<p>I just started using Istio and securing service to service communication and have two questions:  </p>

<ol>
<li>When using nginx ingress, will Istio secure the data from the ingress controller to the service with TLS?</li>
<li>Is it possible to secure with TLS all the way to the pod?</li>
</ol>

<ol>
<li><p>With "Envoy" deployed as sidecar container to both i.e. (a) <strong>NGINX POD</strong> and (b) <strong>Application POD</strong>, istio will ensure that both the services communicate to each-other over TLS. </p></li>
<li><p>Infact that's the whole idea behind using Istio i.e. to secure all the communication way till the POD using ENVOY side-car. Envoy will intercept all the traffic going in/out of the POD and perform TLS communication with the peer Envoy counterpart.</p></li>
</ol>

<p>All this is done in a transparent manner i.e transparent to the application container. The responsibility to perform TLS layer jobs ex. handshake, encryption/decryption, peer discovery etc. are all offloaded to the envoy sidecar. </p>
