Two services need encrypted, mutually authenticated workload-to-workload connections. A compatible service mesh is installed. Which security capability addresses this need?

1. Base64-encoded environment variables alone
2. An ingress-only TLS certificate with plain HTTP between workloads
3. Workload mutual TLS with appropriate mesh policy and identities
4. A Pod label named encrypted without enforcement