healthStatus: HEALTHY
      loadBalancingWeight: 1
    locality: {}
  policy:
    overprovisioningFactor: 140
- clusterName: outbound|9402||cert-manager-istio-csr-metrics.cert-manager.svc.cluster.local
  endpoints:
  - lbEndpoints:
    - endpoint:
        address:
          socketAddress:
            address: 10.244.0.156
            portValue: 9402
        healthCheckConfig: {}

certificate provisioning tool, or use components that are centrally managed and running in a different cluster.

This is a work in progress - building on top of the multi-cluster installer.

As an extreme, the goal is to be possible to run Istio workloads in a cluster without installing any Istio component
in that cluster. Currently, the minimum we require is the security provider (node agent or citadel).

### Install Istio CRDs

cluster/agent                                                       cluster/agent                         -        -          -               STATIC     
cluster/inbound-vip|8000|http|httpbin.default.svc.cluster.local     httpbin.default.svc.cluster.local     8000     http       inbound-vip     EDS        

    },
    {
      "identity": "spiffe://cluster.local/ns/istio-system/sa/ztunnel",
      "state": "Initializing",
      "certChain": []
    },
    {
      "identity": "spiffe://cluster.local/ns/istio-system/sa/another-sa",
      "state": "Unavailable: the identity is no longer needed",
      "certChain": []
    },
    {
      "identity": "spiffe://cluster.local/ns/istio-system/sa/istiod",

        }
      ],
      "dynamic_active_clusters": [
        {
          "cluster": {
            "@type": "type.googleapis.com/envoy.config.cluster.v3.Cluster",
            "name": "inbound-vip|8000|http|httpbin.default.svc.cluster.local",
            "type": "EDS",
            "eds_cluster_config": {
              "eds_config": {
                "ads": {},
                "initial_fetch_timeout": "0s",

  periodSeconds: 15
  timeoutSeconds: 10
  successThreshold: 1
  failureThreshold: 3
```

## Cluster probe

### Cluster-writeable probe

The reply is '200 OK' if cluster has write quorum if not it returns '503 Service Unavailable'.

```
curl http://minio1:9001/minio/health/cluster
HTTP/1.1 503 Service Unavailable
Accept-Ranges: bytes
Content-Length: 0
Server: MinIO
Vary: Origin

| `minio_cluster_usage_object_total`           | Total number of objects in a cluster                           |
| `minio_cluster_usage_total_bytes`            | Total cluster usage in bytes                                   |
| `minio_cluster_usage_version_total`          | Total number of versions (includes delete marker) in a cluster |

| `minio_cluster_health_drives_count`                | `gauge` | Count of all drives in the cluster             |        |
| `minio_cluster_health_nodes_offline_count`         | `gauge` | Count of offline nodes in the cluster          |        |
| `minio_cluster_health_nodes_online_count`          | `gauge` | Count of online nodes in the cluster           |        |

## Healthcheck Probe

MinIO server has two healthcheck related un-authenticated endpoints, a liveness probe to indicate if server is responding, cluster probe to check if server can be taken down for maintenance.

- Liveness probe available at `/minio/health/live`
- Cluster probe available at `/minio/health/cluster`

Read more on how to use these endpoints in [MinIO healthcheck guide](https://github.com/minio/minio/blob/master/docs/metrics/healthcheck/README.md).

func (e *EndpointFilter) Verify(host *admin.HostStatus, cluster string) bool {
	if e.Address == "" && e.Port == 0 && e.Cluster == "" && e.Status == "" {
		return true
	}
	if e.Address != "" && !strings.EqualFold(retrieveEndpointAddress(host), e.Address) {
		return false
	}
	if e.Port != 0 && retrieveEndpointPort(host) != e.Port {
		return false
	}
	if e.Cluster != "" && !strings.EqualFold(cluster, e.Cluster) {
		return false
	}