flowchart TD
    subgraph "配置输入层"
        IstioOperatorCR[IstioOperator CR]
        ConfigFiles[配置文件]
        CLI[命令行参数]
        Profile[预定义配置模板]
    end
    
    subgraph "配置处理层"
        Validator[配置验证器<br/>Validator]
        Merger[配置合并器<br/>ConfigMerger]
        Translator[配置转换器<br/>Translator]
    end
    
    subgraph "渲染引擎层"
        ManifestRenderer[清单渲染器<br/>ManifestRenderer]
        HelmRenderer[Helm渲染器<br/>HelmRenderer]
        ComponentRenderer[组件渲染器<br/>ComponentRenderer]
        TemplateEngine[模板引擎<br/>TemplateEngine]
    end
    
    subgraph "组件管理层"
        ComponentManager[组件管理器<br/>ComponentManager]
        subgraph "核心组件"
            PilotComponent[Pilot组件]
            GatewayComponent[Gateway组件]
            CNIComponent[CNI组件]
            BaseComponent[Base组件]
        end
    end
    
    subgraph "部署执行层"
        Installer[安装器<br/>Installer]
        ResourceApplier[资源应用器<br/>ResourceApplier]
        ProgressTracker[进度跟踪器<br/>ProgressTracker]
        StateManager[状态管理器<br/>StateManager]
    end
    
    subgraph "目标环境"
        K8sAPI[Kubernetes API]
        IstioComponents[Istio组件]
        Workloads[应用工作负载]
    end
    
    %% 配置流向
    IstioOperatorCR -->|解析| Validator
    ConfigFiles -->|加载| Validator
    CLI -->|参数| Validator
    Profile -->|模板| Merger
    
    Validator -->|验证配置| Merger
    Merger -->|合并配置| Translator
    Translator -->|转换| ManifestRenderer
    
    %% 渲染流向
    ManifestRenderer -->|调用| HelmRenderer
    ManifestRenderer -->|调用| ComponentRenderer
    HelmRenderer -->|使用| TemplateEngine
    ComponentRenderer -->|生成清单| ComponentManager
    
    %% 组件管理
    ComponentManager -->|管理| PilotComponent
    ComponentManager -->|管理| GatewayComponent
    ComponentManager -->|管理| CNIComponent
    ComponentManager -->|管理| BaseComponent
    
    %% 部署流向
    ComponentManager -->|生成清单| Installer
    Installer -->|应用资源| ResourceApplier
    ResourceApplier -->|部署| K8sAPI
    Installer -->|跟踪进度| ProgressTracker
    Installer -->|管理状态| StateManager
    
    %% 目标环境
    K8sAPI -->|创建| IstioComponents
    IstioComponents -->|服务| Workloads
    
    %% 反馈流向
    StateManager -.->|状态反馈| ComponentManager
    ProgressTracker -.->|进度更新| ManifestRenderer
    
    %% 样式定义
    classDef input fill:#e3f2fd
    classDef process fill:#f3e5f5
    classDef render fill:#e8f5e8
    classDef component fill:#fff3e0
    classDef deploy fill:#fce4ec
    classDef target fill:#f1f8e9
    
    class IstioOperatorCR,ConfigFiles,CLI,Profile input
    class Validator,Merger,Translator process
    class ManifestRenderer,HelmRenderer,ComponentRenderer,TemplateEngine render
    class ComponentManager,PilotComponent,GatewayComponent,CNIComponent,BaseComponent component
    class Installer,ResourceApplier,ProgressTracker,StateManager deploy
    class K8sAPI,IstioComponents,Workloads target

type IstioOperator struct {
    metav1.TypeMeta   `json:",inline"`
    metav1.ObjectMeta `json:"metadata,omitempty"`
    Spec              IstioOperatorSpec `json:"spec,omitempty"`
}

type IstioOperatorSpec struct {
    // 配置模板名称（如default、minimal、demo等）
    Profile string `json:"profile,omitempty"`
    
