<p>I am trying to setup Istio and I need to whitelist few ports for allowing non mTLS traffic from outside world coming in through specfic port for few pods runnings in local k8s.</p>

<p>I am unable to find a successful way of doing it.</p>

<p>Tried Service entry, policy and destination rule and didnt succeed.</p>

<p>Helps is highly appreciated. </p>

<pre><code>version.BuildInfo{Version:"1.1.2", GitRevision:"2b1331886076df103179e3da5dc9077fed59c989", User:"root", Host:"35adf5bb-5570-11e9-b00d-0a580a2c0205", GolangVersion:"go1.10.4", DockerHub:"docker.io/istio", BuildStatus:"Clean", GitTag:"1.1.1"}```

Service Entry
```apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: external-traffic
  namespace: cloud-infra
spec:
  hosts:
  - "*.cluster.local"
  ports:
  - number: 50506
    name: grpc-xxx
    protocol: TCP
  location: MESH_EXTERNAL
  resolution: NONE```
</code></pre>

<p>You need to add a DestinationRule and a Policy :</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: destinationrule-test
spec:
  host: service-name
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
    portLevelSettings:
    - port:
        number: 8080
      tls:
        mode: DISABLE
---
apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: policy-test
spec:
  targets:
  - name: service-name
    ports:
    - number: 8080
  peers:
</code></pre>

<p>This has been tested with istio 1.0, but it will probably work for istio 1.1. It is heavily inspired by the documentation <a href="https://istio.io/help/ops/setup/app-health-check/" rel="nofollow noreferrer">https://istio.io/help/ops/setup/app-health-check/</a></p>
