The mesh-wide PeerAuthentication in istio-system sets STRICT. The namespace has one that sets PERMISSIVE. A workload-specific policy sets portLevelMtls to DISABLE for port 8080. Which mode applies to port 8080 of that workload?

Answer: DISABLE

Explanation

The most specific PeerAuthentication wins. A policy with a selector for the workload overrides the namespace policy, which overrides the mesh-wide one in the root namespace. Port-level settings override the policy's own mode for that port. So port 8080 accepts plain text, and the workload's other ports use the workload policy's mode, or PERMISSIVE from the namespace if it sets none.