8-enforce-mtls-only.yaml

# This will enforce that ONLY traffic that is TLS is allowed between proxies
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
spec:
  mtls:
    mode: STRICT

---

# Configure Istio services to send mutual TLS traffic by setting DestinationRule
apiVersion: "networking.istio.io/v1alpha3"
kind: "DestinationRule"
metadata:
  name: "default"
  namespace: "istio-system"
spec:
  host: "*.local" # Every SINGLE SERVICE eg fleetman-staff-service.default.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL # This mode use cert generated by Istio

#Adding the tls to the fleetman-webapp service as there is a DestinationRule overwriting the config above
---
kind: DestinationRule
apiVersion: networking.istio.io/v1alpha3
metadata:
  name: fleetman-webapp-secure
  namespace: default
spec:
  host: fleetman-webapp
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL # This mode use cert generated by Istio