- key: "request.auth.principal"
          values: ["requestPrincipals", "requestPrincipals-prefix-*", "*-suffix-requestPrincipals", "*", "https://example.com/*"]
          notValues: ["not-requestPrincipals", "not-requestPrincipals-prefix-*", "*-not-suffix-requestPrincipals", "*"]
        - key: "request.auth.audiences"
          values: ["audiences", "audiences-prefix-*", "*-suffix-audiences", "*"]

        requestPrincipals: ["requestPrincipals"]
        namespaces: ["ns", "*ns-suffix", "ns-prefix*", "*"]
        ipBlocks: ["1.2.3.4"]
        remoteIpBlocks: ["172.18.4.0/22"]
        notPrincipals: ["not-principal", "*not-principal-suffix", "not-principal-prefix*", "*"]
        notRequestPrincipals: ["not-requestPrincipals"]

                      stringMatch:
                        exact: requestPrincipals
                - metadata:
                    filter: istio_authn
                    path:
                    - key: request.auth.principal
                    value:
                      stringMatch:
                        prefix: requestPrincipals-prefix-
                - metadata:
                    filter: istio_authn

  - from:
    - source:
        requestPrincipals: [ "requestPrincipals", "requestPrincipals-prefix-*", "*-suffix-requestPrincipals", "*" ]
        notRequestPrincipals: [ "not-requestPrincipals", "not-requestPrincipals-prefix-*", "*-suffix-not-requestPrincipals", "*" ]
  - from:
    - source:
        namespaces: [ "ns", "ns-prefix-*", "*-ns-suffix", "*" ]

kind: AuthorizationPolicy
metadata:
  name: groups-deny
spec:
  action: DENY
  rules:
  # Has mix of L4 and L7 in from
  - from:
    - source:
        principals: ["from-mix-principal"]
        requestPrincipals: ["from-mix-requestPrincipals"]
        namespaces: ["from-mix-ns"]
    to:
    - operation:
        ports: ["80"]
  # Has mix of L4 and L7 in to
  - from:
    - source:
        principals: ["to-mix-principal"]

{{- end }}
    from:
    - source:
        requestPrincipals: ["******@****.***/sub-1"]
    - source:
        requestPrincipals: ["******@****.***/sub-1"]
  - to:
    - operation:
        hosts:
  {{- range $svc := .Services }}
        - "any-request-principal-ok.{{ $svc.ServiceName }}.com"
  {{- end }}
    from:
    - source:
        requestPrincipals: ["*"]
  - to:
    - operation:

{{- end }}
    from:
    - source:
        requestPrincipals: ["******@****.***/sub-1"]
    - source:
        requestPrincipals: ["******@****.***/sub-1"]
  - to:
    - operation:
        hosts:
  {{- range $svc := .Services }}
        - "any-request-principal-ok.{{ $svc.ServiceName }}.com"
  {{- end }}
    from:
    - source:
        requestPrincipals: ["*"]
  - to:
    - operation:

                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            exact: requestPrincipals
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub

kind: AuthorizationPolicy
metadata:
  name: groups
spec:
  rules:
  # Has mix of L4 and L7 in from
  - from:
    - source:
        principals: ["from-mix-principal"]
        requestPrincipals: ["from-mix-requestPrincipals"]
        namespaces: ["from-mix-ns"]
    to:
    - operation:
        ports: ["80"]
  # Has mix of L4 and L7 in to
  - from:
    - source:
        principals: ["to-mix-principal"]

    - from:
        - source:
            requestPrincipals: ["id-1"]
      to:
        - operation:
            methods: ["GET"]
    - from:
        - source:
            namespaces: ["ns-1"]
      to:
        - operation:
            ports: ["8080"]
            methods: ["GET"]
    - from:
        - source:
            namespaces: ["ns-2"]
            requestPrincipals: ["id-2"]
      to:
        - operation: