# No caCertificates when mode is simple at destination level and MUTUAL at port level
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: db-mtls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    tls:
      mode: SIMPLE
      clientCertificate: /etc/certs/myclientcert.pem
      privateKey: /etc/certs/client_private_key.pem
    portLevelSettings:
      - port:
          number: 443
        tls:

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443
        tls:
          mode: SIMPLE
          credentialName: db-credential
  workloadSelector:
      matchLabels:

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    tls:
      mode: SIMPLE
      credentialName: db-credential
  workloadSelector:
      matchLabels:

	return analysis.Metadata{
		Name:        "destinationrule.CaCertificateAnalyzer",
		Description: "Checks if caCertificates is set when TLS mode is SIMPLE/MUTUAL",
		Inputs: []config.GroupVersionKind{
			gvk.DestinationRule,
		},
	}
}

func (c *CaCertificateAnalyzer) Analyze(ctx analysis.Context) {
	ctx.ForEach(gvk.DestinationRule, func(r *resource.Instance) bool {
		c.analyzeDestinationRule(r, ctx)

			dr: &config.Config{
				Spec: &networking.DestinationRule{
					TrafficPolicy: &networking.TrafficPolicy{
						OutlierDetection: &networking.OutlierDetection{
							ConsecutiveErrors: 5,
						},
					},
				},
			},
			expectedLabels: nil,
		},
		{
			name: "failover priority disabled",
			dr: &config.Config{
				Spec: &networking.DestinationRule{
					TrafficPolicy: &networking.TrafficPolicy{

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "default"
spec:
  host: "*"
  trafficPolicy:
    tls:
      mode: {{ .TLSMode }}
---
# Apply a local policy to the system namespace to turn this off
# Otherwise, the eastwest gateway will be impacted
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "eastwest-opt-out"
spec:
  exportTo: [.]
  host: "*"

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: passthrough
spec:
  host: "*"
  trafficPolicy:
    loadBalancer:
      simple: PASSTHROUGH
---
# Apply a local policy to the system namespace to turn this off
# Otherwise, the eastwest gateway will be impacted
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "eastwest-opt-out"
  annotations:
    test-suite: "beta-mtls-on"

  This means server certificates will be automatically verified using the OS CA certificates when not using a DestinationRule caCertificates field.
  If undesired please use the new `compatibilityVersion` feature to fallback to old behavior, or `insecureSkipVerify`
  field in DestinationRule to skip the verification.
upgradeNotes:
- title: Default value of the feature flag `VERIFY_CERT_AT_CLIENT` is set to true
  content: |

)

type ApplyFunc = func(tcpProxy *tcp.TcpProxy, destinationRule *networking.DestinationRule, subsetName string)

// Apply configures tunneling_config in a given TcpProxy depending on the destination rule and the destination hosts
var Apply ApplyFunc = func(tcpProxy *tcp.TcpProxy, destinationRule *networking.DestinationRule, subsetName string) {
	var tunnelSettings *networking.TrafficPolicy_TunnelSettings

						name            string
						destinationRule string
						expectSuccess   bool
					}{
						{
							name:            "connection fails when DR doesn't match SA",
							destinationRule: defaultIdentityDR,
							expectSuccess:   false,
						},
						{
							name:            "connection succeeds when DR matches SA",
							destinationRule: correctIdentityDR,
							expectSuccess:   true,