- [security](security/). This directory contains [security](https://istio.io/latest/docs/concepts/security/) related code,
including Citadel (acting as Certificate Authority), citadel agent, etc.

- [istio/proxy](https://github.com/istio/proxy). The Istio proxy contains
extensions to the [Envoy proxy](https://github.com/envoyproxy/envoy) (in the form of

	"github.com/containernetworking/plugins/pkg/ns"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"

	"istio.io/api/annotation"
	"istio.io/istio/pilot/cmd/pilot-agent/options"
	diff "istio.io/istio/pilot/test/util"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/maps"
	"istio.io/istio/pkg/slices"
	"istio.io/istio/pkg/test/env"
	"istio.io/istio/tools/istio-iptables/pkg/cmd"

> Host: localhost:9000
> User-Agent: curl/7.81.0
> Accept: */*
>

                },
                {
                    "endpoint_config": {
                        "@type": "type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment",
                        "cluster_name": "agent",
                        "endpoints": [
                            {
                                "locality": {},
                                "lb_endpoints": [
                                    {

- `aws:username` - This is a string containing the friendly name of the current user, this value would point to STS temporary credential in `AssumeRole`ed requests, use `jwt:preferred_username` in case of OpenID connect and `ldap:username`...

<mxfile host="65bd71144e" modified="2020-11-28T18:13:19.199Z" agent="5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Code/1.51.1 Chrome/83.0.4103.122 Electron/9.3.3 Safari/537.36" etag="KPHuXUeExV3PdWouu_3U" version="13.6.5">
    <diagram id="zB4-QXJZ7ScUzHSLnJ1i" name="Page-1">

        .method("CONNECT", null)
        .header("Host", route.address.url.toHostHeader(includeDefaultPort = true))
        .header("Proxy-Connection", "Keep-Alive") // For HTTP/1.0 proxies like Squid.
        .header("User-Agent", USER_AGENT)
        .build()

    val fakeAuthChallengeResponse =
      Response.Builder()
        .request(proxyConnectRequest)
        .protocol(Protocol.HTTP_1_1)

labels.regularName=Regular Name
labels.replacement=Replacement
labels.sessionId=Session ID
labels.sortOrder=Display Order
labels.updatedBy=Updated by
labels.updatedTime=Updated Time
labels.urls=URLs
labels.userAgent=User Agent
labels.username=Username
labels.value=Value
labels.versionNo=Version No.
labels.cronExpression=Schedule
labels.dayForCleanup=Remove Documents Before Days
labels.crawlingThreadCount=Simultaneous Crawler Config

As an extreme, the goal is to be possible to run Istio workloads in a cluster without installing any Istio component
in that cluster. Currently, the minimum we require is the security provider (node agent or citadel).

### Install Istio CRDs

This is the first step of the installation. Please do not remove or edit any CRD - config currently requires

		cniInstalls.With(resultLabel.Value(resultCopyBinariesFailure)).Increment()
		return copiedFiles, fmt.Errorf("copy binaries: %v", err)
	}

	// Write kubeconfig with our current service account token as the contents, to the Istio agent rundir.
	// We do not write this to the common/shared CNI config dir, because it's not CNI config, we do not
	// need to watch it, and writing non-shared stuff to that location creates churn for other node agents.