    // 镜像仓库根路径
    Hub string `json:"hub,omitempty"`
    
    // 镜像标签版本
    Tag any `json:"tag,omitempty"`
    
    // 安装命名空间
    Namespace string `json:"namespace,omitempty"`
    
    // 修订版本标识
    Revision string `json:"revision,omitempty"`
    
    // 兼容性版本
    CompatibilityVersion string `json:"compatibilityVersion,omitempty"`
    
    // 网格配置
    MeshConfig json.RawMessage `json:"meshConfig,omitempty"`
    
    // 组件配置
    Components *IstioComponentSpec `json:"components,omitempty"`
    
    // Helm values覆盖
    Values json.RawMessage `json:"values,omitempty"`
}

type IstioComponentSpec struct {
    // 基础组件（CRD、RBAC等）
    Base *BaseComponentSpec `json:"base,omitempty"`
    
    // Pilot组件配置
    Pilot *ComponentSpec `json:"pilot,omitempty"`
    
    // 代理配置
    Proxy *ProxyComponentSpec `json:"proxy,omitempty"`
    
    // 入口网关配置
    IngressGateways []*GatewaySpec `json:"ingressGateways,omitempty"`
    
    // 出口网关配置
    EgressGateways []*GatewaySpec `json:"egressGateways,omitempty"`
    
    // CNI组件配置
    Cni *ComponentSpec `json:"cni,omitempty"`
    
    // Ztunnel组件配置
    Ztunnel *ComponentSpec `json:"ztunnel,omitempty"`
}

type Validator struct {
    schemaValidator *SchemaValidator
    semanticValidator *SemanticValidator
    warningHandler WarningHandler
}

// 验证IstioOperator配置
func (v *Validator) ValidateConfig(iop *IstioOperator) error {
    // 1) 结构验证 - 检查字段类型和格式
    if err := v.schemaValidator.Validate(iop); err != nil {
        return fmt.Errorf("配置结构验证失败: %v", err)
    }
    
    // 2) 语义验证 - 检查配置逻辑合理性
    if err := v.semanticValidator.Validate(iop); err != nil {
        return fmt.Errorf("配置语义验证失败: %v", err)
    }
    
    // 3) 兼容性检查 - 验证版本兼容性
    if err := v.validateCompatibility(iop); err != nil {
        return fmt.Errorf("兼容性验证失败: %v", err)
    }
    
    return nil
}

// 语义验证核心逻辑
func (sv *SemanticValidator) validateComponent(component *ComponentSpec) error {
    // 验证资源限制合理性
    if component.K8s != nil && component.K8s.Resources != nil {
        if err := sv.validateResourceRequirements(component.K8s.Resources); err != nil {
            return err
        }
    }
    
    // 验证副本数配置
    if component.K8s != nil && component.K8s.ReplicaCount != nil {
        if *component.K8s.ReplicaCount < 0 {
            return fmt.Errorf("副本数不能为负数")
        }
    }
    
    // 验证环境变量配置
    if component.K8s != nil {
        for _, env := range component.K8s.Env {
            if env.Name == "" {
                return fmt.Errorf("环境变量名称不能为空")
            }
        }
    }
    
    return nil
}

type ManifestRenderer struct {
    helmRenderer      *HelmRenderer
    componentRenderer *ComponentRenderer
    templateCache     map[string]*template.Template
    mutex            sync.RWMutex
}

// 渲染配置为Kubernetes清单
func (mr *ManifestRenderer) RenderManifest(iop *IstioOperator) (*ManifestSet, error) {
    manifestSet := &ManifestSet{
        Manifests: make(map[ComponentName][]Manifest),
    }
    
    // 1) 渲染基础组件
    baseManifests, err := mr.renderBaseComponent(iop)
    if err != nil {
        return nil, fmt.Errorf("渲染基础组件失败: %v", err)
    }
    manifestSet.Manifests[ComponentNameBase] = baseManifests
    
