Istio Citadel provides each microservice with a strong, cryptographic, identity in the form of a certificate. The certificates' life cycle is fully managed by Istio.

Istio provides microservices with mutually authenticated connections, without requiring app code changes.

When Envoy retries a failed request, the endpoint that caused the retry is no longer in the load balancing pool.

After Istio is installed on a Kubernetes cluster, any workloads deployed to service mesh are automatically accompanied with sidecars.