Istio服务网格架构深度剖析：控制平面与数据平面的协同设计

graph TB
    subgraph "Istio 服务网格整体架构"
        subgraph "控制平面 (Control Plane)"
            subgraph "Istiod"
                pilot[Pilot<br/>配置管理]
                citadel[Citadel<br/>证书管理]
                galley[Galley<br/>配置验证]
            end
            operator[Operator<br/>生命周期管理]
        end
        
        subgraph "数据平面 (Data Plane)"
            subgraph "Pod 1"
                app1[应用容器]
                envoy1[Envoy Sidecar]
            end
            subgraph "Pod 2"
                app2[应用容器]
                envoy2[Envoy Sidecar]
            end
            subgraph "Gateway"
                igw[Ingress Gateway]
                egw[Egress Gateway]
            end
        end
        
        subgraph "配置资源"
            vs[VirtualService]
            dr[DestinationRule]
            gw[Gateway]
            se[ServiceEntry]
            pa[PeerAuthentication]
            ap[AuthorizationPolicy]
        end
        
        subgraph "Kubernetes API Server"
            k8s[Kubernetes<br/>API Server]
            crd[CRD<br/>自定义资源]
        end
        
        subgraph "管理工具"
            istioctl[istioctl CLI]
            ui[Kiali UI]
        end
        
        %% 连接关系
        pilot --> envoy1
        pilot --> envoy2
        pilot --> igw
        pilot --> egw
        
        citadel --> envoy1
        citadel --> envoy2
        
        pilot -.->|watch| k8s
        pilot -.->|read config| vs
        pilot -.->|read config| dr
        pilot -.->|read config| gw
        pilot -.->|read config| se
        pilot -.->|read config| pa
        pilot -.->|read config| ap
        
        k8s --> crd
        
        operator -.->|manage| pilot
        operator -.->|manage| citadel
        operator -.->|manage| galley
        
        istioctl -.->|configure| k8s
        ui -.->|visualize| pilot
        
        app1 <--> envoy1
        app2 <--> envoy2
        envoy1 <--> envoy2
        envoy1 <--> igw
        envoy2 <--> egw
    end
    
    style pilot fill:#e1f5fe
    style citadel fill:#f3e5f5
    style galley fill:#e8f5e8
    style operator fill:#fff3e0
    style envoy1 fill:#ffebee
    style envoy2 fill:#ffebee
    style igw fill:#e0f2f1
    style egw fill:#e0f2f1

graph TB
    subgraph "Istiod 内部架构"
        subgraph "配置管理 (Configuration Management)"
            watcher[Config Watcher<br/>配置监听器]
            validator[Config Validator<br/>配置验证器]
            store[Config Store<br/>配置存储]
        end
        
        subgraph "服务发现 (Service Discovery)"
            sd[Service Discovery<br/>服务发现]
            ep[Endpoint Controller<br/>端点控制器]
            se_ctrl[ServiceEntry Controller<br/>外部服务控制器]
        end
        
        subgraph "XDS服务 (XDS Server)"
            ads[ADS Server<br/>聚合发现服务]
            cds[CDS Server<br/>集群发现服务]
            lds[LDS Server<br/>监听器发现服务]
            rds[RDS Server<br/>路由发现服务]
            eds[EDS Server<br/>端点发现服务]
            sds[SDS Server<br/>密钥发现服务]
        end
        
        subgraph "证书管理 (Certificate Management)"
            ca[Certificate Authority<br/>证书签发]
            ca_server[CA Server<br/>证书服务器]
            cert_watcher[Cert Watcher<br/>证书监听器]
        end
        
        subgraph "网络策略 (Network Policy)"
            authn[Authentication<br/>认证策略]
            authz[Authorization<br/>授权策略]
            policy[Policy Engine<br/>策略引擎]
        end
        
