I've worked at a place where even internal traffic that crosses machines needs to be encrypted. So Ingress -TLS-> Container (pod). We implemented LinkerD for

I've worked at a place where even internal traffic that crosses machines needs to be encrypted. So Ingress -TLS-> Container (pod). We implemented LinkerD for this, which runs as a sidecar in the pod. Since the sidecar and the main container communicate on the same machine, this is OK.