metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	"istio.io/api/security/v1beta1"
	"istio.io/istio/pilot/pkg/features"
	securityModel "istio.io/istio/pilot/pkg/security/model"
	"istio.io/istio/pkg/config/constants"
	"istio.io/istio/pkg/env"
	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/security"
	"istio.io/istio/security/pkg/cmd"
	"istio.io/istio/security/pkg/pki/ca"
	"istio.io/istio/security/pkg/pki/ra"

          },
          "expr": "sum(container_memory_working_set_bytes{namespace!=\"istio-system\",container=\"istio-proxy\"}) / count(container_memory_working_set_bytes{namespace!=\"istio-system\",container=\"istio-proxy\"})",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "per istio proxy",
          "refId": "B"
        }
      ],
      "title": "Memory Usage",

// limitations under the License.

package istio

import (
	"net/netip"
	"regexp"
	"strconv"
	"strings"
	"time"

	"google.golang.org/protobuf/types/known/structpb"
	corev1 "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/types"

	meshconfig "istio.io/api/mesh/v1alpha1"
	"istio.io/istio/pkg/kube/inject"
	"istio.io/istio/pkg/test"
	"istio.io/istio/pkg/test/framework/components/cluster"

[Unit]
Description=istio-sidecar: The Istio sidecar
Documentation=http://istio.io/
StartLimitIntervalSec=0

[Service]
ExecStart=/usr/local/bin/istio-start.sh
ExecStartPre=+/usr/bin/install -d -o istio-proxy -m 0755 /var/run/secrets
ExecStopPost=/usr/local/bin/istio-start.sh clean
Restart=always
RestartSec=10
KillMode=mixed
TimeoutStopSec=30s

[Install]

	// the command-line, that takes precedence.
	// nolint: revive, stylecheck
	KUBECONFIG Variable = "KUBECONFIG"

	// IstioSrc is the location of istio source ($TOP/src/istio.io/istio
	IstioSrc = REPO_ROOT.ValueOrDefaultFunc(getDefaultIstioSrc)

	// IstioOut is the location of the output directory ($TOP/out)
	IstioOut = verifyFile(TARGET_OUT, TARGET_OUT.ValueOrDefaultFunc(getDefaultIstioOut))

{
  "cniVersion": "0.3.1",
  "name": "istio-cni",
  "type": "istio-cni",
  "ipam": {},
  "dns": {},
  "plugin_log_level": "debug",
  "log_uds_address": "",
  "cni_event_address": "",
  "ambient_enabled": false,
  "kubernetes": {
    "kubeconfig": "/path/to/kubeconfig",
    "exclude_namespaces": [
      ""
    ]
  }

apiVersion: release-notes/v2
kind: feature
area: installation
issue: []
releaseNotes:
- |

```

3) `istio-control/istio-discovery` chart installs a revision of istiod.

```console
 helm install -n istio-system istiod manifests/charts/istio-control/istio-discovery --set profile=openshift
```

4) `gateways` charts install a load balancer with `ingress` and `egress`.

Ingress secrets and access should be separated from the control plane.

```console

# Architecture of Istiod

This document describes the high level architecture of the Istio control plane, Istiod.
Istiod is structured as a modular monolith, housing a wide range of functionality from certificate signing, proxy configuration (XDS), traditional Kubernetes controllers, and more.

## Proxy Configuration

  istioctl dashboard istiod-debug istiod-123-456.istio-system

  # Open Istio debug web UI for the istiod-56dd66799-jfdvs pod in a custom namespace
  istioctl dashboard istiod-debug istiod-123-456 -n custom-ns

  # Open Istio debug web UI for any Istiod pod
  istioctl dashboard istiod-debug deployment/istiod.istio-system

  # with short syntax
  istioctl dash istiod-debug pilot-123-456.istio-system