So technically you only need networkPlatform: Istio when using mTLS (a result of us needing /etc/hosts injection to avoid CBS routing things the wrong way). You can specify this flag when using NONE and still use CB TLS for peer authentication. I think this will be too limiting. There is an annotation that is applied to the Operator pod that gives a hint at the true mode, but then we are tying ourselves to a 3rd party thing, and even then this isn't visible to the DAC. For this reason, I guess I'm nervous about going further for now. Everything is documented if you read it.