apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: "per-port"
  annotations:
    test-suite: "beta-per-port-mtls"
spec:
  selector:
    matchLabels:
      app: b
  mtls:
    mode: DISABLE
  portLevelMtls:
    # 8090 is the targetPort for service http(80)
    8090:
      mode: STRICT
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: "default"

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443
        tls:
          mode: SIMPLE
          credentialName: db-credential
  workloadSelector:
      matchLabels:

Nicole LiHui <******@****.***> 1682232835 +0800

apiVersion: release-notes/v2
kind: feature
area: istioctl
issue: []
releaseNotes:
  - |

# If port is unnamed or port name doesn't follow <protocol>[-<suffix>], the analyzer will report warning.
# If the service is in system namespace, i.e., kube-system, istio-system, kube-public, the check will be skipped.
apiVersion: v1
kind: Service
metadata:
  name: my-service1
  namespace: kube-system  # Skipped because it's in a kube system namespace
spec:
  selector:
    app: my-service1
  ports:
    - protocol: TCP
      port: 8080

John Howard <******@****.***> 1682567498 -0700

apiVersion: v1
kind: Service
metadata:
  name: nginx-svc4
  namespace: nginx-ns4
spec:
  externalName: nginx.example.com
  ports:
  - name: https
    port: 443
    protocol: TCP
    targetPort: 443

issue:
  - 27994

releaseNotes:
  - |
    **Added** support of PeerAuthentication per-port-level configuration on pass through filter chains.

upgradeNotes:
  - title: PeerAuthentication per-port-level configuration will now also apply to pass through filter chains.
    content: |
      Previously the PeerAuthentication per-port-level configuration is ignored if the port number is not defined in a

  namespace: nginx-ns
spec:
  externalName: nginx.example.com
  ports:
  - name: nginx
    port: 443
    protocol: TCP
    targetPort: 443
  type: ExternalName
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-svc2
  namespace: nginx-ns2
spec:
  externalName: nginx.example.com
  ports:
  - port: 443
    protocol: TCP
    targetPort: 443
  type: ExternalName
--- 
apiVersion: v1

John Howard <******@****.***> 1709232034 -0800