        %% 数据流
        watcher -->|配置变更| store
        store -->|配置推送| ads
        
        sd -->|服务信息| eds
        ep -->|端点变更| eds
        se_ctrl -->|外部服务| eds
        
        ca -->|证书分发| sds
        cert_watcher -->|证书更新| ca_server
        
        authn -->|认证配置| ads
        authz -->|授权配置| ads
        policy -->|策略配置| ads
        
        ads -->|推送配置| cds
        ads -->|推送配置| lds
        ads -->|推送配置| rds
        ads -->|推送配置| eds
        ads -->|推送配置| sds
    end
    
    style watcher fill:#e1f5fe
    style ads fill:#f3e5f5
    style ca fill:#e8f5e8
    style policy fill:#fff3e0

sequenceDiagram
    participant K8s as Kubernetes API
    participant Watcher as Config Watcher
    participant Validator as Config Validator
    participant Store as Config Store
    participant XDS as XDS Server
    participant Envoy as Envoy Proxy
    
    Note over K8s,Envoy: 配置更新流程
    
    K8s->>Watcher: 1. 配置资源变更事件
    Watcher->>Validator: 2. 验证配置语法
    
    alt 配置验证失败
        Validator->>K8s: 3a. 更新资源状态(Invalid)
    else 配置验证成功
        Validator->>Store: 3b. 存储有效配置
        Store->>XDS: 4. 触发配置推送
        XDS->>XDS: 5. 生成Envoy配置
        XDS->>Envoy: 6. 推送配置(gRPC/ADS)
        Envoy->>XDS: 7. 确认配置接收(ACK/NACK)
        
        alt 配置应用成功
            XDS->>K8s: 8a. 更新分发状态(Applied)
        else 配置应用失败
            XDS->>K8s: 8b. 更新分发状态(Failed)
        end
    end

graph TB
    subgraph "Pod 内部架构"
        subgraph "应用容器 (App Container)"
            app[应用程序<br/>业务逻辑]
            port_app[应用端口<br/>如:8080]
        end
        
        subgraph "Envoy Sidecar容器"
            subgraph "监听器 (Listeners)"
                inbound[Inbound Listener<br/>入站流量]
                outbound[Outbound Listener<br/>出站流量]
            end
            
            subgraph "过滤器链 (Filter Chains)"
                http_filter[HTTP过滤器]
                tcp_filter[TCP过滤器]
                authz_filter[授权过滤器]
                authn_filter[认证过滤器]
                rate_limit[限流过滤器]
                metrics[指标过滤器]
            end
            
            subgraph "集群管理 (Clusters)"
                cluster1[Cluster 1]
                cluster2[Cluster 2]
                lb[负载均衡器]
                hc[健康检查]
            end
            
            subgraph "配置管理 (Configuration)"
                xds_client[XDS客户端]
                config_cache[配置缓存]
            end
        end
        
        subgraph "iptables规则"
            nat_pre[PREROUTING<br/>入站重定向]
            nat_out[OUTPUT<br/>出站重定向]
        end
    end
    
    subgraph "Istiod控制平面"
        xds_server[XDS服务器]
    end
    
    subgraph "其他服务"
        svc1[Service 1]
        svc2[Service 2]
        ext[外部服务]
    end
    
    %% 流量路径
    svc1 -.->|入站流量| nat_pre
    nat_pre -->|重定向:15006| inbound
    inbound -->|过滤处理| http_filter
    http_filter -->|转发| port_app
    port_app -->|响应| inbound
    
    app -->|出站请求| nat_out
    nat_out -->|重定向:15001| outbound
    outbound -->|选择集群| cluster1
    cluster1 -->|负载均衡| lb
    lb -.->|转发| svc2
    
    %% 配置同步
    xds_server -.->|配置推送| xds_client
    xds_client -->|更新配置| config_cache
    config_cache -->|应用配置| inbound
    config_cache -->|应用配置| outbound
    
    style inbound fill:#e1f5fe
    style outbound fill:#e1f5fe
    style xds_client fill:#f3e5f5
    style lb fill:#e8f5e8

