# Negative test: tls.mode "tcp" does not exist in ClientTLSSettings enum — expect API rejection
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata: { name: t91-invalid-mode, namespace: istio-vt-t91 }
spec:
  host: api.partner.example
  trafficPolicy:
    tls:
      mode: tcp
