title: What are the benefits of enabling mTLS in Istio?
body: <p>I try to understand why <a href="https://istio.io" rel="nofollow noreferrer">Istio</a> have the mTLS feature? It enables mutual TLS authentication between all the services in a cluster via automatically issued certificates.</p>
  
  <p>Mandatory TLS authentication is a benefit only as long as they are services outside Istio, but when Istio is enabled globally in Kubernetes, this is not the case - then every service gets certificate automatically, so can connect to any other.</p>
  
  <p>Maybe TLS is used as identity provider, required by Istio authorization rules, like asked in yet unanswered <a href="https://stackoverflow.com/questions/55071965/does-istio-authorization-have-effect-if-mtls-is-not-used-for-istio-authenticatio">Does istio authorization have effect if mtls is not used for istio authentication?</a>? But why Istio does not just use Kubernetes service accounts as identity provider. This is even mentioned in <a href="https://istio.io/docs/concepts/security/#istio-identity" rel="nofollow noreferrer">documentation</a>.</p>
  
  <p>Also, even with TLS for identity, why encrypting traffic (TLS can be used without encryption)? I am assuming here that the container is not able to spoof IP address.</p>