Under mesh-wide mTLS, adding a DestinationRule starts returning 503s. What is the usual cause?

Why this is the answer

A DestinationRule with a trafficPolicy but no tls block leaves the mode at DISABLE, so the client sidecar sends plaintext to a server that expects mTLS and the connection fails — the fix is tls: mode: ISTIO_MUTUAL. Label-less subsets fail differently, with no healthy upstream; connection-pool limits produce UO overflow flags; and an unusable locality setting falls back rather than returning 503.