    // 2) 渲染Pilot组件
    if iop.Spec.Components != nil && iop.Spec.Components.Pilot != nil {
        pilotManifests, err := mr.renderPilotComponent(iop)
        if err != nil {
            return nil, fmt.Errorf("渲染Pilot组件失败: %v", err)
        }
        manifestSet.Manifests[ComponentNamePilot] = pilotManifests
    }
    
    // 3) 渲染网关组件
    gatewayManifests, err := mr.renderGatewayComponents(iop)
    if err != nil {
        return nil, fmt.Errorf("渲染网关组件失败: %v", err)
    }
    for name, manifests := range gatewayManifests {
        manifestSet.Manifests[name] = manifests
    }
    
    return manifestSet, nil
}

// Helm模板渲染
func (mr *ManifestRenderer) renderHelmChart(chartPath string, values map[string]interface{}) ([]Manifest, error) {
    // 1) 加载Helm图表
    chart, err := loader.Load(chartPath)
    if err != nil {
        return nil, fmt.Errorf("加载Helm图表失败: %v", err)
    }
    
    // 2) 渲染模板
    renderOpts := chartutil.ReleaseOptions{
        Name:      "istio",
        Namespace: "istio-system",
        Revision:  1,
        IsInstall: true,
    }
    
    caps := &chartutil.Capabilities{
        APIVersions: chartutil.DefaultVersionSet,
        KubeVersion: chartutil.DefaultKubeVersion,
    }
    
    valuesToRender, err := chartutil.ToRenderValues(chart, values, renderOpts, caps)
    if err != nil {
        return nil, fmt.Errorf("准备渲染值失败: %v", err)
    }
    
    files, err := engine.Render(chart, valuesToRender)
    if err != nil {
        return nil, fmt.Errorf("渲染模板失败: %v", err)
    }
    
    // 3) 转换为Manifest对象
    manifests := make([]Manifest, 0)
    for filename, content := range files {
        if strings.HasSuffix(filename, ".yaml") && content != "" {
            manifest := Manifest{
                Name:    filepath.Base(filename),
                Content: content,
            }
            manifests = append(manifests, manifest)
        }
    }
    
    return manifests, nil
}

type Installer struct {
    Kube          kubernetes.Interface
    DryRun        bool
    SkipWait      bool
    WaitTimeout   time.Duration
    ProgressLogger ProgressLogger
    FieldManager  string
}

// 安装Istio组件
func (i *Installer) Install(manifestSet *ManifestSet) error {
    // 1) 按依赖关系排序组件
    sortedComponents := i.sortComponentsByDependency(manifestSet)
    
    // 2) 逐个安装组件
    for _, componentName := range sortedComponents {
        manifests := manifestSet.Manifests[componentName]
        if len(manifests) == 0 {
            continue
        }
        
        if err := i.installComponent(componentName, manifests); err != nil {
            return fmt.Errorf("安装组件 %s 失败: %v", componentName, err)
        }
    }
    
    return nil
}

// 安装单个组件
func (i *Installer) installComponent(componentName ComponentName, manifests []Manifest) error {
    componentLogger := i.ProgressLogger.NewComponent(string(componentName))
    
    // 1) 按资源类型排序（确保依赖顺序）
    sortedManifests := i.sortManifestsByKind(manifests)
    
    // 2) 应用每个资源
    for _, manifest := range sortedManifests {
        // 添加标签和注解
        labeledManifest, err := i.applyLabelsAndAnnotations(manifest, string(componentName))
        if err != nil {
            componentLogger.ReportError(err.Error())
            return err
        }
        
        // 执行Server-Side Apply
        if err := i.serverSideApply(labeledManifest); err != nil {
            componentLogger.ReportError(err.Error())
            return err
        }
        
        componentLogger.ReportProgress()
    }
    
    // 3) 等待资源就绪（如果需要）
    if !i.SkipWait {
        if err := i.waitForResourcesReady(manifests); err != nil {
            componentLogger.ReportError(err.Error())
            return err
        }
    }
    
    componentLogger.ReportFinished()
    return nil
}

// Server-Side Apply实现
func (i *Installer) serverSideApply(manifest Manifest) error {
    // 1) 获取动态客户端
    gvk := manifest.GroupVersionKind()
    dynamicClient, err := i.Kube.DynamicClientFor(gvk, manifest.Unstructured, "")
    if err != nil {
        return fmt.Errorf("获取动态客户端失败: %v", err)
    }
    
