apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: valid-peer-authentication
spec:
  selector:
    matchLabels:
      app: httpbin
      version: v1
  mtls:
    mode: PERMISSIVE
  portLevelMtls:
    8080:

apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
  name: peerauthentications.security.istio.io

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: valid-peer-authentication
spec:
  selector:
    matchLabels:
      app: httpbin
      version: v1
  mtls:
    mode: PERMISSIVE
  portLevelMtls:
    8080:

# PeerAuthentication Implementation in Ambient

kind: feature
area: security
issue:
  - 27994

releaseNotes:
  - |
    **Added** support of PeerAuthentication per-port-level configuration on pass through filter chains.

upgradeNotes:
  - title: PeerAuthentication per-port-level configuration will now also apply to pass through filter chains.
    content: |
      Previously the PeerAuthentication per-port-level configuration is ignored if the port number is not defined in a

# Global PeerAuthentication can be removed for this test, once we remove the (alpha) mesh policy
# during installation.
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: "default"
  annotations:
    test-suite: "beta-mtls-permissive"
spec:
  mtls:
    mode: PERMISSIVE
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: "default"
  annotations:

		return "MeshNetworks"
	case MutatingWebhookConfiguration:
		return "MutatingWebhookConfiguration"
	case Namespace:
		return "Namespace"
	case Node:
		return "Node"
	case PeerAuthentication:
		return "PeerAuthentication"
	case Pod:
		return "Pod"
	case ProxyConfig:
		return "ProxyConfig"
	case ReferenceGrant:
		return "ReferenceGrant"
	case RequestAuthentication:
		return "RequestAuthentication"

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: "a-disable"
  annotations:
    test-suite: "beta-mtls-automtls-workload"
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: DISABLE
---
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: "b-strict"
  annotations:
    test-suite: "beta-mtls-automtls-workload"
spec:
  selector:
    matchLabels:

	case *k8sioapicorev1.Namespace:
		return gvk.Namespace, true
	case *k8sioapicorev1.Node:
		return gvk.Node, true
	case *istioioapisecurityv1beta1.PeerAuthentication:
		return gvk.PeerAuthentication, true
	case *apiistioioapisecurityv1beta1.PeerAuthentication:
		return gvk.PeerAuthentication, true
	case *k8sioapicorev1.Pod:
		return gvk.Pod, true
	case *istioioapinetworkingv1beta1.ProxyConfig:
		return gvk.ProxyConfig, true

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: strict-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: STRICT
  portLevelMtls:
    8080: