 other services that do not use HTTP can be secured. Network Policy isn’t limited to a classic firewall’s tuple of IP addresses, proto, and ports. Both Istio and Network Policy are aware of rich Kubernetes labels to describe pod endpoints.</p><h2 id=implementation>Implementation</h2><p>The Istio’s proxy is based on <a href=https://envoyproxy.github.io/envoy/>Envoy</a>, which is implemented as a user space daemon in the data plane that
interacts with the network layer using standard sockets. This gives