Systems

Internal subsystems that span multiple binaries or that are large enough to deserve their own page. Where an application is "the thing you deploy", a system here is "the architectural component". A few of these live almost entirely inside istiod, but cut across so much of the codebase they merit their own page.

System	What it is	Where it lives
xDS server	The gRPC ADS endpoint, push pipeline, generators, cache	pilot/pkg/xds/
Service discovery	The aggregate of all sources of services and endpoints	pilot/pkg/serviceregistry/, pilot/pkg/config/
Networking core	Translation from PushContext into Envoy listeners/clusters/routes/secrets	pilot/pkg/networking/core/
Security CA	Citadel: workload CSR signing, root cert rotation, RA bridges	security/pkg/pki/, security/pkg/server/ca/
Sidecar injection	The mutating webhook that adds istio-proxy to pods	pkg/kube/inject/
Ambient mesh	The Istiod side of Ambient: workload API, ambient registry, waypoint config	pilot/pkg/serviceregistry/ambient/, pkg/workloadapi/, networking core's waypoint files
krt	The home-grown declarative controller framework	pkg/kube/krt/
Mesh config	How MeshConfig, ProxyConfig, and the istio ConfigMap come together	pkg/config/mesh/, pilot/pkg/features/

These pages are independent — read them in any order based on the symptom you're investigating. Read xds first if you want one entry point that covers the most of istiod.