if b.svc == nil || b.port == nil {
		return nil
	}

	// resolve policy from context
	destinationRule := corexds.CastDestinationRule(b.node.SidecarScope.DestinationRule(
		model.TrafficDirectionOutbound, b.node, b.svc.Hostname).GetRule())
	trafficPolicy, _ := util.GetPortLevelTrafficPolicy(destinationRule.GetTrafficPolicy(), b.port)

	// setup default cluster
	b.applyTrafficPolicy(defaultCluster, trafficPolicy)

apiVersion: release-notes/v2
kind: feature
area: networking
issue:
releaseNotes:
- |

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "{{ .To.ServiceName }}"
spec:
  host: "{{ .To.ClusterLocalFQDN }}"
  trafficPolicy:
    tls:

apiVersion: release-notes/v2
kind: feature
area: networking
releaseNotes:
- |

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: passthrough
  annotations:
    test-suite: automtls-passthrough
spec:
  host: "*"
  trafficPolicy:
    loadBalancer:

func TestUpdateExistingContents(t *testing.T) {
	g := NewWithT(t)
	src := NewKubeSource(collections.Istio)

	applyAndValidate := func(version string) {
		configTemplate := `apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: productpage
  labels:
    version: %s
spec:
  host: productpage
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
  subsets:
  - name: %s
    labels:
      version: %s`

	DestinationRule                = config.GroupVersionKind{Group: "networking.istio.io", Version: "v1alpha3", Kind: "DestinationRule"}
	DestinationRule_v1beta1        = config.GroupVersionKind{Group: "networking.istio.io", Version: "v1beta1", Kind: "DestinationRule"}
	DestinationRule_v1             = config.GroupVersionKind{Group: "networking.istio.io", Version: "v1", Kind: "DestinationRule"}

  namespace: {{ .To.NamespaceName }}
spec:
  mtls:
    mode: PERMISSIVE

---
# This configures requests to any service in the namespace to use mTLS.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: default
  namespace: {{ .To.NamespaceName }}
spec:
  host: "*.{{ .To.NamespaceName }}.svc.cluster.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

---

releaseNotes:
  - |

	}
}

// DestinationRule returns a destinationrule for a svc.
func (sc *SidecarScope) DestinationRule(direction TrafficDirection, proxy *Proxy, svc host.Name) *ConsolidatedDestRule {
	destinationRules := sc.destinationRules[svc]
	var catchAllDr *ConsolidatedDestRule
	for _, destRule := range destinationRules {
		destinationRule := destRule.rule.Spec.(*networking.DestinationRule)