    // 2) 执行Server-Side Apply
    patchOptions := metav1.PatchOptions{
        DryRun:       i.getDryRunOptions(),
        Force:        ptr.Of(true),
        FieldManager: i.FieldManager,
    }
    
    _, err = dynamicClient.Patch(
        context.TODO(),
        manifest.GetName(),
        types.ApplyPatchType,
        []byte(manifest.Content),
        patchOptions,
    )
    
    if err != nil {
        return fmt.Errorf("应用资源失败 %s/%s: %v", 
            manifest.GetKind(), manifest.GetName(), err)
    }
    
    return nil
}

sequenceDiagram
    autonumber
    participant User as 用户
    participant CLI as istioctl
    participant Validator as 配置验证器
    participant Renderer as 清单渲染器
    participant Installer as 安装器
    participant K8sAPI as Kubernetes API
    participant Components as Istio组件
    
    Note over User,Components: 配置准备阶段
    User->>CLI: istioctl install --set values.pilot.env.LOG_LEVEL=debug
    CLI->>CLI: 解析命令行参数
    CLI->>CLI: 加载默认profile配置
    CLI->>CLI: 合并用户配置覆盖
    
    Note over CLI,Renderer: 配置验证阶段
    CLI->>Validator: 验证IstioOperator配置
    Validator->>Validator: 结构验证（Schema）
    Validator->>Validator: 语义验证（逻辑检查）
    Validator->>Validator: 兼容性验证
    Validator->>CLI: 返回验证结果
    
    Note over CLI,K8sAPI: 清单生成阶段
    CLI->>Renderer: 渲染Kubernetes清单
    Renderer->>Renderer: 渲染Base组件清单
    Renderer->>Renderer: 渲染Pilot组件清单
    Renderer->>Renderer: 渲染Gateway组件清单
    Renderer->>Renderer: 渲染CNI组件清单
    Renderer->>CLI: 返回完整清单集合
    
    Note over CLI,Components: 资源部署阶段
    CLI->>Installer: 执行安装操作
    
    loop 按依赖顺序安装各组件
        Installer->>K8sAPI: Server-Side Apply Base资源
        K8sAPI->>Installer: 确认Base资源创建
        Installer->>K8sAPI: Server-Side Apply Pilot资源
        K8sAPI->>Installer: 确认Pilot资源创建
        Installer->>K8sAPI: Server-Side Apply Gateway资源
        K8sAPI->>Installer: 确认Gateway资源创建
    end
    
    Note over Installer,Components: 状态等待阶段
    Installer->>K8sAPI: 查询Pilot Deployment状态
    K8sAPI->>Installer: 返回Deployment状态
    Installer->>K8sAPI: 查询Gateway Deployment状态  
    K8sAPI->>Installer: 返回Deployment状态
    
    loop 等待所有组件就绪
        K8sAPI->>Components: 启动Istio组件Pod
        Components->>K8sAPI: 报告Pod就绪状态
        K8sAPI->>Installer: 组件状态更新
    end
    
    Installer->>CLI: 安装完成通知
    CLI->>User: 显示安装结果

sequenceDiagram
    autonumber
    participant User as 用户
    participant CLI as istioctl
    participant ConfigDiff as 配置差异计算器
    participant Renderer as 清单渲染器
    participant Installer as 安装器
    participant K8sAPI as Kubernetes API
    participant Components as Istio组件
    
