<p>I am new in istio therefore might be nonsense question but I would like to understand the best approach.. I have these namespaces as below in k8s.. So currently the microservice running in hub-dev can able to access PostgreSQL where the istio is disabled for database namespace.</p>
<ol>
<li>How could it be possible in <code>STRICT</code> mode or did I do something wrong or analyse a wrong way? So it means pod in mesh can talk with another pod which is not meshed, but the other pod can not talk any other pod which is meshed ?</li>
</ol>
<p>as you can see here, seems my application can talk with database</p>
<pre><code>[2021-01-15T15:21:38.601Z] &quot;GET /userinfo?t=1610724097377 HTTP/1.1&quot; 200 - &quot;-&quot; 0 236 5 3 &quot;95.0.145.40,10.6.0.24&quot; &quot;Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36&quot; &quot;34130335-b0dd-4cca-b157-f612e3767c9c&quot; &quot;oneapihub-auth-dev&quot; &quot;127.0.0.1:50002&quot; inbound|80|| 127.0.0.1:51230 10.6.19.251:50002 10.6.0.24:0 outbound_.80_._.oneapihub-auth-dev.hub-dev.svc.cluster.local default
[2021-01-15T15:21:38.608Z] &quot;- - -&quot; 0 - &quot;-&quot; 374 778 10012 - &quot;-&quot; &quot;-&quot; &quot;-&quot; &quot;-&quot; &quot;10.6.5.95:64000&quot; outbound|64000||my-postgres-postgresql-helm.database.svc.cluster.local 10.6.19.251:50024 10.254.134.161:64000 10.6.19.251:47396 - -
</code></pre>
<p>I have some monolith service running <code>analytics</code>  namespace where these services needs to connect <code>logging</code> and <code>monitoring</code> likewise the microservices running in hub-dev .. So if I enabled Istio for <code>logging</code> and <code>monitoring</code>, the services running in analytics namespace could not able to access the services running in <code>logging</code> and <code>monitoring</code> , am I right? so should ı create another ELK or prometheus instances ?</p>
<p>So what is the best approach to manage this flow ?</p>
<pre><code>$ kubectl get ns --show-labels
NAME              STATUS   AGE     LABELS

database          Active   319d    name=database
analytics         Actice.  20d.    name=analytics      
hub-dev           Active   46h     istio-injection=enabled
istio-system      Active   2d8h    istio-injection=disabled
logging           Active   133d    purpose=logging
monitoring        Active   291d    name=monitoring,namespace=monitoring
</code></pre>
<p>And here is peerauthentication</p>
<pre><code>$ kubectl get peerauthentication -n istio-system -o yaml
apiVersion: v1
items:
- apiVersion: security.istio.io/v1beta1
  kind: PeerAuthentication
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {&quot;apiVersion&quot;:&quot;security.istio.io/v1beta1&quot;,&quot;kind&quot;:&quot;PeerAuthentication&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;name&quot;:&quot;default&quot;,&quot;namespace&quot;:&quot;istio-system&quot;},&quot;spec&quot;:{&quot;mtls&quot;:{&quot;mode&quot;:&quot;STRICT&quot;}}}
    name: default
    namespace: istio-system
  spec:
    mtls:
      mode: STRICT
</code></pre>

<p>You are correct in both cases:</p>
<ol>
<li>A service that is outside of the mesh, can't talk to a service within the mesh, when strict mode is enabled, but vice-versa is possible.</li>
<li>If <code>logging</code> and <code>monitoring</code> get into the mesh, indeed, <code>analytics</code> can't communicate with it, when <code>STRICT</code> mode is enabled.</li>
</ol>
