 modification, since the kubelet does not have Istio-issued certificates.</p><p>There are several options:</p><ol><li><p>Using probe rewrite to redirect liveness and readiness requests to the
workload directly. Please refer to <a href=/v1.16/docs/ops/configuration/mesh/app-health-check/#probe-rewrite>Probe Rewrite</a>
for more information. This is enabled by default and recommended.</p></li><li><p>Using a separate port for health checks and enabling mutual TLS only on the regular service port. Please refer 