    Note over User,Components: 配置变更检测阶段
    User->>CLI: istioctl install --set values.pilot.resources.requests.memory=2Gi
    CLI->>CLI: 加载当前安装的配置
    CLI->>ConfigDiff: 计算配置差异
    ConfigDiff->>ConfigDiff: 对比新旧配置
    ConfigDiff->>ConfigDiff: 识别影响的组件
    ConfigDiff->>CLI: 返回差异分析结果
    
    Note over CLI,Installer: 增量更新准备阶段
    CLI->>Renderer: 渲染受影响组件的清单
    Renderer->>Renderer: 仅渲染变更的组件
    Renderer->>CLI: 返回增量清单
    CLI->>Installer: 执行增量更新
    
    Note over Installer,Components: 滚动更新执行阶段
    Installer->>K8sAPI: 更新Pilot Deployment配置
    K8sAPI->>K8sAPI: 触发滚动更新
    K8sAPI->>Components: 创建新版本Pod
    Components->>K8sAPI: 新Pod就绪通知
    K8sAPI->>K8sAPI: 终止旧版本Pod
    K8sAPI->>Installer: 更新完成通知
    
    Note over Installer,Components: 配置推送阶段
    Components->>Components: Pilot检测配置变更
    Components->>Components: 重新加载网格配置
    Components->>Components: 推送新配置到Envoy代理
    
    Installer->>CLI: 更新完成
    CLI->>User: 显示更新结果

type ConfigMerger struct {
    strategy MergeStrategy
}

type MergeStrategy string

const (
    MergeStrategyReplace MergeStrategy = "replace"
    MergeStrategyMerge   MergeStrategy = "merge"
    MergeStrategyAppend  MergeStrategy = "append"
)

func (cm *ConfigMerger) MergeConfigs(base, overlay *IstioOperator) (*IstioOperator, error) {
    result := base.DeepCopy()
    
    // 1) 合并基础字段
    if overlay.Spec.Hub != "" {
        result.Spec.Hub = overlay.Spec.Hub
    }
    
    if overlay.Spec.Tag != nil {
        result.Spec.Tag = overlay.Spec.Tag
    }
    
    // 2) 合并MeshConfig（深度合并JSON）
    if overlay.Spec.MeshConfig != nil {
        mergedMeshConfig, err := cm.mergeJSONFields(
            result.Spec.MeshConfig, 
            overlay.Spec.MeshConfig,
        )
        if err != nil {
            return nil, fmt.Errorf("合并MeshConfig失败: %v", err)
        }
        result.Spec.MeshConfig = mergedMeshConfig
    }
    
    // 3) 合并组件配置
    if overlay.Spec.Components != nil {
        if result.Spec.Components == nil {
            result.Spec.Components = &IstioComponentSpec{}
        }
        
        if err := cm.mergeComponentSpecs(result.Spec.Components, overlay.Spec.Components); err != nil {
            return nil, fmt.Errorf("合并组件配置失败: %v", err)
        }
    }
    
    // 4) 合并Values（Helm覆盖值）
    if overlay.Spec.Values != nil {
        mergedValues, err := cm.mergeJSONFields(
            result.Spec.Values,
            overlay.Spec.Values,
        )
        if err != nil {
            return nil, fmt.Errorf("合并Values失败: %v", err)
        }
        result.Spec.Values = mergedValues
    }
    
    return result, nil
}

func (cm *ConfigMerger) mergeJSONFields(base, overlay json.RawMessage) (json.RawMessage, error) {
    var baseObj, overlayObj map[string]interface{}
    
    // 解析base配置
    if len(base) > 0 {
        if err := json.Unmarshal(base, &baseObj); err != nil {
            return nil, fmt.Errorf("解析base JSON失败: %v", err)
        }
    } else {
        baseObj = make(map[string]interface{})
    }
    
    // 解析overlay配置
    if len(overlay) > 0 {
        if err := json.Unmarshal(overlay, &overlayObj); err != nil {
            return nil, fmt.Errorf("解析overlay JSON失败: %v", err)
        }
    } else {
        overlayObj = make(map[string]interface{})
    }
    
    // 执行深度合并
    merged := cm.deepMergeMap(baseObj, overlayObj)
    
