annotations:
    test-suite: "beta-per-port-mtls"
spec:
  selector:
    matchLabels:
      app: b
  mtls:
    mode: DISABLE
  portLevelMtls:
    # 8090 is the targetPort for service http(80)
    8090:
      mode: STRICT
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: "default"
  annotations:
    test-suite: "beta-per-port-mtls"
spec:
  host: "*.local"
  trafficPolicy:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: direct-cnn-through-egress-gateway
spec:
  hosts:
  - fake.external.com
  gateways:
  - istio-egressgateway
  - mesh
  tls:
  - match:
    - gateways:
      - mesh
      port: 443
      sniHosts:
      - fake.external.com
    route:
    - destination:
        host: istio-egressgateway.istio-system.svc.cluster.local
        port:

kind: DestinationRule
metadata:
  name: egressgateway-for-external-app
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: ISTIO_MUTUAL

action: DENY
groups:
- rules:
  - matches:
    - notDestinationPorts:
      - 9090
name: converted_peer_authentication_strict-mtls

action: DENY
groups:
- rules:
  - matches:
    - destinationPorts:
      - 9090
      notPrincipals:
      - presence: {}
name: converted_peer_authentication_permissive-strict-mtls

action: DENY
groups:
- rules:
  - matches:
    - destinationPorts:
      - 9090
      notPrincipals:
      - presence: {}
name: converted_peer_authentication_disable-strict-mtls

metadata:
  name: productpage
spec:
  host: productpage
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
  subsets:
  - name: v1
    labels:
      version: v1
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: reviews
spec:
  host: reviews
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
  subsets:
  - name: v1
    labels:
      version: v1

Shriram Rajagopalan <******@****.***> 1572405935 -0400

action: DENY
groups:
- rules:
  - matches:
    - notPrincipals:
      - presence: {}
  - matches:
    - notDestinationPorts:
      - 9090
name: converted_peer_authentication_strict-and-permissive-mtls

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: permissive-strict-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: PERMISSIVE
  portLevelMtls:
    9090: