apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
 name: default
spec:
 selector:
   matchLabels:
     app: foo
 mtls:
   mode: STRICT
---`
	paDisable := `
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
 name: default
spec:
 selector:
   matchLabels:
     app: foo
 mtls:
   mode: DISABLE
---`
	paPermissive := `
apiVersion: security.istio.io/v1beta1

func TestJobStrategy_ValidateUpdate(t *testing.T) {
	ctx := genericapirequest.NewDefaultContext()
	validSelector := &metav1.LabelSelector{
		MatchLabels: map[string]string{"a": "b"},
	}
	validPodTemplateSpec := api.PodTemplateSpec{
		ObjectMeta: metav1.ObjectMeta{
			Labels: validSelector.MatchLabels,
		},
		Spec: api.PodSpec{
			RestartPolicy: api.RestartPolicyOnFailure,
			DNSPolicy:     api.DNSClusterFirst,

    port: 9090
    targetPort: 9090
  selector:
    app: multiversion
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: multiversion-v-istio
spec:
  replicas: 1
  selector:
    matchLabels:
      app: multiversion
      version: v-istio
  template:
    metadata:
      labels:
        app: multiversion
        version: v-istio
        test.istio.io/class: naked
      annotations:

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: {{ .To.ServiceName }}
spec:
  selector:
    matchLabels:
      app: {{ .To.ServiceName }}
  mtls:

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: strict-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: UNSET
  portLevelMtls:
    8080: 

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: strict-and-permissive-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: STRICT
  portLevelMtls:
    9090:

  - name: http
    port: 8090
    targetPort: 8090
  selector:
    app: foo
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: foo-bar-rev-a
spec:
  replicas: 1
  selector:
    matchLabels:
      app: foo
      version: bar
  template:
    metadata:
      labels:
        app: foo
        version: bar
        test.istio.io/class: standard
        istio.io/rev: rev-a
      annotations:

			},
			Spec: admissionregistration.ValidatingAdmissionPolicyBindingSpec{
				PolicyName: "replicalimit-policy.example.com",
				ParamRef: &admissionregistration.ParamRef{
					Selector: &metav1.LabelSelector{
						MatchLabels: map[string]string{
							"label": "value",
						},
					},
					ParameterNotFoundAction: &denyAction,
				},
				ValidationActions: []admissionregistration.ValidationAction{admissionregistration.Deny},
			},

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-all
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
      version: v1
  rules:

apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterSPIFFEID
metadata:
  name: example
spec:
  spiffeIDTemplate: "spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"
  podSelector:
    matchLabels: