ginates HTTP/TLS connection towards the final destination.
Puts destination’s hostname into the SNI header. This TLS session is not
decrypted inside the mesh. Only SNI header is inspected (as it is in cleartext).</p></li><li><p>Sidecar proxy</p><p>Sidecar intercepts traffic to matching hostnames in the SNI header from the application originated TLS sessions.
Based on the VirtualService, the traffic is routed to the egress gateway while wrapping original traffic into
Istio mTLS as well. Outer TLS session h