kind: DestinationRule
metadata:
  name: egressgateway-for-external-app
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: ISTIO_MUTUAL

action: DENY
groups:
- rules:
  - matches:
    - notDestinationPorts:
      - 9090
name: converted_peer_authentication_strict-mtls

action: DENY
groups:
- rules:
  - matches:
    - destinationPorts:
      - 9090
      notPrincipals:
      - presence: {}
name: converted_peer_authentication_permissive-strict-mtls

action: DENY
groups:
- rules:
  - matches:
    - destinationPorts:
      - 9090
      notPrincipals:
      - presence: {}
name: converted_peer_authentication_disable-strict-mtls

action: DENY
groups:
- rules:
  - matches:
    - notPrincipals:
      - presence: {}
  - matches:
    - notDestinationPorts:
      - 9090
name: converted_peer_authentication_strict-and-permissive-mtls

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: permissive-strict-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: PERMISSIVE
  portLevelMtls:
    9090:

action: DENY
groups:
- rules:
  - matches:
    - destinationPorts:
      - 8080
      notPrincipals:
      - presence: {}
name: converted_peer_authentication_strict-mtls

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: strict-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: UNSET
  portLevelMtls:
    8080: 

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: strict-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: UNSET
  portLevelMtls:
    9090:

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: disable-strict-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: DISABLE
  portLevelMtls:
    9090: