```yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: strict-and-permissive-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: STRICT
  portLevelMtls:
    9090:
      mode: PERMISSIVE
```

will be translated into this `Authorization`:

```yaml
action: DENY
groups:
- rules:
  - matches:

# This configures all services within the namespace to use mTLS with permissive mode (allowing plaintext).

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: ns-default
  namespace: {{ .To.NamespaceName }}
spec:
  mtls:
    mode: PERMISSIVE

---
# This configures requests to any service in the namespace to use mTLS.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:

apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: valid-peer-authentication
spec:
  selector:
    matchLabels:
      app: httpbin
      version: v1
  mtls:
    mode: PERMISSIVE
  portLevelMtls:
    8080:

apiVersion: release-notes/v2
kind: bug-fix
area: networking
issue:
- 29538
releaseNotes:
- |

apiVersion: release-notes/v2
kind: bug-fix
area: security
issue:
- 31297
releaseNotes:
- |

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: default
spec:
  mtls:

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: valid-peer-authentication
spec:
  selector:
    matchLabels:
      app: httpbin
      version: v1
  mtls:
    mode: PERMISSIVE
  portLevelMtls:
    8080:

releaseNotes:
- |
  **Removed** the protocol detection timeout by default, reducing traffic failures during slow connections.
upgradeNotes:
- title: Protocol Detection Timeout Changes
  content: |
    In order to support permissive mTLS traffic as well as [automatic protocol detection](istio.io/latest/docs/ops/configuration/traffic-management/protocol-selection/#automatic-protocol-selection),

		if features.DisableMxALPN {
			ctx.CommonTlsContext.AlpnProtocols = util.ALPNDownstream
		} else {
			ctx.CommonTlsContext.AlpnProtocols = util.ALPNDownstreamWithMxc
		}
	} else {
		// Note that in the PERMISSIVE mode, we match filter chain on "istio" ALPN,
		// which is used to differentiate between service mesh and legacy traffic.
		//
		// Client sidecar outbound cluster's TLSContext.ALPN must include "istio".
		//

        where:
        // We can't test against Java 6 since the gradleApi dependencies are compiled to java 8.
        // However, the java 7 compiler is permissive enough to compile against the java 8 API classes.
        version << [JavaVersion.VERSION_1_7]
    }

    def "succeeds when running with compatible java version"() {
        given: