# istio_peer-authn-strict-root-permissive-workload-in.yaml
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default-mesh
  namespace: istio-system
spec:
  mtls:
    mode: STRICT
---
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: workload
  namespace: foo
spec:
  selector:
    matchLabels:
      app: a
  portLevelMtls:
    9090:
      mode: PERMISSIVE