You create an Istio PeerAuthentication with a workload selector in the root namespace, istio-system. What does Istio do with it?

Answer: It ignores the policy, because root-namespace policies need no selector

Explanation

The PeerAuthentication API states that policies with workload selectors are ignored when deployed in the root namespace. A root-namespace policy is only meaningful as the mesh-wide default without a selector. To target specific workloads, put the policy with its selector in their own namespace.