Istio PeerAuthentication 严格 mTLS 与 DestinationRule ISTIO_MUTUAL 实战

强制 mTLS（命名空间内指定工作负载）：apiVersion: security.istio.io/v1beta1

kind: PeerAuthentication

metadata:

name: api-mtls-strict

namespace: default

spec:

selector:

matchLabels:

app: api

mtls:

mode: STRICT

客户端侧 TLS（DestinationRule）：apiVersion: networking.istio.io/v1beta1

kind: DestinationRule

metadata:

name: api-dr

namespace: default

spec:

host: api.default.svc.cluster.local

trafficPolicy:

tls:

mode: ISTIO_MUTUAL