- [Multi-platform](#multi-platform)
      - [Cloud Providers](#cloud-providers)
    - [Network](#network)
      - [network-policy](#network-policy)
      - [kube-proxy ipvs mode](#kube-proxy-ipvs-mode)
    - [API Machinery](#api-machinery)
      - [kube-apiserver](#kube-apiserver)
      - [Dynamic Admission Control](#dynamic-admission-control)

* kube-apiserver: the root /proxy paths have been removed (deprecated since v1.2). Use the /proxy subresources on objects that support HTTP proxying. ([#59884](https://github.com/kubernetes/kubernetes/pull/59884), [@mikedanese](https://github.com/mikedanese))

[前チャプターのHTTPSについて](https.md){.internal-link target=_blank}では、HTTPSがどのようにAPIを暗号化するのかについて学びました。

通常、アプリケーションサーバにとって**外部の**コンポーネントである**TLS Termination Proxy**によって提供されることが一般的です。このプロキシは通信の暗号化を担当します。

さらにセキュアな通信において、HTTPS証明書の定期的な更新を行いますが、これはTLS Termination Proxyと同じコンポーネントが担当することもあれば、別のコンポーネントが担当することもあります。

### HTTPS 用ツールの例
TLS Termination Proxyとして使用できるツールには以下のようなものがあります：

* Traefik
    * 証明書の更新を自動的に処理 ✨
* Caddy
    * 証明書の更新を自動的に処理 ✨
* Nginx

	proxyAdminPort int

	configDumpFile string

	node string
}

func (c *commonFlags) attach(cmd *cobra.Command) {
	cmd.PersistentFlags().IntVar(&c.proxyAdminPort, "proxy-admin-port", defaultProxyAdminPort, "Ztunnel proxy admin port")
	cmd.PersistentFlags().StringVarP(&c.outputFormat, "output", "o", summaryOutput, "Output format: one of json|yaml|short")

    * [metatada-proxy addon] Bump prometheus-to-sd v0.5.0 to pick up security fixes.
* Node-Problem-Detector configuration is now decoupled from the Kubernetes release on GKE/GCE. ([#73288](https://github.com/kubernetes/kubernetes/pull/73288), [@wangzhen127](https://github.com/wangzhen127))

                    <mxGeometry x="495" y="320" width="355" height="440" as="geometry"/>
                </mxCell>
                <mxCell id="7" value="&lt;font style=&quot;font-size: 24px&quot; face=&quot;Roboto&quot;&gt;TLS Termination Proxy&lt;br&gt;&lt;/font&gt;" style="text;html=1;strokeColor=none;fillColor=none;align=center;verticalAlign=middle;whiteSpace=wrap;rounded=0;strokeWidth=3;fontFamily=Roboto Mono, mono;FType=g;" parent="1" vertex="1">

	HTTPListener = wellknown.HTTPConnectionManager

	// TCPListener identifies a listener as being of TCP type by the presence of TCP proxy filter
	TCPListener = wellknown.TCPProxy

	IPMatcher = "type.googleapis.com/xds.type.matcher.v3.IPMatcher"
)

// ListenerFilter is used to pass filter information into listener based config writer print functions

	public final fun takeRequest ()Lokhttp3/mockwebserver/RecordedRequest;
	public final fun takeRequest (JLjava/util/concurrent/TimeUnit;)Lokhttp3/mockwebserver/RecordedRequest;
	public final fun toProxyAddress ()Ljava/net/Proxy;
	public fun toString ()Ljava/lang/String;
	public final fun url (Ljava/lang/String;)Lokhttp3/HttpUrl;
	public final fun useHttps (Ljavax/net/ssl/SSLSocketFactory;Z)V
}

                    {
                        "endpoint": {
                            "address": {
                                "pipe": {
                                    "path": "./etc/istio/proxy/XDS"
                                }
                            },
                            "healthCheckConfig": {}
                        },
                        "healthStatus": "HEALTHY",

    locality: {}
  policy:
    overprovisioningFactor: 140
- clusterName: xds-grpc
  endpoints:
  - lbEndpoints:
    - endpoint:
        address:
          pipe:
            path: ./etc/istio/proxy/XDS
        healthCheckConfig: {}
      healthStatus: HEALTHY
      loadBalancingWeight: 1
    locality: {}
  policy: