}
    }
  }

  /**
   * Not checking the CA bit created a vulnerability in old OkHttp releases. It is exploited by
   * triggering different chains to be discovered by the TLS engine and our chain cleaner. In this
   * attack there's several different chains.
   *
   *
   * The victim's gets a non-CA certificate signed by a CA, and pins the CA root and/or
   * intermediate. This is business as usual.
   *

						Name:      "istiod",
					},
					CABundle: []byte("ca"),
				},
			},
			{
				Name: fmt.Sprintf("object.%s", istioInjectionWebhookSuffix),
				ClientConfig: admitv1.WebhookClientConfig{
					Service: &admitv1.ServiceReference{
						Namespace: "default",
						Name:      "istiod",
					},
					CABundle: []byte("ca"),
				},
			},
		},
	}
	samplePath               = "/sample/path"

        if (opLambda != null) {
            opLambda.callback(builder);
        }
        if (aggsLambda != null) {
            DataConfigCA ca = new DataConfigCA();
            aggsLambda.callback(ca);
            ca.getAggregationBuilderList().forEach(builder::subAggregation);
        }
    }

        if (opLambda != null) {
            opLambda.callback(builder);
        }
        if (aggsLambda != null) {
            BadWordCA ca = new BadWordCA();
            aggsLambda.callback(ca);
            ca.getAggregationBuilderList().forEach(builder::subAggregation);
        }
    }

        if (opLambda != null) {
            opLambda.callback(builder);
        }
        if (aggsLambda != null) {
            CrawlingInfoParamCA ca = new CrawlingInfoParamCA();
            aggsLambda.callback(ca);
            ca.getAggregationBuilderList().forEach(builder::subAggregation);
        }
    }

    public void global(String name, ConditionOptionCall<GlobalAggregationBuilder> opLambda,

		} else {
			// get the CA value and remove it from the cert chain slice so it's not printed twice
			ca := secret.CertChain[0]
			secret.CertChain = secret.CertChain[1:]
			n := new(big.Int)
			n, _ = n.SetString(ca.SerialNumber, 10)
			fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%x\t%v\t%v\n",
				secret.Identity, "CA", secret.State, certNotExpired(ca), n, valueOrNA(ca.ExpirationTime), valueOrNA(ca.ValidFrom))

![SDS decision flow](docs/sds-flow.svg)

### Default CA Flow through istio-agent

![CA Flow](docs/ca.svg)

A single SDS request from Envoy goes through a few different layers in istio-agent.

      - name: istio-token
        projected:
          sources:
          - serviceAccountToken:
              audience: istio-ca
              expirationSeconds: 43200
              path: istio-token
      - configMap:
          name: istio-ca-root-cert
        name: istiod-ca-cert
      {{- if .Values.global.imagePullSecrets }}
      imagePullSecrets:
        {{- range .Values.global.imagePullSecrets }}

 * either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.es.config.cbean.ca;

import org.codelibs.fess.es.config.cbean.ca.bs.BsDataConfigCA;

/**
 * @author ESFlute (using FreeGen)
 */
public class DataConfigCA extends BsDataConfigCA {

 * either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.es.log.cbean.ca;

import org.codelibs.fess.es.log.cbean.ca.bs.BsFavoriteLogCA;

/**
 * @author ESFlute (using FreeGen)
 */
public class FavoriteLogCA extends BsFavoriteLogCA {