This means server certificates will be automatically verified using the OS CA certificates when not using a DestinationRule caCertificates field.
  If undesired please use the new `compatibilityVersion` feature to fallback to old behavior, or `insecureSkipVerify`
  field in DestinationRule to skip the verification.
upgradeNotes:
- title: Default value of the feature flag `VERIFY_CERT_AT_CLIENT` is set to true
  content: |

)

type ApplyFunc = func(tcpProxy *tcp.TcpProxy, destinationRule *networking.DestinationRule, subsetName string)

// Apply configures tunneling_config in a given TcpProxy depending on the destination rule and the destination hosts
var Apply ApplyFunc = func(tcpProxy *tcp.TcpProxy, destinationRule *networking.DestinationRule, subsetName string) {
	var tunnelSettings *networking.TrafficPolicy_TunnelSettings

						name            string
						destinationRule string
						expectSuccess   bool
					}{
						{
							name:            "connection fails when DR doesn't match SA",
							destinationRule: defaultIdentityDR,
							expectSuccess:   false,
						},
						{
							name:            "connection succeeds when DR matches SA",
							destinationRule: correctIdentityDR,
							expectSuccess:   true,

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: productpage
spec:
  host: productpage
  subsets:
  - name: v1
    labels:
      version: v1
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: reviews
spec:
  host: reviews
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
  - name: v3

	return h.Sum64()
}

func (t *clusterCache) DependentConfigs() []model.ConfigHash {
	drs := t.destinationRule.GetFrom()
	configs := make([]model.ConfigHash, 0, len(drs)+1+len(t.envoyFilterKeys))
	if t.destinationRule != nil {
		for _, dr := range drs {
			configs = append(configs, model.ConfigKey{Kind: kind.DestinationRule, Name: dr.Name, Namespace: dr.Namespace}.HashCode())
		}
	}
	if t.service != nil {

	case CustomResourceDefinition:
		return "CustomResourceDefinition"
	case DNSName:
		return "DNSName"
	case DaemonSet:
		return "DaemonSet"
	case Deployment:
		return "Deployment"
	case DestinationRule:
		return "DestinationRule"
	case EndpointSlice:
		return "EndpointSlice"
	case Endpoints:
		return "Endpoints"
	case EnvoyFilter:
		return "EnvoyFilter"
	case GRPCRoute:
		return "GRPCRoute"
	case Gateway:

	}

	return false
}

func initDestHostsAndSubsets(ctx analysis.Context) map[hostAndSubset]bool {
	hostsAndSubsets := make(map[hostAndSubset]bool)
	ctx.ForEach(gvk.DestinationRule, func(r *resource.Instance) bool {
		dr := r.Message.(*v1alpha3.DestinationRule)
		drNamespace := r.Metadata.FullName.Namespace

		for _, ss := range dr.GetSubsets() {
			hs := hostAndSubset{

type mtlsChecker struct {
	push            *model.PushContext
	svcPort         int
	destinationRule *networkingapi.ClientTLSSettings_TLSmode
}

func newMtlsChecker(push *model.PushContext, svcPort int, dr *config.Config, subset string) *mtlsChecker {
	return &mtlsChecker{
		push:            push,
		svcPort:         svcPort,
		destinationRule: tlsModeForDestinationRule(dr, subset, svcPort),
	}
}

# Fails if a service with the name exists: trusted_ca required !
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: ssl-simple
  namespace: testns
spec:
  host: ssl1.webinf.info
  trafficPolicy:
    loadBalancer:
      simple: LEAST_CONN
    tls:
      mode: SIMPLE
---
# This will not work: myCA not found, results in rejecting all clusters if the
# service exists.
apiVersion: networking.istio.io/v1alpha3

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: tunnel-outbound-traffic-to-external-svc-via-external-forward-proxy
spec:
  host: external-forward-proxy.{{ .externalNamespace }}.svc.cluster.local
  subsets:
  - name: external-svc-tcp
    trafficPolicy:
      tunnel:
        targetHost: external.{{ .externalNamespace }}
        targetPort: {{ .externalSvcTcpPort }}
  - name: external-svc-tls
    trafficPolicy: