# Istio Agent

This document describes the internal architecture of Istio agent.

## High Level overview

![High Level overview](docs/overview.svg)

At a high level, the Istio agent acts as an intermediate proxy between Istiod and Envoy. This is done
at two levels. For distributing workload certificates, Envoy will send [SDS](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret)

package options

import (
	"os"
	"path/filepath"
	"strings"

	meshconfig "istio.io/api/mesh/v1alpha1"
	"istio.io/istio/pkg/bootstrap/platform"
	istioagent "istio.io/istio/pkg/istio-agent"
	"istio.io/istio/pkg/util/sets"
	"istio.io/istio/pkg/wasm"
)

// Similar with ISTIO_META_, which is used to customize the node metadata - this customizes extra header.
const xdsHeaderPrefix = "XDS_HEADER_"

  template:
    metadata:
      labels:
        k8s-app: ip-masq-agent
    spec:
      priorityClassName: system-node-critical
      serviceAccountName: ip-masq-agent
      hostNetwork: true
      containers:
      - name: ip-masq-agent
        image: registry.k8s.io/networking/ip-masq-agent-amd64:v2.6.1
        args:
          - --masq-chain=IP-MASQ
          - --nomasq-all-reserved-ranges
        resources:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: grpc
spec:
  selector:
    matchLabels:
      app: grpc
  template:
    metadata:
      annotations:
        inject.istio.io/templates: grpc-agent
      labels:
        app: grpc
    spec:
      containers:
      - name: traffic
        image: "fake.docker.io/google-samples/traffic-go-gke:1.0"
        readinessProbe:
          httpGet:

--add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED -Xms1536m -Xmx6g -Dfile.encoding=UTF-8 -Djava.io.tmpdir=/home/tcagent1/agent/temp/buildTmp -Duser.country=US -Duser.language=en -Duser.variant -cp /home/tcagent1/.gradle/wrapper/dists/gradle-8.4-20230818222751+0000-bin/89h6cjxiw2m9bic290x647cni/gradle-8.4-20230818222751+0000/lib/gradle-launcher-8.4.jar -javaagent:/home/tcagent1/.gradle/wrapper/dists/gradle-8.4-20230818222751+0000-bin/89h6cjxiw2m9bic290x647cni/gradle-8.4-20230818222751+0000/li...

kind: ClusterRole
metadata:
  name: stackdriver:metadata-agent
  labels:
    kubernetes.io/cluster-service: "true"
    addonmanager.kubernetes.io/mode: Reconcile
rules:
- apiGroups:
  - "*"
  resources:
  - "*"
  verbs:
  - watch
  - get
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: stackdriver:metadata-agent
  labels:
    kubernetes.io/cluster-service: "true"

metadata:
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
    k8s-app: konnectivity-agent
  namespace: kube-system
  name: konnectivity-agent
spec:
  selector:
    matchLabels:
      k8s-app: konnectivity-agent
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        k8s-app: konnectivity-agent
    spec:
      priorityClassName: system-cluster-critical
      tolerations:

			args:   []args{{agent: "myagent", text: "mytext"}},
			expect: []string{`299 myagent "mytext"`},
		},
		{
			name: "duplicate text",
			args: []args{
				{agent: "myagent", text: "mytext"},
				{agent: "myagent2", text: "mytext"},
			},
			expect: []string{`299 myagent "mytext"`},
		},
		{
			name: "multiple",
			args: []args{
				{agent: "", text: "mytext1"},
				{agent: "", text: "mytext2"},

apiVersion: release-notes/v2
kind: feature
area: telemetry
issue:
- 22825
releaseNotes:
- |
  **Added** Prometheus metrics to istio-agent.
- |

      cc_ctx->coordination_service_agent());
}

bool TF_CoordinationServiceIsInitialized(TF_CoordinationServiceAgent* agent) {
  if (agent == nullptr) return false;
  auto* cc_agent = reinterpret_cast<tsl::CoordinationServiceAgent*>(agent);
  return cc_agent->IsInitialized();
}

void TF_CoordinationServiceInsertKeyValue(const char* key, int64_t key_size,