The downstream client of Envoy. Within the Service Mesh a Source is typically a Workload, but the Source for ingress traffic may include other clients such as a browser or mobile app.