name: envoy.filters.network.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
  rules: {}
  shadowRulesStatPrefix: istio_dry_run_allow_

            - orRules:
                rules:
                - destinationPort: 80
        principals:
        - andIds:
            ids:
            - any: true
  shadowRulesStatPrefix: istio_dry_run_allow_

        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local
      clusterName: outbound|9000||my-custom-ext-authz.foo.svc.cluster.local
    timeout: 0.002s
  statPrefix: tcp.

                ids:
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/ns-1/.*
  shadowRulesStatPrefix: istio_dry_run_allow_

								TypedConfig: protoconv.MessageToAny(hcm),
							},
						},
					},
					TransportSocket: createTransportSocket(listenerSettings.TLSEnabled),
				},
			},
			StatPrefix: fmt.Sprintf("http_forward_proxy_%d", listenerSettings.Port),
		})
	}
	return protomarshal.ToYAML(bootstrap)
}

var dynamicForwardProxyCacheConfig = &envoy_common_dynamic_forward_proxy.DnsCacheConfig{

                  ids:
                  - authenticated:
                      principalName:
                        exact: spiffe://not-principal
  shadowRulesStatPrefix: istio_dry_run_allow_

                orIds:
                  ids:
                  - directRemoteIp:
                      addressPrefix: 9.0.0.1
                      prefixLen: 32
  shadowRulesStatPrefix: istio_ext_authz_

					},
				},
				{ // valid http route patch
					Patch: &networking.EnvoyFilter_Patch{
						Operation: networking.EnvoyFilter_Patch_MERGE,
						Value:     buildPatchStruct(`{"statPrefix": "bar"}`),
					},
					Match: &networking.EnvoyFilter_EnvoyConfigObjectMatch{
						Proxy: &networking.EnvoyFilter_ProxyMatch{ProxyVersion: `foobar`},
					},
					ApplyTo: networking.EnvoyFilter_HTTP_ROUTE,