oy</a> and the server side Envoy. End-to-end communication is secured by:</p><ul><li><p>Local TCP connections between the service and Envoy</p></li><li><p>Mutual TLS connections between proxies</p></li><li><p>Secure Naming: during the handshake process, the client side Envoy checks that the service account provided by the server side certificate is allowed to run the target service</p></li></ul><h3 id="key-management">Key management</h3><p>Istio v0.2 supports services running on both Kubernetes pods and VM/