Pod-to-Pod Encryption with Cilium and Istio

Every curl between pods in your cluster travels in plaintext. The Kubernetes networking model requires that every pod can reach every other pod without NAT. CNI plugins implement this by building overlay networks or configuring native routing. None of them encrypt traffic by default.

That design assumes the underlying network is trusted. In practice, the assumption breaks when it matters most: