DestinationRule: productpage for "productpage"
   WARNING POD DOES NOT MATCH ANY SUBSETS.  (Non matching subsets v1)
   Matching subsets: 
      (Non-matching subsets v1)
   Traffic Policy TLS Mode: ISTIO_MUTUAL
   Policies: load balancer/connection pool/outlier detection
   Port Level Settings:
    8080:
      TLS Mode: DISABLE
      Policies: load balancer/connection pool/outlier detection
VirtualService: bookinfo

                                      Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
                                    enum:
                                    - DISABLE
                                    - SIMPLE
                                    - MUTUAL
                                    - ISTIO_MUTUAL
                                    type: string
                                  privateKey:

				ValidationContextSdsSecretConfig: model.ConstructSdsSecretConfig(model.SDSRootResourceName),
			},
		}
		tlsContext.CommonTlsContext.AlpnProtocols = model.ALPNInMeshH2
		tlsContext.Sni = tls.Sni
		// For ISTIO_MUTUAL if custom SNI is not provided, use the default SNI name.
		if len(tls.Sni) == 0 {
			tlsContext.Sni = sniName
		}
	default:
		// No TLS.
		return nil
	}
	return tlsContext
}

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: echo-dr
  namespace: default
spec:
  host: echo-app.default.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: default
spec:
  mtls:
    mode: STRICT
`,
	}, echoCfg{version: "v1", tls: true})

---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: {{ .To.ServiceName }}-dr
spec:
  host: "fake.destination.{{ .To.ServiceName }}"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---`)).
						BuildAll(nil, apps.Ns1.All).
						Apply()

					echotest.New(t, apps.Ns1.All.Instances()).
						WithDefaultFilters(1, 1).
						FromMatch(match.NotProxylessGRPC).

    trustDomain: "cluster.local"

    defaultConfig:
      proxyMetadata: {}
      tracing:
      #      tlsSettings:
      #        mode: DISABLE # DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
      #        clientCertificate: # example: /etc/istio/tracer/cert-chain.pem
      #        privateKey:        # example: /etc/istio/tracer/key.pem
      #        caCertificates:    # example: /etc/istio/tracer/root-cert.pem

	MultiRootMesh = env.Register("ISTIO_MULTIROOT_MESH", false,
		"If enabled, mesh will support certificates signed by more than one trustAnchor for ISTIO_MUTUAL mTLS").Get()

	EnableEnvoyFilterMetrics = env.Register("PILOT_ENVOY_FILTER_STATS", false,
		"If true, Pilot will collect metrics for envoy filter operations.").Get()

// ISTIO_MUTUAL  |    ENABLED    |   DISABLED  | support SDS at gateway to terminate workload mTLS, with internal workloads
//
//	| for egress or with another trusted cluster for ingress)
//
// ISTIO_MUTUAL  |    DISABLED   |   DISABLED  | use file-mounted secret paths to terminate workload mTLS from gateway
//

    trustDomain: "cluster.local"

    defaultConfig:
      proxyMetadata: {}
      tracing:
      #      tlsSettings:
      #        mode: DISABLE # DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL
      #        clientCertificate: # example: /etc/istio/tracer/cert-chain.pem
      #        privateKey:        # example: /etc/istio/tracer/key.pem
      #        caCertificates:    # example: /etc/istio/tracer/root-cert.pem

		result            *auth.DownstreamTlsContext
		transportProtocol istionetworking.TransportProtocol
		mesh              *meshconfig.MeshConfig
	}{
		{
			name: "mesh SDS enabled, tls mode ISTIO_MUTUAL",
			server: &networking.Server{
				Hosts: []string{"httpbin.example.com"},
				Port: &networking.Port{
					Protocol: string(protocol.HTTPS),
				},
				Tls: &networking.ServerTLSSettings{