flowchart TD
    subgraph Control Plane
        direction TB
        Istiod[Istiod<br/>控制平面统一组件]
        Pilot[Pilot<br/>配置管理]
        Citadel[Citadel<br/>证书管理]  
        Galley[Galley<br/>配置验证]
        
        Istiod --> Pilot
        Istiod --> Citadel
        Istiod --> Galley
    end
    
    subgraph Data Plane
        direction LR
        Envoy1[Envoy Proxy<br/>Service A]
        Envoy2[Envoy Proxy<br/>Service B]
        Envoy3[Envoy Proxy<br/>Service C]
        Gateway[Istio Gateway<br/>入口网关]
    end
    
    subgraph Management Tools
        direction TB
        Istioctl[istioctl<br/>命令行工具]
        Operator[Istio Operator<br/>运维管理]
    end
    
    subgraph Infrastructure
        direction TB
        K8s[Kubernetes API Server]
        CNI[Istio CNI<br/>网络插件]
    end
    
    %% 控制流
    Pilot -.->|配置推送<br/>xDS协议| Envoy1
    Pilot -.->|配置推送<br/>xDS协议| Envoy2
    Pilot -.->|配置推送<br/>xDS协议| Envoy3
    Pilot -.->|配置推送<br/>xDS协议| Gateway
    
    Citadel -.->|证书分发| Envoy1
    Citadel -.->|证书分发| Envoy2
    Citadel -.->|证书分发| Envoy3
    
    %% 数据流
    Gateway -->|流量转发| Envoy1
    Envoy1 -->|服务调用| Envoy2
    Envoy2 -->|服务调用| Envoy3
    
    %% 管理流
    Istioctl -.->|管理命令| Istiod
    Operator -.->|部署配置| K8s
    Galley -.->|配置监听| K8s
    CNI -.->|网络配置| K8s
    
    %% 样式
    classDef controlPlane fill:#e1f5fe
    classDef dataPlane fill:#f3e5f5
    classDef management fill:#e8f5e8
    classDef infrastructure fill:#fff3e0
    
    class Istiod,Pilot,Citadel,Galley controlPlane
    class Envoy1,Envoy2,Envoy3,Gateway dataPlane
    class Istioctl,Operator management
    class K8s,CNI infrastructure

sequenceDiagram
    autonumber
    participant User as 用户/应用
    participant Gateway as Istio Gateway
    participant EnvoyA as Service A Envoy
    participant ServiceA as Service A
    participant EnvoyB as Service B Envoy  
    participant ServiceB as Service B
    participant Pilot as Pilot
    participant Citadel as Citadel
    participant K8s as Kubernetes API
    
    Note over Pilot,K8s: 控制平面初始化阶段
    K8s->>Pilot: 监听服务和配置变更
    Pilot->>EnvoyA: 推送LDS/CDS/RDS配置
    Pilot->>EnvoyB: 推送LDS/CDS/RDS配置
    Citadel->>EnvoyA: 分发mTLS证书
    Citadel->>EnvoyB: 分发mTLS证书
    
    Note over User,ServiceB: 服务调用阶段
    User->>Gateway: HTTP请求
    Gateway->>EnvoyA: 根据路由规则转发
    EnvoyA->>ServiceA: 业务请求处理
    ServiceA->>EnvoyA: 发起downstream调用
    EnvoyA->>EnvoyB: mTLS加密传输
    EnvoyB->>ServiceB: 解密后转发
    ServiceB->>EnvoyB: 返回响应
    EnvoyB->>EnvoyA: mTLS加密响应
    EnvoyA->>ServiceA: 返回结果
    ServiceA->>EnvoyA: 业务响应
    EnvoyA->>Gateway: 返回最终结果
    Gateway->>User: HTTP响应
    
    Note over Pilot,EnvoyB: 配置动态更新阶段
    K8s->>Pilot: 配置变更通知
    Pilot->>Pilot: 计算配置差异
    Pilot->>EnvoyA: 增量配置推送
    Pilot->>EnvoyB: 增量配置推送
    EnvoyA->>Pilot: ACK确认
    EnvoyB->>Pilot: ACK确认