answer><p><p>When <code>STRICT</code> mutual TLS is enabled, non-Istio workloads cannot communicate to Istio services, as they will not have a valid Istio client certificate.</p><p>If you need to allow these clients, the mutual TLS mode can be configured to <code>PERMISSIVE</code>, allowing both plaintext and mutual TLS.
This can be done for individual workloads or the entire mesh.</p><p>See <a href=/v1.16/docs/tasks/security/authentication/authn-policy>Authentication Policy</a> for more details.</p></p></d