# istio-init容器执行的关键脚本
/usr/local/bin/istio-iptables.sh \
  -p 15001 \         # Envoy出站流量端口
  -z 15006 \         # Envoy入站流量端口  
  -u 1337 \          # Envoy用户ID
  -m REDIRECT \      # 流量重定向模式
  -i '*' \           # 拦截所有入站接口
  -x "" \            # 排除的CIDR范围
  -b '*' \           # 拦截所有入站端口
  -d 15090,15021,15020  # 排除的出站端口

# === NAT表 PREROUTING链 - 处理入站流量 ===
# 将所有入站TCP流量重定向到15006端口（Envoy入站监听器）
-A PREROUTING -p tcp -j REDIRECT --to-ports 15006

# === NAT表 OUTPUT链 - 处理出站流量 ===
# 排除Envoy进程的出站流量（避免死循环）
-A OUTPUT -m owner --uid-owner 1337 -j RETURN

# 排除回环地址流量
-A OUTPUT -d 127.0.0.0/8 -j RETURN

# 排除Istio控制平面端口
-A OUTPUT -p tcp --dport 15090 -j RETURN  # Envoy admin
-A OUTPUT -p tcp --dport 15021 -j RETURN  # 健康检查
-A OUTPUT -p tcp --dport 15020 -j RETURN  # 合并指标

# 将应用出站流量重定向到15001端口（Envoy出站监听器）
-A OUTPUT -p tcp -j REDIRECT --to-ports 15001

应用发起请求 
    ↓
iptables规则拦截(OUTPUT链)
    ↓  
Envoy出站监听器(0.0.0.0:15001)
    ↓
负载均衡算法选择端点
    ↓
建立到目标Pod的mTLS连接  
    ↓
目标Pod iptables拦截(PREROUTING链)
    ↓
Envoy入站监听器(0.0.0.0:15006)
    ↓
应用安全策略和路由规则
    ↓
转发到目标应用容器

// pilot/pkg/networking/core/v1alpha3/listener.go
func (configgen *ConfigGeneratorImpl) buildSidecarOutboundListeners(
    node *model.Proxy, push *model.PushContext) []*listener.Listener {
    
    var listeners []*listener.Listener
    
    // 创建虚拟出站监听器(0.0.0.0:15001) 
    virtualOutboundListener := &listener.Listener{
        Name: VirtualOutboundListenerName,
        Address: util.BuildAddress("0.0.0.0", uint32(15001)),
        FilterChains: configgen.buildVirtualOutboundFilterChains(node, push),
        ListenerFilters: buildListenerFilters(),  // 包含original_dst过滤器
        UseOriginalDst: proto.BoolTrue,           // 启用原始目标地址检测
        TrafficDirection: core.TrafficDirection_OUTBOUND,
    }
    
    listeners = append(listeners, virtualOutboundListener)
    return listeners
}

// pilot/pkg/networking/core/v1alpha3/listener.go  
func (configgen *ConfigGeneratorImpl) buildSidecarInboundListeners(
    node *model.Proxy, push *model.PushContext) []*listener.Listener {
    
    var listeners []*listener.Listener
    
    // 创建虚拟入站监听器(0.0.0.0:15006)
    virtualInboundListener := &listener.Listener{
        Name: VirtualInboundListenerName, 
        Address: util.BuildAddress("0.0.0.0", uint32(15006)),
        FilterChains: configgen.buildVirtualInboundFilterChains(node, push),
        ListenerFilters: buildListenerFilters(),
        UseOriginalDst: proto.BoolTrue,
        TrafficDirection: core.TrafficDirection_INBOUND,
    }
    
    listeners = append(listeners, virtualInboundListener)
    return listeners
}

sequenceDiagram
    participant App1 as 应用A
    participant Envoy1 as Envoy A
    participant Envoy2 as Envoy B
    participant App2 as 应用B
    participant Istiod as Istiod
    
