On Istio metrics reported by the destination proxy, which connection_security_policy value means the request used mutual TLS?

Answer: mutual_tls

Explanation

Istio sets connection_security_policy to mutual_tls when the connection used Istio's mutual TLS and the destination reports the metric. Querying istio_requests_total for reporter="destination" and any other value finds the plain-text clients to fix before switching to STRICT. On metrics reported by the source the label is unknown.