Istio has a variety of [controllers](https://kubernetes.io/docs/concepts/architecture/controller/), which basically watch some inputs and do something.
This can be reading from Kubernetes and writing other objects back, writing to proxies over XDS, etc.

Unfortunately, writing controllers is very error prone, even for seemingly simple cases.
To work around this, Istio has a variety of abstractions meant to make writing controllers easier.

## Clients

For various reasons outside the scope of this document, there is a desire to move from a sidecar based architecture to a "remote proxy" architecture.
However, this has one glaring issue: how do we get the traffic to the remote proxies, while maintaining the zero-trust properties that Istio is built upon?

A secondary goal was to enable a smoother on-ramp from "Zero" to "Getting some value".

    @Override
    public void injectMirror(List<ArtifactRepository> repositories, List<Mirror> mirrors) {}

    @Override
    public void injectProxy(List<ArtifactRepository> repositories, List<Proxy> proxies) {}

    @Override
    public void publish(
            ArtifactRepository repository, File source, String remotePath, ArtifactTransferListener transferListener)
            throws ArtifactTransferFailedException {

    val proxySelector = RecordingProxySelector()
    val socketAddress = InetSocketAddress.createUnresolved("myproxy", 8008)
    proxySelector.proxies.add(Proxy(Proxy.Type.HTTP, socketAddress))

    // Define two host names for the DNS routing of fake proxy servers
    val proxyServer1 = InetAddress.getByAddress("proxyServer1", byteArrayOf(127, 0, 0, 2))

As it is discouraged, the interactive docs with Swagger UI won't show the documentation for the body when using `GET`, and proxies in the middle might not support it.

///

## Import Pydantic's `BaseModel`

First, you need to import `BaseModel` from `pydantic`:

{* ../../docs_src/body/tutorial001_py310.py hl[2] *}

O Uvicorn esperará que o proxy acesse o Uvicorn em `http://127.0.0.1:8000/app`, e então seria responsabilidade do proxy adicionar o prefixo extra `/api/v1` no topo.

## Sobre proxies com um prefixo de caminho removido

Tenha em mente que um proxy com prefixo de caminho removido é apenas uma das maneiras de configurá-lo.

Como é desencorajado, a documentação interativa com Swagger UI não irá mostrar a documentação para o corpo da requisição para um `GET`, e proxies que intermediarem podem não suportar o corpo da requisição.

///

## Importe o `BaseModel` do Pydantic

Primeiro, você precisa importar `BaseModel` do `pydantic`:

```Python hl_lines="4"

- `aws:SecureTransport` - This is a Boolean value that represents whether the request was sent over TLS.
- `aws:SourceIp` - This is the requester's IP address, for use with IP address conditions. If running behind Nginx like proxies, MinIO preserve's the source IP.

```
{
  "Version": "2012-10-17",
  "Statement": {
	"Effect": "Allow",
	"Action": "s3:ListBucket*",
	"Resource": "arn:aws:s3:::mybucket",

        .url(route.address.url)
        .method("CONNECT", null)
        .header("Host", route.address.url.toHostHeader(includeDefaultPort = true))
        .header("Proxy-Connection", "Keep-Alive") // For HTTP/1.0 proxies like Squid.
        .header("User-Agent", USER_AGENT)
        .build()

    val fakeAuthChallengeResponse =
      Response.Builder()
        .request(proxyConnectRequest)
        .protocol(Protocol.HTTP_1_1)

	// the following fails.
	// This is so that if it is removed from the mesh, the inpod rules will unconditionally
	// be removed.

	log.Debug("notifying subscribed node proxies")
	if err := s.sendPodToZtunnelAndWaitForAck(ctx, pod, openNetns); err != nil {
		return NewErrPartialAdd(err)
	}
	return nil
}