  matchLabels:
          istio: ingress
</code></pre><p>You can and should write a similar policy for each service to enforce which other pods are allowed to access each.</p><h2 id=summary>Summary</h2><p>Our take is that Istio and Network Policy have different strengths in applying policy. Istio is application-protocol aware and highly flexible, making it ideal for applying policy in support of operational goals, like service routing, retries, circuit-breaking, etc, and for security that operates at the app