to change cluster-wide <code>PodSecurityPolicy</code> to deploy Istio.</p></li><li><p><strong>Using VMs becomes easier.</strong> To add a workload to a mesh, you now just need to install one agent and the generated certificates. That agent connects back to only a single service.</p></li><li><p><strong>Maintenance becomes easier.</strong> Installing, upgrading, and removing Istio no longer require a complicated dance of version dependencies and startup orders. For example: To upgrade, you only need to start 