name: istio-kubeconfig
          readOnly: true
        - mountPath: /var/run/secrets/istiod/tls
          name: istio-csr-dns-cert
          readOnly: true
        - mountPath: /var/run/secrets/istiod/ca
          name: istio-csr-ca-configmap
          readOnly: true
      serviceAccountName: istiod
      volumes:
      - emptyDir:
          medium: Memory
        name: local-certs

	}

	return nil
}

// WriteCSR writes the pem-encoded CSR data to csrPath.
// The CSR file will be created with file mode 0600.
// If the CSR file already exists, it will be overwritten.
// The parent directory of the csrPath will be created as needed with file mode 0700.
func WriteCSR(csrDir, name string, csr *x509.CertificateRequest) error {
	if csr == nil {

openssl req -new -key ServerKey.pem -out server.csr -subj "/CN=${CN_BASE}_server" -config server.conf
openssl x509 -req -in server.csr -CA CACert.pem -CAkey CAKey.pem -CAcreateserial -out ServerCert.pem -days 100000 -extensions v3_req -extfile server.conf

# Create a client certificate
openssl genrsa -out ClientKey.pem 2048
openssl req -new -key ClientKey.pem -out client.csr -subj "/CN=${CN_BASE}_client" -config client.conf

	print("r10   ", hex(u.r10), "\n")
	print("r11   ", hex(u.r11), "\n")
	print("r12   ", hex(u.r12), "\n")
	print("sp    ", hex(u.sp), "\n")
	print("link  ", hex(u.link), "\n")
	print("pc    ", hex(u.pc), "\n")
	print("psr   ", hex(u.psr), "\n")
}

CAAgFiEEiybxTePKQyXbjvbPBbVeIBuFJTwFAmFWykACGwwACgkQBbVeIBuFJTyN
aQP/bwhfZ6jRHooHF50X6DLNNHLndiMy3Qo6AzyfwKQsk7Qp1ePd7Rd3syNAj41O
NVFiWeztpDlJl2eE0fi/KYUzodtKXDKCtOux5HYpLN4CVvseDaGeLSVJKE29lV1B
Aa/SY4RrJ5EGNUV+qnRVewsUm6qZykGQq4skPdXUaE9uuEQ=
=CPFR

          name: istio-kubeconfig
          readOnly: true
        - mountPath: /var/run/secrets/istiod/tls
          name: istio-csr-dns-cert
          readOnly: true
        - mountPath: /var/run/secrets/istiod/ca
          name: istio-csr-ca-configmap
          readOnly: true
      serviceAccountName: istiod
      volumes:
      - emptyDir:
          medium: Memory
        name: local-certs

# issue is a list of GitHub issues resolved in this note.
issue:
- https://github.com/cert-manager/istio-csr/issues/113

docs: []

releaseNotes:
- |
  **Added** values to the Istio Pilot Helm charts for configuring additional container arguments, volumeMounts, and volumes. Can be used in conjunction with cert-manager istio-csr.

upgradeNotes: []

          name: istio-kubeconfig
          readOnly: true
        - mountPath: /var/run/secrets/istiod/tls
          name: istio-csr-dns-cert
          readOnly: true
        - mountPath: /var/run/secrets/istiod/ca
          name: istio-csr-ca-configmap
          readOnly: true
      nodeSelector:
        master: "true"
      serviceAccountName: istiod
      volumes:
      - emptyDir:

	}
	csr, ok := a.GetObject().(*api.CertificateSigningRequest)
	if !ok {
		return admission.NewForbidden(a, fmt.Errorf("expected type CertificateSigningRequest, got: %T", a.GetObject()))
	}

	// only run if the status.certificate or status.conditions field has been changed

digraph {
    grpc -> ca [label="Send CSR gRPC Request"]
    subgraph cluster_istioagent {
        label = "Istio Agent"
        color="orange"
        sds
        SecretManager -> caClient [label="Sign CSR"]
        caClient -> grpc
        grpc -> TokenProvider [dir=none,label="Fetch JWT",color=purple]
        grpc -> cfiles [dir=none,label="Fetch Cert",color=purple]

        sds -> SecretManager [label="Generate certificate"]