[williamallthing]

This is one of the several reasons Linkerd moved from per-host to sidecars.

For mTLS, the moment you want to have identity per service (as opposed to one cert across everything in the mesh), you need the security boundary to be at the pod level.