# Within the istio-system namespace, we have a control plane component with a DR
# that would normally violate policy. However the istio control plane is
# not controlled via Policy declarations, and is therefore exempt. We don't
# expect the validator to complain about this either.
apiVersion: authentication.istio.io/v1alpha1
kind: MeshPolicy
metadata:
  name: default
spec:
  peers:
  - mtls: {}
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: default
  namespace: istio-system
spec:
  host: "*.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