    Note over App1,App2: 服务A调用服务B的完整流程
    
    App1->>Envoy1: 1. 发起HTTP请求到Service B
    Note over Envoy1: 2. iptables拦截出站流量
    
    Envoy1->>Istiod: 3. 查询Service B的端点信息
    Istiod->>Envoy1: 4. 返回端点列表和路由规则
    
    Envoy1->>Envoy1: 5. 应用流量策略<br/>(负载均衡、重试、超时)
    Envoy1->>Envoy1: 6. 应用安全策略<br/>(mTLS、认证、授权)
    
    Envoy1->>Envoy2: 7. 建立mTLS连接
    Envoy1->>Envoy2: 8. 转发请求
    
    Note over Envoy2: 9. iptables拦截入站流量
    Envoy2->>Envoy2: 10. 应用入站安全策略
    Envoy2->>App2: 11. 转发请求到应用
    
    App2->>Envoy2: 12. 返回响应
    Envoy2->>Envoy2: 13. 应用响应策略
    Envoy2->>Envoy1: 14. 返回响应
    
    Envoy1->>Envoy1: 15. 记录指标和链路追踪
    Envoy1->>App1: 16. 返回最终响应

sequenceDiagram
    participant Envoy as Envoy
    participant ADS as ADS Stream
    participant XDS as DiscoveryServer
    
    Envoy->>ADS: 1. StreamAggregatedResources 开流
    Envoy->>ADS: 2. DiscoveryRequest(TypeUrl=CDS, nonce="")
    ADS->>XDS: 3. processRequest(CDS)
    XDS->>XDS: 4. Generate(CDS) → Version=v1, Nonce=n1
    XDS-->>Envoy: 5. DiscoveryResponse(CDS, v1, n1)
    Envoy-->>XDS: 6. ACK(CDS, version=v1, response_nonce=n1)
    
    Envoy->>ADS: 7. DiscoveryRequest(TypeUrl=EDS, ResourceNames=[c1,c2])
    ADS->>XDS: 8. processRequest(EDS)
    XDS->>XDS: 9. Generate(EDS[c1,c2]) → Version=v2, Nonce=n2
    XDS-->>Envoy: 10. DiscoveryResponse(EDS, v2, n2)
    Envoy-->>XDS: 11. NACK(EDS, response_nonce=n2, error=detail)
    XDS->>XDS: 12. onNack 记录错误，不立即重推
    
    Note over XDS: 等待后续配置修复或新的触发

sequenceDiagram
    participant K8s as Kubernetes API
    participant EP as EndpointSlice Controller
    participant Reg as Aggregate Registry
    participant XDS as DiscoveryServer
    participant Envoy as Envoy
    
    K8s->>EP: 1. EndpointSlice 事件(ADD/UPDATE/DELETE)
    EP->>Reg: 2. 转换端点，更新服务端点表
    Reg->>XDS: 3. 触发EDS更新 ConfigUpdate
    XDS->>XDS: 4. debounce 合并
    XDS->>XDS: 5. 计算受影响的集群与代理
    XDS->>Envoy: 6. EDS推送(ClusterLoadAssignment)
    Envoy->>Envoy: 7. 更新LB端点与健康状态

// Envoy过滤器链架构示例
type FilterChain struct {
    // HTTP连接管理器过滤器
    HttpConnectionManager *http_connection_manager.HttpConnectionManager
    
    // 自定义过滤器链
    CustomFilters []HttpFilter
    
    // 路由配置
    RouteConfig *route.RouteConfiguration
}

// 过滤器接口定义
type HttpFilter interface {
    // 处理请求头
    OnRequestHeaders(headers HeaderMap) FilterHeadersStatus
    
