# list PeerAuthentication resources in a namespace# If no PeerAuthentication resource exists in the namespace, # then it's PERMISSIVE mode (Istio API default)
kubectlgetPeerAuthentication-n$NAMESPACE# for each of the above run the following command
kubectlgetPeerAuthentication$PEER-AUTHN-n$NAMESPACE# Expected Output is as follows:# MTLS Mode must be PERMISSIVE.# If the output says STRICT, then please update the policy to PERMISSIVE.
apiVersion:security.istio.io/v1
kind:PeerAuthentication
metadata:
name:$PEER-AUTHN
namespace:$NAMESPACE
spec:
mtls:
mode:PERMISSIVE
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Cloud Run API reference\n=======================\n\n|\n| **Preview**\n|\n|\n| This product or feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA products and features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n| **Note:** This guide only supports Cloud Service Mesh with Istio APIs and does not support Google Cloud APIs. For more information see, [Cloud Service Mesh overview](/service-mesh/v1.25/docs/overview).\n\nThis page provides a reference for the APIs that are used to configure\nCloud Service Mesh for Cloud Run workloads.\n\nCloud Run API\n-------------\n\n### v1 API\n\nCloud Service Mesh is enabled using a [Revision level annotation](/run/docs/reference/yaml/v1).\nThe value of this annotation is the backing mesh name of the\nCloud Service Mesh Istio cluster.\n\n### v2 API\n\nCloud Service Mesh is enabled using the `serviceMesh` field in the\n[`Service` resource](/run/docs/reference/rest/v2/projects.locations.services#Service)\n\nCloud Service Mesh Istio API\n----------------------------\n\n### VirtualService API\n\n### Istio Auto MTLS and Secure Naming\n\nCurrently, Cloud Service Mesh supports Automatic Istio MutualTLS and Secure\nNaming for requests between GKE Services.\n\nFor Preview, non-GKE workloads communicating with\nGKE workloads/services will not use Istio Auto MTLS nor Secure\nNaming. The traffic will be in plain text. Make sure that GKE\nServices have a permissive MTLS policy (which is the Istio API default) which\naccepts MTLS traffic from GKE workloads and plain text from\nnon-GKE workloads.\n\nUse the following command to check if PeerAuthentication is in permissive mode: \n\n # list PeerAuthentication resources in a namespace\n # If no PeerAuthentication resource exists in the namespace, \n # then it's PERMISSIVE mode (Istio API default)\n kubectl get PeerAuthentication -n $NAMESPACE\n\n # for each of the above run the following command\n kubectl get PeerAuthentication $PEER-AUTHN -n $NAMESPACE\n\n # Expected Output is as follows:\n # MTLS Mode must be PERMISSIVE.\n # If the output says STRICT, then please update the policy to PERMISSIVE.\n apiVersion: security.istio.io/v1\n kind: PeerAuthentication\n metadata:\n name: $PEER-AUTHN\n namespace: $NAMESPACE\n spec:\n mtls:\n mode: PERMISSIVE\n\n### MeshConfig Telemetry\n\nCloud Service Mesh supports MeshConfig telemetry API to enable and disable\nCloud Logging and Cloud Monitoring for GKE workloads.\nThis will work similarly for non-GKE workloads as well.\n\n### Destination Rule\n\nFor Preview, `DestinationRule` targeting the \"external-mesh\" virtual services\nwill be supported except following fields: `trafficPolicy.tls`\n\n### Sidecar API\n\nSidecar API will not be applicable to non-GKE workloads.\nNon-GKE workloads will be able to see all the virtual services\nscoped to \"external-mesh\" without being filtered by any Sidecar visibility rules.\n\n### Security API - Authorization Policy, Request Authentication Policy\n\nThese will not apply to non-GKE workloads which act as Clients\nsending outbound traffic. They will continue to apply GKE\nworkloads that receive inbound traffic.\n\n### GCPBackend API\n\n| **Note:** This is a Kubernetes Custom Resource."]]
