Data models

The internal Go types that flow through istiod, and how they relate. This is the "where do I find the type" reference; for behavior, see the systems pages.

Core model types

All in pilot/pkg/model/:

Type	File	What it is
Environment	context.go	Top-level container: ServiceDiscovery, ConfigStore, MeshConfig, NetworksWatcher, …
Proxy	context.go	One xDS client: identity, IPs, labels, Sidecar scope, ConfigDump, ACK state
PushContext	push_context.go	Immutable per-push snapshot of all of istiod's state
PushRequest	push_context.go	A single push: Reason, ConfigsUpdated, Full flag
Service	service.go	A service abstraction (cross-source: kube + SE + multi-cluster)
ServiceInstance	service.go	An endpoint of a service; tied to a workload
WorkloadInstance	service.go	A workload (Pod or WE) before being attached to services
IstioEndpoint	service.go	The xDS-side endpoint structure
Sidecar / SidecarScope	sidecar.go	Per-namespace Sidecar resource and the resolved scope
Gateway	gateway.go	Internal gateway model (used by both Istio API and Gateway API)
VirtualService	virtualservice.go	Internal VS model
DestinationRule	destination_rule.go	Internal DR model
AuthorizationPolicy / AuthnPolicies	authorization.go, authentication.go	Resolved security policies
Telemetry	telemetry.go	Resolved telemetry config
Config	pkg/config/model.go	Generic CR wrapper: TypeMeta + Spec + Status
XdsResourceGenerator	xds.go	The interface every xDS type implements

Config schemas

In pkg/config/schema/:

• kind/kind.go — enum of every config kind (ServiceEntry, VirtualService, …).
• gvk/gvk.go — full GroupVersionKind constants.
• collections/collections.gen.go — generated collection of every supported kind, used as the source of truth for converters and code generation.
• resource/schema.go — the Schema type that ties a kind to its proto, validators, and converters.

The Istio API protos themselves live in istio/api and are generated into Go via the dependency.

Service registry types

In pilot/pkg/serviceregistry/:

Type	File	Role
serviceregistry.Instance	instance.go	The interface every registry implements
aggregate.Controller	aggregate/controller.go	Cross-registry aggregate
kube.Controller	kube/controller/controller.go	Kube registry
serviceentry.Controller	serviceentry/controller.go	SE registry

Networking types

In pilot/pkg/networking/:

• core/configgen.go — top-level ConfigGeneratorImpl.
• core/listener_builder.go — the per-proxy ListenerBuilder.
• core/cluster_builder.go — the per-proxy ClusterBuilder.
• util/ — shared protobuf and string helpers.

Ambient types

In pilot/pkg/serviceregistry/kube/controller/ambient/:

• Index — top-level krt-driven container.
• Workload, Service, Address, Authorization — the wDS shapes.

In pkg/workloadapi/:

• Workload (proto) — the wire shape sent to ztunnel.
• Service, Address, Authorization — siblings.

krt types

In pkg/kube/krt/:

• Collection[T] — the central observable set.
• Singleton[T] — a Collection of one.
• HandlerContext — passed to transforms; tracks dependencies.

See systems/krt for the full surface.

Security types

In security/pkg/:

• pki/util.KeyCertBundle — active root + intermediate state.
• pki/ca.IstioCA — the signer.
• pki/ra.RegistrationAuthority — cert-manager bridge.

In pkg/security/:

• Options — agent-side security configuration.
• SecretManager — the interface for fetching certs.

CRD wrapping

The Config type at pkg/config/model.go is the universal CR wrapper:

type Config struct {
    Meta            // TypeMeta + ObjectMeta
    Spec   Spec     // proto.Message
    Status Status   // proto.Message or string
}

ConfigStores and registry events deal in Config; converters in pkg/config/schema/ translate between Config and the typed CR (e.g. *v1.VirtualService).

Generated code

Several files are generated and must not be hand-edited:

• pkg/config/schema/collections/collections.gen.go — generated by pkg/config/schema/codegen/.
• pkg/config/schema/kind/kind.go — generated.
• *_test_collections.gen.go — test-only.
• *.pb.go, *_vtproto.pb.go, *_json.gen.go — proto generated.
• Helm gen-istio.yaml, gen-istio-cluster.yaml — generated by make refresh-templates in manifests/.

Run make gen to regenerate; make gen-check verifies up-to-date in CI.