I feel that service mesh integration in k8s is still very immature. Be aware that running any sidecar model service mesh requires setting elevated permissions on the entire pod. Your pod security policy will need to allow NET_ADMIN at the very least, since service meshes mostly operate by manipulating iptables rules in the pod. Often there are other elevated permissions required. Usually this means people are setting elevated permissions globally on the default svc account, which is scary.