Basically a client can be configured to send to a fixed target host/ip:port, while using the SNI of TLS handshake to tell istio the “logical” host name for which istio will do the routing with. This is an “equivalent” to the Host header in http/https.