels:
        app: hello
        tier: backend

This document describes the high level architecture of the Istio control plane, Istiod.
Istiod is structured as a modular monolith, housing a wide range of functionality from certificate signing, proxy configuration (XDS), traditional Kubernetes controllers, and more.

## Proxy Configuration

Istiod's primary role - and most code - is to dynamically configure proxies (Envoy sidecars and ingress, gRPC, ztunnel, and more). This roughly consists of 3 parts:

import java.net.HttpURLConnection
import java.net.Proxy
import okhttp3.HttpUrl
import okhttp3.Request

object RequestLine {
  /**
   * Returns the request status line, like "GET / HTTP/1.1". This is exposed to the application by
   * [HttpURLConnection.getHeaderFields], so it needs to be set even if the transport is
   * HTTP/2.
   */
  fun get(
    request: Request,
    proxyType: Proxy.Type,
  ): String =
    buildString {

  fun proxyMoveTest(cleanShutdown: Boolean) {
    // Define a single Proxy at myproxy:8008 that will artificially move during the test
    val proxySelector = RecordingProxySelector()
    val socketAddress = InetSocketAddress.createUnresolved("myproxy", 8008)
    proxySelector.proxies.add(Proxy(Proxy.Type.HTTP, socketAddress))

    // Define two host names for the DNS routing of fake proxy servers

                            proxy = result.getProxy();

                            ProxyInfo proxyInfo = new ProxyInfo();
                            proxyInfo.setHost(proxy.getHost());
                            proxyInfo.setType(proxy.getProtocol());
                            proxyInfo.setPort(proxy.getPort());
                            proxyInfo.setNonProxyHosts(proxy.getNonProxyHosts());

      certificatePinner = null,
      proxyAuthenticator = proxyAuthenticator,
      proxy = proxy,
      protocols = protocols,
      connectionSpecs = connectionSpecs,
      proxySelector = proxySelector,
    )
  }

  fun newRoute(
    address: Address = newAddress(),
    proxy: Proxy = this.proxy,
    socketAddress: InetSocketAddress = InetSocketAddress.createUnresolved(uriHost, uriPort),
  ): Route {

/**
 * Performs either **preemptive** authentication before connecting to a proxy server, or
 * **reactive** authentication after receiving a challenge from either an origin web server or proxy
 * server.
 *
 * ## Preemptive Authentication
 *
 * To make HTTPS calls using an HTTP proxy server OkHttp must first negotiate a connection with
 * the proxy. This proxy connection is called a "TLS Tunnel" and is specified by