spec: `
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/{{.Namespace}}/sa/{{.Source}}", "cluster.local/ns/{{.Namespace}}/sa/{{.WaypointName}}"]
`,
				},
				{
					name:  "not allow",
					check: CheckDeny,
					spec: `
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/something/sa/else"]
          `,
				},
			}

		}))})

	// Now add a rule allowing a specific source principal to the workload AuthorizationPolicy
	s.addPolicy(t, selectorPolicyName, testNS, map[string]string{"app": "a"}, gvk.AuthorizationPolicy, func(c controllers.Object) {
		pol := c.(*clientsecurityv1beta1.AuthorizationPolicy)
		pol.Spec.Rules = []*auth.Rule{
			{
				From: []*auth.Rule_From{{Source: &auth.Source{Principals: []string{"cluster.local/ns/ns1/sa/sa1"}}}},
			},
		}

						},
						{
							path:  "/source-namespace-notValues",
							allow: allow,
						},

						// Test source principal
						{
							path:  "/source-principal",
							allow: allow,
						},
						{
							path:  "/source-principal-notValues",
							allow: allow,
						},

						// Test destination IP
						{
							path:  "/destination-ip-good",

	public final fun -deprecated_localCertificates ()Ljava/util/List;
	public final fun -deprecated_localPrincipal ()Ljava/security/Principal;
	public final fun -deprecated_peerCertificates ()Ljava/util/List;
	public final fun -deprecated_peerPrincipal ()Ljava/security/Principal;
	public final fun -deprecated_tlsVersion ()Lokhttp3/TlsVersion;
	public final fun cipherSuite ()Lokhttp3/CipherSuite;

            final String providerUrl, final String principal, final String credntials) {
        final Hashtable<String, String> env = new Hashtable<>();
        putEnv(env, Context.INITIAL_CONTEXT_FACTORY, initialContextFactory);
        putEnv(env, Context.SECURITY_AUTHENTICATION, securityAuthentication);
        putEnv(env, Context.PROVIDER_URL, providerUrl);
        putEnv(env, Context.SECURITY_PRINCIPAL, principal);

  // 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
  // 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
  //   See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
  // 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the

	//  For example, a variable named 'foo' can be accessed as 'variables.foo'
	// - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
	//   See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
	// - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the

  // 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
  // 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
  //   See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
  // 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the

	//   For example, a variable named 'foo' can be accessed as 'variables.foo'.
	// - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
	//   See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
	// - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the

	//   For example, a variable named 'foo' can be accessed as 'variables.foo'.
	// - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
	//   See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
	// - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the