Not all traffic in your pods should go through the Istio sidecar. Some protocols don't work well with Envoy's Layer 7 processing, some services handle their own TLS, and some legacy systems just break ...