Yes, Istio was the service mesh I referenced above that we can't install for different reasons:

>> It was a huge PITA tho without a service mesh (which we can't use for different reasons)

If you have Istio then you don't need MeTaLS (unless your client comes from outside the cluster or something, and even then I think there are ways to make it work).

I don't know that I would agree that it is "for free" as Istio still needs to be configured, and it isn't trivial from my experience. I could also see situations where something like MeTaLS where you place a few env vars for certs and you're done is nice to have. I would definitely recommend Istio if you can use it though.