if b.svc == nil || b.port == nil {
		return nil
	}

	// resolve policy from context
	destinationRule := corexds.CastDestinationRule(b.node.SidecarScope.DestinationRule(
		model.TrafficDirectionOutbound, b.node, b.svc.Hostname).GetRule())
	trafficPolicy, _ := util.GetPortLevelTrafficPolicy(destinationRule.GetTrafficPolicy(), b.port)

	// setup default cluster
	b.applyTrafficPolicy(defaultCluster, trafficPolicy)

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "{{ .To.ServiceName }}"
spec:
  host: "{{ .To.ClusterLocalFQDN }}"
  trafficPolicy:
    tls:

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: passthrough
  annotations:
    test-suite: automtls-passthrough
spec:
  host: "*"
  trafficPolicy:
    loadBalancer:

	DestinationRule                = config.GroupVersionKind{Group: "networking.istio.io", Version: "v1alpha3", Kind: "DestinationRule"}
	DestinationRule_v1beta1        = config.GroupVersionKind{Group: "networking.istio.io", Version: "v1beta1", Kind: "DestinationRule"}
	DestinationRule_v1             = config.GroupVersionKind{Group: "networking.istio.io", Version: "v1", Kind: "DestinationRule"}

func TestUpdateExistingContents(t *testing.T) {
	g := NewWithT(t)
	src := NewKubeSource(collections.Istio)

	applyAndValidate := func(version string) {
		configTemplate := `apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: productpage
  labels:
    version: %s
spec:
  host: productpage
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
  subsets:
  - name: %s
    labels:
      version: %s`

  namespace: {{ .To.NamespaceName }}
spec:
  mtls:
    mode: PERMISSIVE

---
# This configures requests to any service in the namespace to use mTLS.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: default
  namespace: {{ .To.NamespaceName }}
spec:
  host: "*.{{ .To.NamespaceName }}.svc.cluster.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

---

releaseNotes:
  - |

	"istio.io/istio/pkg/test/framework"
	"istio.io/istio/pkg/test/framework/components/echo"
	"istio.io/istio/pkg/test/framework/components/echo/check"
)

// TestDestinationRuleTls tests that MUTUAL tls mode is respected in DestinationRule.
// This sets up a client and server with appropriate cert config and ensures we can successfully send a message.
func TestDestinationRuleTls(t *testing.T) {
	framework.
		NewTest(t).
		Run(func(t framework.TestContext) {

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: "default"
  annotations:
    test-suite: "no-peer-authn"
spec:
  host: "*.local"
  trafficPolicy:
    tls:

				clusters = append(clusters, cb.buildWaypointInboundVIPCluster(proxy, svc, *port, "http").build())
			}
			cfg := cb.sidecarScope.DestinationRule(model.TrafficDirectionInbound, proxy, svc.Hostname).GetRule()
			if cfg != nil {
				destinationRule := cfg.Spec.(*networking.DestinationRule)
				for _, ss := range destinationRule.Subsets {
					if port.Protocol.IsUnsupported() || port.Protocol.IsTCP() {