kind: AuthorizationPolicy
metadata:
  name: {{ .To.ServiceName }}-allow
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  action: ALLOW
  rules:
    - to:
      - operation:

metadata:
  name: allow-policy
spec:
  action: ALLOW
  selector:
    matchLabels:
      "istio": {{.GatewayIstioLabel | default "ingressgateway"}}
  rules:
  - to:
    - operation:
        notPorts: ["100"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-policy
spec:
  action: DENY
  selector:
    matchLabels:

    to:
    - operation:
        methods: ["method"]
        hosts: ["exact.com"]
        ports: ["80"]
        paths: ["/exact"]
        notMethods: ["not-method"]
        notHosts: ["not-exact.com"]
        notPorts: ["8000"]
        notPaths: ["/not-exact"]
    when:
      - key: "request.headers[X-header]"
        values: ["header"]
        notValues: ["not-header"]
      - key: "source.ip"
        values: ["10.10.10.10"]

            methods: ["method"]
            hosts: ["exact.com"]
            ports: ["80"]
            paths: ["/exact"]
            notMethods: ["not-method"]
            notHosts: ["not-exact.com"]
            notPorts: ["8000"]
            notPaths: ["/not-exact"]
      when:
        - key: "request.headers[X-header]"
          values: ["header"]

            notMethods: ["not-method", "not-method-prefix-*", "*-not-suffix-method", "*"]
            notHosts: ["not-exact.com", "*.not-suffix.com", "not-prefix.*", "*"]
            notPorts: ["8000", "9000"]
            notPaths: ["/not-exact", "/not-prefix/*", "*/not-suffix", "*", "/not-path/template/{*}", "/{**}/not-path/template"]
      when:
        - key: "request.headers[X-header]"

    - operation:
        hosts: ["exact.com", "*.suffix.com", "prefix.*", "*"]
        notHosts: ["not-exact.com", "*.not-suffix.com", "not-prefix.*", "*"]
  - to:
    - operation:
        ports: ["80", "90"]
        notPorts: ["800", "900"]
  - to:
    - operation:
        paths: ["/exact", "/prefix/*", "*/suffix", "*"]
        notPaths: ["/not-exact", "/not-prefix/*", "*/not-suffix", "*"]
  - when:
    - key: "request.headers[X-header]"

    to:
    - operation:
        methods: ["method"]
        hosts: ["exact.com"]
        ports: ["80"]
        paths: ["/exact"]
        notMethods: ["not-method"]
        notHosts: ["not-exact.com"]
        notPorts: ["8000"]
        notPaths: ["/not-exact"]
    when:
      - key: "request.headers[X-header]"
        values: ["header"]
        notValues: ["not-header"]
      - key: "source.ip"
        values: ["10.10.10.10"]