# Mesh-wide STRICT mTLS - Zero Trust
# All service-to-service communication must present valid SPIFFE SVID
# In ambient mode, ztunnel enforces mTLS for all enrolled namespaces
# Services outside the ambient mesh will be rejected
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT