# Allows the Webhooks to be reached by kube-api with or without
# sidecar injection and with mTLS PERMISSIVE and STRICT.
apiVersion: "security.istio.io/v1beta1"
kind: "PeerAuthentication"
metadata:
  name: "webhook"
  namespace: "knative-serving"
  labels:
    serving.knative.dev/release: devel
    networking.knative.dev/ingress-provider: istio
spec:
  selector:
    matchLabels:
      app: webhook
  portLevelMtls:
    8443:
      mode: PERMISSIVE
---
apiVersion: "security.istio.io/v1beta1"
kind: "PeerAuthentication"
metadata:
  name: "domainmapping-webhook"
  namespace: "knative-serving"
  labels:
    serving.knative.dev/release: devel
    networking.knative.dev/ingress-provider: istio
spec:
  selector:
    matchLabels:
      app: domainmapping-webhook
  portLevelMtls:
    8443:
      mode: PERMISSIVE
---
apiVersion: "security.istio.io/v1beta1"
kind: "PeerAuthentication"
metadata:
  name: "istio-webhook"
  namespace: "knative-serving"
  labels:
    serving.knative.dev/release: devel
    networking.knative.dev/ingress-provider: istio
spec:
  selector:
    matchLabels:
      app: istio-webhook
  portLevelMtls:
    8443:
      mode: PERMISSIVE
