Prometheus sets the `Host` header to `domain:port` as part of HTTP operations against the MinIO metrics endpoint. For MinIO deployments behind a load balancer, reverse proxy, or other control plane (HAProxy, nginx, pfsense, opnsense, etc.), ensure the network service supports routing these requests to the deployment.

### 6. Configure Grafana

  @Throws(IOException::class)
  private fun connectSocket() {
    val rawSocket =
      when (route.proxy.type()) {
        Proxy.Type.DIRECT, Proxy.Type.HTTP -> route.address.socketFactory.createSocket()!!
        else -> Socket(route.proxy)
      }
    this.rawSocket = rawSocket

    // Handle the race where cancel() precedes connectSocket(). We don't want to miss a cancel.

import java.net.HttpURLConnection
import java.net.Proxy
import okhttp3.HttpUrl
import okhttp3.Request

object RequestLine {
  /**
   * Returns the request status line, like "GET / HTTP/1.1". This is exposed to the application by
   * [HttpURLConnection.getHeaderFields], so it needs to be set even if the transport is
   * HTTP/2.
   */
  fun get(
    request: Request,
    proxyType: Proxy.Type,
  ): String =
    buildString {

      annotations:
        prometheus.io/path: /stats/prometheus
        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"
        proxy.istio.io/config: '{ "holdApplicationUntilProxyStarts": true }'
        sidecar.istio.io/status: '{"initContainers":["istio-init"],"containers":["istio-proxy"],"volumes":null,"imagePullSecrets":null,"revision":"default"}'
      creationTimestamp: null
      labels:
        app: hello
        tier: backend

This document describes the high level architecture of the Istio control plane, Istiod.
Istiod is structured as a modular monolith, housing a wide range of functionality from certificate signing, proxy configuration (XDS), traditional Kubernetes controllers, and more.

## Proxy Configuration

Istiod's primary role - and most code - is to dynamically configure proxies (Envoy sidecars and ingress, gRPC, ztunnel, and more). This roughly consists of 3 parts:

      certificatePinner = null,
      proxyAuthenticator = proxyAuthenticator,
      proxy = proxy,
      protocols = protocols,
      connectionSpecs = connectionSpecs,
      proxySelector = proxySelector,
    )
  }

  fun newRoute(
    address: Address = newAddress(),
    proxy: Proxy = this.proxy,
    socketAddress: InetSocketAddress = InetSocketAddress.createUnresolved(uriHost, uriPort),
  ): Route {

/**
 * Performs either **preemptive** authentication before connecting to a proxy server, or
 * **reactive** authentication after receiving a challenge from either an origin web server or proxy
 * server.
 *
 * ## Preemptive Authentication
 *
 * To make HTTPS calls using an HTTP proxy server OkHttp must first negotiate a connection with
 * the proxy. This proxy connection is called a "TLS Tunnel" and is specified by

     */
    void injectMirror(List<ArtifactRepository> repositories, List<Mirror> mirrors);

    /**
     * Injects the proxy information into the specified repositories. For each repository that is matched by a proxy,
     * its proxy data will be set accordingly. Repositories without a matching proxy will have their proxy cleared.
     * Note: This method must be called after {@link #injectMirror(List, List)} or the repositories will end up

        for (Proxy proxy : decrypted.getProxies()) {
            AuthenticationBuilder authBuilder = new AuthenticationBuilder();
            authBuilder.addUsername(proxy.getUsername()).addPassword(proxy.getPassword());
            proxySelector.add(
                    new org.eclipse.aether.repository.Proxy(
                            proxy.getProtocol(), proxy.getHost(), proxy.getPort(), authBuilder.build()),

import assertk.assertions.containsExactly
import java.io.IOException
import java.net.InetSocketAddress
import java.net.Proxy
import java.net.ProxySelector
import java.net.SocketAddress
import java.net.URI
import okhttp3.internal.format

class RecordingProxySelector : ProxySelector() {
  @JvmField val proxies = mutableListOf<Proxy>()

  private val requestedUris = mutableListOf<URI>()
  private val failures = mutableListOf<String>()