use the health check requests to the <code>liveness-http</code> service are sent by Kubelet,
which does not have an Istio issued certificate. Therefore when mutual TLS is enabled,
the health check requests will fail.</p><p>Istio solves this problem by rewriting the application <code>PodSpec</code> readiness/liveness probe,
so that the probe request is sent to the <a href=/v1.9/docs/reference/commands/pilot-agent/>sidecar agent</a>.
The sidecar agent then redirects the request to the application, strips the 