<p>I have istio set up with mtls globally enabled. I have verifed it by bashing into a pot without an envoy sidecar, and running a curl command on http, which failed. Then run a curl on HTTPS using the Istio certs, which worked.</p>

<p>When I port-forward to a service, eq <code>kubectl port-forward svc/my-svc 8080:80</code> I am able to access my app by going to <code>http://localhost:8080</code>
I would expect that this wouldn't work, since mtls is being enforced. 
How does this port-forward with kubernetes work? Does it go directly to the node, thereby by-passing the sidecar?</p>

<p>I found out that <strong>Istio</strong> is working in parallel with standard Kubernetes network services and does not affect traffic in case of <code>port-forwarding</code>.</p>

<p><strong>Istio</strong> network service will create iptables rule exactly the same as <code>kubectl port-forward</code> or any other standard command do.</p>

<p>Unfortunately, I did not find any official documentation with an explanation of how it works.</p>
