Istio 1.22 is now available! Click here to learn more This task shows how to ensure your workloads only communicate using mutual TLS as they are migrated to Istio. Istio automatically configures workload sidecars to use mutual TLS when calling other workloads. By default, Istio configures the destination workloads using PERMISSIVE mode. When PERMISSIVE mode is enabled, a service can accept both pl