    // 处理请求体
    OnRequestData(data Buffer) FilterDataStatus
    
    // 处理响应头
    OnResponseHeaders(headers HeaderMap) FilterHeadersStatus
    
    // 处理响应体
    OnResponseData(data Buffer) FilterDataStatus
}

// Envoy监听器核心实现逻辑（C++伪代码展示概念）
class ListenerManager {
    // 监听器配置映射
    std::map<std::string, ListenerImpl*> listeners_;
    
    // 动态添加监听器
    void addListener(const envoy::config::listener::v3::Listener& config) {
        auto listener = std::make_unique<ListenerImpl>(config);
        listener->initialize();
        listeners_[config.name()] = std::move(listener);
    }
    
    // 热重载监听器配置
    void updateListener(const std::string& name, 
                       const envoy::config::listener::v3::Listener& config) {
        if (auto it = listeners_.find(name); it != listeners_.end()) {
            it->second->drain();                    // 优雅排空现有连接
            auto new_listener = std::make_unique<ListenerImpl>(config);
            new_listener->initialize();
            listeners_[name] = std::move(new_listener);
        }
    }
}

// 集群管理器实现
class ClusterManager {
    // 集群配置缓存
    std::map<std::string, ClusterImpl*> clusters_;
    
    // 健康检查管理器
    HealthCheckerManager health_checker_manager_;
    
    // 负载均衡器工厂
    LoadBalancerFactory lb_factory_;
    
    // 动态更新集群配置
    void updateCluster(const envoy::config::cluster::v3::Cluster& config) {
        auto cluster = clusters_[config.name()];
        
        // 更新端点配置
        cluster->updateEndpoints(config.load_assignment());
        
        // 更新负载均衡策略
        auto lb = lb_factory_.create(config.lb_policy());
        cluster->setLoadBalancer(std::move(lb));
        
        // 更新健康检查配置
        if (config.has_health_checks()) {
            health_checker_manager_.updateHealthChecker(config.name(), config.health_checks());
        }
    }
}

# 基于生产环境经验的DestinationRule配置
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: productpage-destination
spec:
  host: productpage
  trafficPolicy:
    # 负载均衡策略 - 根据服务特性选择
    loadBalancer:
      simple: LEAST_CONN          # 适用于长连接服务的策略
      # consistentHash:            # 会话保持场景
      #   httpHeaderName: "user-id"
    
    # 连接池配置 - 防止资源耗尽
    connectionPool:
      tcp:
        maxConnections: 100        # 最大连接数
        connectTimeout: 30s        # 连接超时
        keepAlive:
          time: 7200s             # TCP keepalive
          interval: 75s           # keepalive间隔
      http:
        http1MaxPendingRequests: 100   # HTTP/1.1排队请求
        http2MaxRequests: 1000         # HTTP/2并发请求
        maxRequestsPerConnection: 2    # 连接最大请求数
        maxRetries: 3                  # 最大重试次数
        idleTimeout: 60s               # 空闲超时
        h2UpgradePolicy: UPGRADE       # HTTP/2升级策略
    
    # 熔断配置 - 故障隔离
    outlierDetection:
      consecutiveGatewayErrors: 5      # 连续网关错误
      consecutive5xxErrors: 5          # 连续5xx错误
      interval: 30s                    # 检测间隔
      baseEjectionTime: 30s           # 基础驱逐时间
      maxEjectionPercent: 50          # 最大驱逐百分比
      minHealthPercent: 50            # 最小健康百分比

