licy regardless of the layer 7 protocol: DNS, SQL databases, real-time streaming, and a plethora of other services that do not use HTTP can be secured. Network Policy isn’t limited to a classic firewall’s tuple of IP addresses, proto, and ports. Both Istio and Network Policy are aware of rich Kubernetes labels to describe pod endpoints.</p><h2 id=implementation>Implementation</h2><p>Istio’s proxy is based on <span class=term data-title=Envoy data-body='<p>The high-performance proxy that Istio uses to 