How does Istio provide mTLS without application code changes?

Istio injects an Envoy sidecar proxy into every Pod and configures iptables rules to intercept all traffic through the proxy. Applications communicate in plaintext on localhost; the proxy handles TLS termination, certificate presentation, and peer authentication transparently.