    // 序列化结果
    result, err := json.Marshal(merged)
    if err != nil {
        return nil, fmt.Errorf("序列化合并结果失败: %v", err)
    }
    
    return result, nil
}

func (cm *ConfigMerger) deepMergeMap(base, overlay map[string]interface{}) map[string]interface{} {
    result := make(map[string]interface{})
    
    // 复制base中的所有键值
    for key, value := range base {
        result[key] = value
    }
    
    // 合并overlay中的键值
    for key, overlayValue := range overlay {
        if baseValue, exists := result[key]; exists {
            // 如果两边都是map，进行递归合并
            if baseMap, baseIsMap := baseValue.(map[string]interface{}); baseIsMap {
                if overlayMap, overlayIsMap := overlayValue.(map[string]interface{}); overlayIsMap {
                    result[key] = cm.deepMergeMap(baseMap, overlayMap)
                    continue
                }
            }
            
            // 如果两边都是数组，根据策略处理
            if baseArray, baseIsArray := baseValue.([]interface{}); baseIsArray {
                if overlayArray, overlayIsArray := overlayValue.([]interface{}); overlayIsArray {
                    switch cm.strategy {
                    case MergeStrategyAppend:
                        result[key] = append(baseArray, overlayArray...)
                    case MergeStrategyReplace:
                        result[key] = overlayArray
                    default:
                        result[key] = overlayArray
                    }
                    continue
                }
            }
        }
        
        // 默认情况：直接覆盖
        result[key] = overlayValue
    }
    
    return result
}

type ComponentDependencyManager struct {
    dependencies map[ComponentName][]ComponentName
    graph        *DependencyGraph
}

type DependencyGraph struct {
    nodes    map[ComponentName]*GraphNode
    edges    map[ComponentName][]ComponentName
    inDegree map[ComponentName]int
}

type GraphNode struct {
    Name         ComponentName
    Dependencies []ComponentName
    Status       ComponentStatus
}

func (cdm *ComponentDependencyManager) GetInstallOrder(components []ComponentName) ([]ComponentName, error) {
    // 1) 构建依赖图
    graph := cdm.buildDependencyGraph(components)
    
    // 2) 执行拓扑排序
    return cdm.topologicalSort(graph)
}

func (cdm *ComponentDependencyManager) buildDependencyGraph(components []ComponentName) *DependencyGraph {
    graph := &DependencyGraph{
        nodes:    make(map[ComponentName]*GraphNode),
        edges:    make(map[ComponentName][]ComponentName),
        inDegree: make(map[ComponentName]int),
    }
    
    // 初始化所有节点
    for _, component := range components {
        graph.nodes[component] = &GraphNode{
            Name:         component,
            Dependencies: cdm.dependencies[component],
            Status:       ComponentStatusPending,
        }
        graph.inDegree[component] = 0
    }
    
    // 构建边和计算入度
    for _, component := range components {
        deps := cdm.dependencies[component]
        for _, dep := range deps {
            // 只有当依赖组件也在安装列表中时才添加边
            if _, exists := graph.nodes[dep]; exists {
                graph.edges[dep] = append(graph.edges[dep], component)
                graph.inDegree[component]++
            }
        }
    }
    
    return graph
}

func (cdm *ComponentDependencyManager) topologicalSort(graph *DependencyGraph) ([]ComponentName, error) {
    result := make([]ComponentName, 0, len(graph.nodes))
    queue := make([]ComponentName, 0)
    
    // 1) 找到所有入度为0的节点
    for component, inDegree := range graph.inDegree {
        if inDegree == 0 {
            queue = append(queue, component)
        }
    }
    
    // 2) 执行拓扑排序
    for len(queue) > 0 {
        // 取出队首元素
        current := queue[0]
        queue = queue[1:]
        result = append(result, current)
        
        // 更新所有依赖当前节点的节点
        for _, dependent := range graph.edges[current] {
            graph.inDegree[dependent]--
            if graph.inDegree[dependent] == 0 {
                queue = append(queue, dependent)
            }
        }
    }
    
