- clusterName: agent
  endpoints:
  - lbEndpoints:
    - endpoint:
        address:
          socketAddress:
            address: 127.0.0.1
            portValue: 15020
        healthCheckConfig: {}
      healthStatus: HEALTHY
      loadBalancingWeight: 1
    locality: {}
  policy:
    overprovisioningFactor: 140
- clusterName: outbound|9402||cert-manager-istio-csr-metrics.cert-manager.svc.cluster.local
  endpoints:
  - lbEndpoints:

  // The Kubernetes controllers that generate Endpoints and EndpointSlice resources for
  // Services interpret this to mean that all endpoints are considered "ready" even if the
  // Pods themselves are not. Agents which consume only Kubernetes generated endpoints
  // through the Endpoints or EndpointSlice resources can safely assume this behavior.
  // +optional
  optional bool publishNotReadyAddresses = 13;

# Istio Agent

This document describes the internal architecture of Istio agent.

## High Level overview

![High Level overview](docs/overview.svg)

At a high level, the Istio agent acts as an intermediate proxy between Istiod and Envoy. This is done
at two levels. For distributing workload certificates, Envoy will send [SDS](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret)

      grpc-simple: |
{{ .Files.Get "files/grpc-simple.yaml" | trim | indent 8 }}
{{- end }}
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "grpc-agent") }}
      grpc-agent: |
{{ .Files.Get "files/grpc-agent.yaml" | trim | indent 8 }}
{{- end }}
{{- if not (hasKey .Values.sidecarInjectorWebhook.templates "waypoint") }}
      waypoint: |
{{ .Files.Get "files/waypoint.yaml" | trim | indent 8 }}

Envoy Version:       0.0.0

NAME                                                                SERVICE FQDN                          PORT     SUBSET     DIRECTION       TYPE       DESTINATION RULE
cluster/agent                                                       cluster/agent                         -        -          -               STATIC     

			expected:   []string{},
			unexpected: secretDiffColumns,
		},
		{
			name:   "test tabular output with a single secret diff",
			format: TABULAR,
			diffs: []SecretItemDiff{
				{
					Agent: "alligator",
					Proxy: "proxy",
					SecretItem: SecretItem{
						Name:        "fields",
						Data:        "certdata",
						Source:      "should",
						Destination: "destination",

# This is intended to explore new features coming to Istio.
# Stability, security, and performance are not guaranteed - use at your own risk.
meshConfig:
  defaultConfig:
    proxyMetadata:
      # Enable Istio agent to handle DNS requests for known hosts
      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf

  # Revision tags are aliases to Istio control plane revisions
  revisionTags: []
  # For Helm compatibility.
  ownerName: ""
  # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior
  # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options
  meshConfig:
    enablePrometheusMerge: true
  experimental:
    stableValidationPolicy: false
  global:

	"github.com/containernetworking/plugins/pkg/ns"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"

	"istio.io/api/annotation"
	"istio.io/istio/pilot/cmd/pilot-agent/options"
	diff "istio.io/istio/pilot/test/util"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/maps"
	"istio.io/istio/pkg/slices"
	"istio.io/istio/pkg/test/env"
	"istio.io/istio/tools/istio-iptables/pkg/cmd"

			cniClient := newCNIClient(conf.CNIEventAddress, constants.CNIAddEventPath)
			if err = PushCNIEvent(cniClient, args, prevResIps, podName, podNamespace); err != nil {
				log.Errorf("istio-cni cmdAdd failed to signal node Istio CNI agent: %s", err)
				return err
			}
			return nil
		}
		log.Debugf("istio-cni ambient cmdAdd podName: %s - not ambient enabled, ignoring", podName)
	}
	// End ambient plugin logic

	pi := &PodInfo{}