# 生产级VirtualService重试配置
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews-retry-policy
spec:
  hosts:
  - reviews
  http:
  - match:
    - uri:
        prefix: "/api/"
    route:
    - destination:
        host: reviews
        subset: v1
    # 智能重试配置
    retries:
      attempts: 3                      # 重试次数
      perTryTimeout: 5s               # 单次重试超时
      retryOn: 5xx,gateway-error,connect-failure,refused-stream  # 重试条件
      retryRemoteLocalities: true     # 跨区域重试
    # 超时配置
    timeout: 15s                      # 总体超时
    # 故障注入（仅测试环境）
    fault:
      delay:
        percentage:
          value: 0.001                # 0.1%延迟注入
        fixedDelay: 100ms

graph TB
    subgraph "Istio安全架构"
        subgraph "身份认证 (Identity)"
            spiffe[SPIFFE身份标准]
            cert[X.509证书]
            jwt[JWT Token]
        end
        
        subgraph "认证 (Authentication)"
            peer_auth[PeerAuthentication<br/>服务间认证]
            req_auth[RequestAuthentication<br/>终端用户认证]
            mtls[双向TLS]
        end
        
        subgraph "授权 (Authorization)"
            authz_policy[AuthorizationPolicy]
            rbac[基于角色的访问控制]
            custom_action[自定义授权动作]
        end
        
        subgraph "证书管理 (Certificate Management)"
            citadel[Citadel CA]
            auto_rotate[自动轮换]
            trust_domain[信任域]
        end
    end
    
    %% 关系连接
    spiffe --> cert
    cert --> mtls
    citadel --> cert
    peer_auth --> mtls
    req_auth --> jwt
    authz_policy --> rbac
    
    style spiffe fill:#e1f5fe
    style mtls fill:#f3e5f5
    style authz_policy fill:#e8f5e8

graph TB
    subgraph "多集群Istio架构"
        subgraph "主集群 (Primary Cluster)"
            istiod1[Istiod Primary]
            mesh1[服务网格]
            eastwest1[东西向网关]
        end
        
        subgraph "远程集群 (Remote Cluster)"
            istiod2[Istiod Remote]
            mesh2[服务网格]
            eastwest2[东西向网关]
        end
        
        subgraph "跨集群发现"
            endpoint_slice[端点发现]
            service_export[服务导出]
            network_endpoint[网络端点]
        end
    end
    
    %% 连接关系
    istiod1 <-.->|配置同步| istiod2
    eastwest1 <-.->|跨集群流量| eastwest2
    mesh1 -.->|服务发现| endpoint_slice
    mesh2 -.->|服务发现| endpoint_slice
    
    style istiod1 fill:#e1f5fe
    style eastwest1 fill:#f3e5f5
    style endpoint_slice fill:#e8f5e8

// 接收配置更新事件 → 入队去抖动
// 功能：将配置变更封装为 PushRequest，进入推送流程
func (s *DiscoveryServer) ConfigUpdate(req *model.PushRequest) {
    // 统计与断言（省略）
    s.pushChannel <- req // 进入去抖动通道
}

// 去抖动与合并 → 回调 Push
// 功能：合并高频配置事件，按时间窗口触发一次推送
func debounce(ch chan *model.PushRequest, stop <-chan struct{},
    opts DebounceOptions, pushFn func(*model.PushRequest)) {
    var merged *model.PushRequest
    var timer <-chan time.Time
    for {
        select {
        case r := <-ch:
            if merged == nil { merged = r } else { merged = merged.Merge(r) }
            if timer == nil { timer = time.After(opts.debounceAfter) }
        case <-timer:
            if merged != nil { pushFn(merged); merged, timer = nil, nil }
        case <-stop:
            return
        }
    }
}

// 按订阅与类型生成并发送 xDS 资源
// 功能：选择生成器、生成资源、封装 DiscoveryResponse 并发送
func (s *DiscoveryServer) pushXds(con *Connection, w *model.WatchedResource,
    req *model.PushRequest) error {
    if w == nil { return nil }
    gen := s.findGenerator(w.TypeUrl, con)
    if gen == nil { return nil }
    resources, _, err := gen.Generate(con.proxy, w, req)
    if err != nil || resources == nil { return err }
    resp := &discovery.DiscoveryResponse{ TypeUrl: w.TypeUrl, Resources: xds.ResourcesToAny(resources) }
    return xds.Send(con, resp)
}