    // 3) 检查是否存在循环依赖
    if len(result) != len(graph.nodes) {
        return nil, fmt.Errorf("检测到组件间的循环依赖")
    }
    
    return result, nil
}

// 预定义的组件依赖关系
func (cdm *ComponentDependencyManager) initDependencies() {
    cdm.dependencies = map[ComponentName][]ComponentName{
        ComponentNameBase: {}, // Base组件无依赖，最先安装
        
        ComponentNamePilot: {
            ComponentNameBase, // Pilot依赖Base组件
        },
        
        ComponentNameIngressGateway: {
            ComponentNameBase,  // Gateway依赖Base组件
            ComponentNamePilot, // Gateway依赖Pilot进行配置推送
        },
        
        ComponentNameEgressGateway: {
            ComponentNameBase,
            ComponentNamePilot,
        },
        
        ComponentNameCNI: {
            ComponentNameBase, // CNI依赖Base组件中的CRD
        },
        
        ComponentNameZtunnel: {
            ComponentNameBase,
            ComponentNameCNI, // Ztunnel依赖CNI进行网络配置
        },
    }
}

type IncrementalUpdater struct {
    diffCalculator *ConfigDiffCalculator
    impactAnalyzer *ImpactAnalyzer
    updateExecutor *UpdateExecutor
}

type ConfigDiff struct {
    ModifiedComponents map[ComponentName]*ComponentDiff
    AddedComponents    []ComponentName
    RemovedComponents  []ComponentName
}

type ComponentDiff struct {
    ConfigChanges  map[string]*FieldDiff
    ResourceChanges map[string]*ResourceDiff
    RequiresRestart bool
}

func (iu *IncrementalUpdater) UpdateConfig(oldConfig, newConfig *IstioOperator) error {
    // 1) 计算配置差异
    diff, err := iu.diffCalculator.CalculateDiff(oldConfig, newConfig)
    if err != nil {
        return fmt.Errorf("计算配置差异失败: %v", err)
    }
    
    // 2) 分析影响范围
    impact, err := iu.impactAnalyzer.AnalyzeImpact(diff)
    if err != nil {
        return fmt.Errorf("分析影响范围失败: %v", err)
    }
    
    // 3) 执行增量更新
    return iu.updateExecutor.ExecuteIncrementalUpdate(impact)
}

func (dc *ConfigDiffCalculator) CalculateDiff(oldConfig, newConfig *IstioOperator) (*ConfigDiff, error) {
    diff := &ConfigDiff{
        ModifiedComponents: make(map[ComponentName]*ComponentDiff),
        AddedComponents:    make([]ComponentName, 0),
        RemovedComponents:  make([]ComponentName, 0),
    }
    
    oldComponents := dc.extractComponentConfigs(oldConfig)
    newComponents := dc.extractComponentConfigs(newConfig)
    
    // 检查修改和新增的组件
    for name, newComponent := range newComponents {
        if oldComponent, exists := oldComponents[name]; exists {
            // 组件存在，检查是否有变更
            componentDiff := dc.compareComponents(oldComponent, newComponent)
            if componentDiff != nil {
                diff.ModifiedComponents[name] = componentDiff
            }
        } else {
            // 新增的组件
            diff.AddedComponents = append(diff.AddedComponents, name)
        }
    }
    
    // 检查删除的组件
    for name := range oldComponents {
        if _, exists := newComponents[name]; !exists {
            diff.RemovedComponents = append(diff.RemovedComponents, name)
        }
    }
    
    return diff, nil
}

func (ia *ImpactAnalyzer) AnalyzeImpact(diff *ConfigDiff) (*UpdateImpact, error) {
    impact := &UpdateImpact{
        ComponentsToUpdate:  make(map[ComponentName]*UpdatePlan),
        ComponentsToRestart: make([]ComponentName, 0),
        DependentComponents: make(map[ComponentName][]ComponentName),
    }
    
