- name: {{ $container.Name }}
    env:
      - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT"
        value: "true"
      - name: "GRPC_XDS_BOOTSTRAP"
        value: "/etc/istio/proxy/grpc-bootstrap.json"
    volumeMounts:
      - mountPath: /var/lib/istio/data
        name: istio-data
      # UDS channel between istioagent and gRPC client for XDS/SDS
      - mountPath: /etc/istio/proxy
        name: istio-xds

}

// DialOptions constructs gRPC dial options from command line configuration
func DialOptions(opts clioptions.CentralControlPlaneOptions,
	ns, serviceAccount string, kubeClient kube.CLIClient,
) ([]grpc.DialOption, error) {
	ctx := context.TODO()
	// If we are using the insecure 15010 don't bother getting a token
	if opts.Plaintext || opts.CertDir != "" {
		return make([]grpc.DialOption, 0), nil
	}
	// Use bearer token

                            "api_config_source": {
                              "api_type": "GRPC",
                              "grpc_services": [
                                {
                                  "envoy_grpc": {
                                    "cluster_name": "sds-grpc"
                                  }
                                }
                              ],

{{- end }}
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
      grpc-simple: |
{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
{{- end }}
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
      grpc-agent: |
{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
{{- end }}

              "name": "default",
              "sds_config": {
               "api_config_source": {
                "api_type": "GRPC",
                "grpc_services": [
                 {
                  "envoy_grpc": {
                   "cluster_name": "sds-grpc"
                  }
                 }
                ],
                "set_node_on_first_message_only": true,

digraph { grpc -> ca [label="Send CSR gRPC Request"] subgraph cluster_istioagent { label = "Istio Agent" color="orange" sds SecretManager -> caClient [label="Sign CSR"] caClient -> grpc grpc -> TokenProvider [dir=none,label="Fetch JWT",color=purple] grpc -> cfiles [dir=none,label="Fetch Cert",color=purple] sds -> SecretManager [label="Generate certificate"] SecretManager -> cfiles [label="Write certs to file"] cfiles [label="Certificate Files"] grpc [shape=diamond] } subgraph cluster_istiod {...

                        "host_selection_retry_max_attempts": "5",
                        "retriable_status_codes": [
                          503
                        ]
                      },
                      "max_grpc_timeout": "0s"
                    },
                    "metadata": {
                      "filter_metadata": {
                        "istio": {

	}
	conn.Close()
}

func connect(socket string) (*grpc.ClientConn, error) {
	var opts []grpc.DialOption

	opts = append(opts, grpc.WithTransportCredentials(insecure.NewCredentials()), grpc.WithContextDialer(func(ctx context.Context, addr string) (net.Conn, error) {
		var d net.Dialer
		return d.DialContext(ctx, "unix", socket)
	}))

	conn, err := grpc.Dial(socket, opts...)
	if err != nil {
		return nil, err
	}

{{- end }}
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-simple") }}
      grpc-simple: |
{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
{{- end }}
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
      grpc-agent: |
{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
{{- end }}

                              "api_config_source": {
                                "api_type": "GRPC",
                                "grpc_services": [
                                  {
                                    "envoy_grpc": {
                                      "cluster_name": "sds-grpc"
                                    }
                                  }
                                ],