c:
  selector:
    matchLabels:
      app: finance
  mtls:
    mode: STRICT
</code></pre><p>Policy to allow mTLS strict for all workloads, but leave port 8080 to
plaintext:</p><pre><code class=language-yaml>apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: foo
spec:
  selector:
    matchLabels:
      app: finance
  mtls:
    mode: STRICT
  portLevelMtls:
    8080:
      mode: DISABLE
</code></pre><p>Policy to inherite mTLS mode from namespace (or mesh) set