    // 分析每个变更组件的影响
    for componentName, componentDiff := range diff.ModifiedComponents {
        plan := &UpdatePlan{
            UpdateType:    ia.determineUpdateType(componentDiff),
            ResourceDiffs: componentDiff.ResourceChanges,
            ConfigDiffs:   componentDiff.ConfigChanges,
        }
        
        impact.ComponentsToUpdate[componentName] = plan
        
        // 检查是否需要重启
        if componentDiff.RequiresRestart {
            impact.ComponentsToRestart = append(impact.ComponentsToRestart, componentName)
        }
        
        // 分析对其他组件的影响
        dependents := ia.findDependentComponents(componentName)
        impact.DependentComponents[componentName] = dependents
    }
    
    return impact, nil
}

func (ue *UpdateExecutor) ExecuteIncrementalUpdate(impact *UpdateImpact) error {
    // 1) 按依赖顺序确定更新序列
    updateOrder, err := ue.calculateUpdateOrder(impact)
    if err != nil {
        return fmt.Errorf("计算更新顺序失败: %v", err)
    }
    
    // 2) 执行滚动更新
    for _, componentName := range updateOrder {
        plan := impact.ComponentsToUpdate[componentName]
        if plan == nil {
            continue
        }
        
        switch plan.UpdateType {
        case UpdateTypeConfigOnly:
            if err := ue.updateComponentConfig(componentName, plan); err != nil {
                return fmt.Errorf("更新组件配置失败 %s: %v", componentName, err)
            }
            
        case UpdateTypeRollingRestart:
            if err := ue.performRollingRestart(componentName, plan); err != nil {
                return fmt.Errorf("滚动重启组件失败 %s: %v", componentName, err)
            }
            
        case UpdateTypeRecreate:
            if err := ue.recreateComponent(componentName, plan); err != nil {
                return fmt.Errorf("重建组件失败 %s: %v", componentName, err)
            }
        }
    }
    
    return nil
}

# custom-profile.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: control-plane
spec:
  # 基础配置
  profile: minimal
  hub: registry.example.com/istio
  tag: 1.23.0
  
  # 网格配置
  meshConfig:
    accessLogFile: /dev/stdout
    defaultConfig:
      discoveryRefreshDelay: 10s
      proxyStatsMatcher:
        inclusionRegexps:
        - ".*outlier_detection.*"
        - ".*circuit_breakers.*"
    extensionProviders:
    - name: jaeger
      envoyOtelAls:
        service: jaeger-collector.istio-system.svc.cluster.local
        port: 4317
        
  # 组件配置
  components:
    pilot:
      k8s:
        resources:
          requests:
            cpu: 200m
            memory: 256Mi
          limits:
            cpu: 500m
            memory: 512Mi
        hpaSpec:
          minReplicas: 2
          maxReplicas: 5
          metrics:
          - type: Resource
            resource:
              name: cpu
              target:
                type: Utilization
                averageUtilization: 80
        env:
        - name: PILOT_ENABLE_WORKLOAD_ENTRY
          value: "true"
        - name: PILOT_ENABLE_AMBIENT
          value: "false"
          
    ingressGateways:
    - name: istio-ingressgateway
      enabled: true
      k8s:
        service:
          type: LoadBalancer
          loadBalancerIP: 192.168.1.100
          ports:
          - port: 80
            targetPort: 8080
            name: http2
          - port: 443
            targetPort: 8443
            name: https
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 200m
            memory: 256Mi
            
    egressGateways:
    - name: istio-egressgateway
      enabled: true
      k8s:
        resources:
          requests:
            cpu: 50m
            memory: 64Mi
          limits:
            cpu: 100m
            memory: 128Mi
            
  # Helm值覆盖
  values:
    global:
      meshID: mesh1
      multiCluster:
        clusterName: cluster1
      network: network1
    pilot:
      env:
        EXTERNAL_ISTIOD: false
        PILOT_ENABLE_CROSS_CLUSTER_WORKLOAD_ENTRY: true