metadata:
  name: ns-default
  namespace: {{ .To.NamespaceName }}
spec:
  mtls:
    mode: PERMISSIVE

---
# This configures requests to any service in the namespace to use mTLS.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: default
  namespace: {{ .To.NamespaceName }}
spec:
  host: "*.{{ .To.NamespaceName }}.svc.cluster.local"
  trafficPolicy:
    tls:

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: route-via-egressgateway-2
  namespace: {{ .From.NamespaceName }}
spec:
  hosts:
    - "{{ .Allowed.ServiceName }}-{{ .Allowed.NamespaceName }}-only.com"
    - "jwt-only.com"
    - "jwt-and-{{ .Allowed.ServiceName }}-{{ .Allowed.NamespaceName }}-only.com"
  gateways:
    - test-egress
    - mesh
  http:
    - match:
        - gateways:

      from:
        - source:
            namespaces: [ "{{ .Allowed.NamespaceName }}" ]
    - to:
        - operation: # GRPC
            ports: [ "{{ (.To.PortForName `grpc`).WorkloadPort }}" ]
            paths: [ "/proto.EchoTestService/Echo" ]
            methods: [ "POST" ]
      from:
        - source:
            namespaces: [ "{{ .Allowed.NamespaceName }}" ]
    - to:
        - operation: # TCP

      from:
        - source:
            namespaces: [ "{{ .Denied.NamespaceName }}" ]
    - to:
        - operation: # GRPC
            ports: [ "{{ (.To.PortForName `grpc`).WorkloadPort }}" ]
            paths: [ "/proto.EchoTestService/Echo" ]
            methods: [ "POST" ]
      from:
        - source:
            namespaces: [ "{{ .Denied.NamespaceName }}" ]
    - to:
        - operation: # TCP

		accessor, err := meta.Accessor(attr.GetObject())
		if err != nil {
			return nil, err
		}
		return accessor.GetLabels(), nil
	}

	namespaceName := attr.GetNamespace()
	namespace, err := m.NamespaceLister.Get(namespaceName)
	if err != nil && !apierrors.IsNotFound(err) {
		return nil, err
	}
	if apierrors.IsNotFound(err) {

	Name string
}

// NamespaceName returns the string name of the namespace, or "" if Namespace is nil.
func (n NamespacedName) NamespaceName() string {
	if n.Namespace != nil {
		return n.Namespace.Name()
	}
	return ""
}

// String returns the Istio-formatted service name in the form of <namespace>/<name>.
func (n NamespacedName) String() string {
	return n.NamespaceName() + "/" + n.Name
}

---

# The following gateway allows request to "*.{{ .To.ServiceName }}.com"

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: gw-{{ .To.ServiceName }}
  namespace: {{ .To.NamespaceName }}
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:

func (c *instance) PortForName(name string) echo.Port {
	return c.cfg.Ports.MustForName(name)
}

func (c *instance) ServiceName() string {
	return c.cfg.Service
}

func (c *instance) NamespaceName() string {
	return c.cfg.NamespaceName()
}

func (c *instance) ServiceAccountName() string {
	return c.cfg.ServiceAccountName()
}

func (c *instance) ClusterLocalFQDN() string {
	return c.cfg.ClusterLocalFQDN()
}

metadata:
  name: {{ .To.ServiceName }}-deny
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  action: DENY
  rules:
    - from:
      - source:

    - operation:
        paths: [ "/source-namespace" ]
    when:
    - key: source.namespace
      values: [ "{{ .Allowed.NamespaceName }}" ]
  - to:
      - operation:
          paths: [ "/source-namespace-notValues" ]
    when:
      - key: source.namespace
        notValues: [ "{{ .Denied.NamespaceName }}" ]
---

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata: