length: 32
      - address: WqgKAA==
        length: 24
- rules:
  - matches:
    - destinationPorts:
      - 91
      - 92
      notDestinationPorts:
      - 9001
      - 9002
name: allow

John Howard <******@****.***> 1709232034 -0800

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        principals: [ "principal", "principal-prefix-*", "*-suffix-principal", "*" ]
        notPrincipals: [ "not-principal", "not-principal-prefix-*", "*-suffix-not-principal", "*" ]
  - from:
    - source:

metadata:
  name: {{ .To.ServiceName }}
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  action: ALLOW
  rules:
    - to:
        - operation: # HTTP
            ports: [ "{{ (.To.PortForName `http`).WorkloadPort }}", "{{ (.To.PortForName `http2`).WorkloadPort }}" ]
            paths: [ "/allow" ]
            methods: [ "GET" ]
      from:
        - source:
            namespaces: [ "{{ .Allowed.NamespaceName }}" ]

metadata:
  name: {{ .To.ServiceName }}
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  action: ALLOW
  rules:
    - to:
        - operation: # HTTP
            ports: [ "{{ (.To.PortForName `http`).WorkloadPort }}", "{{ (.To.PortForName `http2`).WorkloadPort }}" ]
            paths: [ "/allow" ]
            methods: [ "GET" ]
      from:
        - source:

Xiaopeng Han <******@****.***> 1678121866 +0800

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[allow-none]-rule[0]:
        permissions:
        - notRule:
            any: true
        principals:
        - notId:
            any: true

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin-deny
  namespace: foo
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        requestPrincipals: ["id-1"]
    to:
    - operation:
        methods: ["GET"]
  - from:
    - source:
        namespaces: ["ns-1"]
    to:
    - operation:

John Howard <******@****.***> 1709232034 -0800

Jackie Elliott <******@****.***> 1713578333 -0700