istio mTLS causes issue

[aviramha]

Mirantis Kubernetes Engine k8s 1.24
istio mesh with istio-cni

Health checks are received well and plain text by mirrord, but it also receives some TLS traffic that looks destined to the mTLS/istio (i.e before TLS termination)

[linear]

MBE-479 istio mTLS causes issue

[aviramha]

reproduced using this istio installation config:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  profile: demo
  components:
    cni:
      namespace: istio-system
      enabled: true
    ingressGateways:
      - name: istio-ingressgateway
        enabled: false
    egressGateways:
      - name: istio-egressgateway
        enabled: false

and following https://istio.io/latest/docs/setup/getting-started/

[aviramha]

So in this case, the agent doesn't see the istio iptables (since not in the same namespace) and it just initializes in a standard way. It steals traffic from PREROUTING (the mesh), but if I remove the rule there it seems to be okay.