// ADS 双向流入口
// 功能：处理首订/订阅变更、ACK/NACK，并按需推送
func (s *DiscoveryServer) StreamAggregatedResources(stream discovery.AggregatedDiscoveryService_StreamAggregatedResourcesServer) error {
    con := newConnection(/* 省略鉴权与元数据 */)
    for {
        req, err := stream.Recv()
        if err != nil { return err }
        if req.ErrorDetail != nil && req.ResponseNonce != "" { s.onNack(con, req.TypeUrl, req.ResponseNonce, req.ErrorDetail); continue }
        if req.ResponseNonce != "" { s.onAck(con, req.TypeUrl, req.VersionInfo, req.ResponseNonce); continue }
        con.UpdateWatched(req.TypeUrl, &model.WatchedResource{ TypeUrl: req.TypeUrl, ResourceNames: req.ResourceNames })
        _ = s.pushXds(con, con.Watched(req.TypeUrl), &model.PushRequest{ Full: false, Push: s.currentPushContext() })
    }
}

sequenceDiagram
    participant Store as Config Store
    participant XDS as DiscoveryServer
    participant Deb as debounce()
    participant Conn as Connection
    participant Envoy as Envoy

    Store->>XDS: ConfigUpdate(pushReq)
    XDS->>Deb: pushChannel <- req
    Deb-->>XDS: Push(reqMerged)
    XDS->>Conn: enqueue connections
    loop per-connection
        XDS->>XDS: findGenerator(TypeUrl)
        XDS->>Envoy: pushXds → Send(DiscoveryResponse)
        Envoy-->>XDS: ACK/NACK(version, nonce)
    end

sequenceDiagram
    participant Envoy as Envoy
    participant ADS as ADS Stream
    participant XDS as DiscoveryServer

    Envoy->>ADS: StreamAggregatedResources 开流
    Envoy->>ADS: DiscoveryRequest(TypeUrl, names, nonce="")
    ADS->>XDS: UpdateWatched / 首次订阅
    XDS-->>Envoy: DiscoveryResponse(version, nonce)
    Envoy-->>XDS: ACK(version, response_nonce)
    Envoy->>ADS: DiscoveryRequest(变更/错误)
    alt NACK
        Envoy-->>XDS: NACK(response_nonce, error)
        XDS->>XDS: 记录错误（不立即重推）
    end

classDiagram
    class Server {
      +XDSServer *DiscoveryServer
      +environment *model.Environment
      +grpcServer *grpc.Server
      +initControllers()
      +Start(stop)
    }
    class DiscoveryServer {
      +Env *model.Environment
      +Generators map[string]XdsResourceGenerator
      +pushChannel chan *PushRequest
      +pushQueue *PushQueue
      +ConfigUpdate(req)
      +Start(stop)
      +pushXds(con, w, req)
      +StreamAggregatedResources(stream)
    }
    class Connection {
      +proxy *model.Proxy
      +WatchedResources map[string]*WatchedResource
      +UpdateWatched()
      +Watched(typeUrl)
    }
    class PushRequest {
      +Full bool
      +ConfigsUpdated ConfigKeySet
      +Push *PushContext
      +Merge(other)
    }
    class PushContext {
      +Mesh *MeshConfig
      +ServiceIndex *ServiceIndex
      +VirtualServiceIndex *VirtualServiceIndex
    }
    class WatchedResource {
      +TypeUrl string
      +ResourceNames []string
    }
    class ConfigGeneratorImpl {
      +BuildListeners(proxy, push)
      +BuildClusters(proxy, push)
      +BuildHTTPRoutes(proxy, push, names)
    }

    Server --> DiscoveryServer : composition
    DiscoveryServer --> Connection : manages
    DiscoveryServer --> PushRequest : uses
    PushRequest --> PushContext : has
    Connection --> WatchedResource : has
    DiscoveryServer ..> ConfigGeneratorImpl : generates via Env