{
				Name:         "tcp-8085",
				ServicePort:  echo.NoServicePort,
				WorkloadPort: 8085,
				Protocol:     protocol.HTTP,
			},
			{
				Name:         "tcp-8086",
				ServicePort:  echo.NoServicePort,
				WorkloadPort: 8086,
				Protocol:     protocol.HTTP,
			},
			{
				Name:         "tcp-8087",
				ServicePort:  echo.NoServicePort,
				WorkloadPort: 8087,
				Protocol:     protocol.TCP,

							plaintextSucceeds: true,
							mtlsSucceeds:      false,
						},
					},
				},
				{
					// There is only authN policy that enables mTLS by default and disables mTLS strict on port 8086 and 8088.
					// The request should be denied on port 8085 and 8071.
					name: "STRICT with DISABLE",
					config: `apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:

    ```

=== "Python 3.9+"

    ```Python hl_lines="82-85"
    {!> ../../../docs_src/security/tutorial003_an_py39.py!}
    ```

=== "Python 3.8+"

    ```Python hl_lines="83-86"
    {!> ../../../docs_src/security/tutorial003_an.py!}
    ```

=== "Python 3.10+ non-Annotated"

    !!! tip
        Prefer to use the `Annotated` version if possible.

    ```Python hl_lines="78-81"

	// 386:`SUBL\s[A-Z]+,\s\([A-Z]+\)\([A-Z]+\*4\)`
	arr[c] -= b
	// 386:`ADDL\s[$]-15,\s\([A-Z]+\)\([A-Z]+\*4\)`
	arr[d] -= 15
	// 386:`DECL\s\([A-Z]+\)\([A-Z]+\*4\)`
	arr[b]--
	// amd64:`DECQ\s64\([A-Z]+\)`
	arr[8]--
	// 386:"SUBL\t4"
	// amd64:"SUBQ\t8"
	return arr[0] - arr[1]
}

func SubFromConst(a int) int {
	// ppc64x: `SUBC\tR[0-9]+,\s[$]40,\sR`
	b := 40 - a
	return b
}

func SubFromConstNeg(a int) int {

000003f0  5b c0 e8 b4 42 eb ee 83  c2 ae 0d 28 99 48 46 a9  |[...B......(.HF.|
00000400  64 38 60 59 c2 dc 5c 7b  16 03 03 00 14 78 72 cf  |d8`Y..\{.....xr.|
00000410  ac 5d 53 7e 73 b1 6e e2  0a 8e 12 33 be 03 86 6a  |.]S~s.n....3...j|
00000420  ce                                                |.|
>>> Flow 9 (client to server)
00000000  16 03 03 02 69 33 a1 bb  7d ff 23 ba ad dc a0 1e  |....i3..}.#.....|