notRemoteIpBlocks: ["192.168.244.139"]
      to:
        - operation:
            methods: ["method"]
            hosts: ["exact.com"]
            ports: ["80"]
            paths: ["/exact"]
            notMethods: ["not-method"]
            notHosts: ["not-exact.com"]
            notPorts: ["8000"]
            notPaths: ["/not-exact"]
      when:
        - key: "request.headers[X-header]"
          values: ["header"]

kind: AuthorizationPolicy
metadata:
  name: {{ .To.ServiceName }}-allow
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  action: ALLOW
  rules:
    - to:
      - operation:

        notRemoteIpBlocks: ["10.133.154.65"]
    to:
    - operation:
        methods: ["method"]
        hosts: ["exact.com"]
        ports: ["80"]
        paths: ["/exact"]
        notMethods: ["not-method"]
        notHosts: ["not-exact.com"]
        notPorts: ["8000"]
        notPaths: ["/not-exact"]
    when:
      - key: "request.headers[X-header]"
        values: ["header"]

            hosts: ["exact.com", "*.suffix.com", "prefix.*", "*"]
            ports: ["80", "90"]
            paths: ["/exact", "/prefix/*", "*/suffix", "*", "/path/template/{*}", "/{**}/path/template"]
            notMethods: ["not-method", "not-method-prefix-*", "*-not-suffix-method", "*"]
            notHosts: ["not-exact.com", "*.not-suffix.com", "not-prefix.*", "*"]
            notPorts: ["8000", "9000"]

        remoteIpBlocks: [ "1.2.3.4", "5.6.0.0/16" ]
        notRemoteIpBlocks: [ "2.2.3.4", "6.6.0.0/16" ]
  - to:
    - operation:
        methods: ["method", "method-prefix-*", "*-suffix-method", "*"]
        notMethods: ["not-method", "not-method-prefix-*", "*-suffix-not-method", "*"]
  - to:
    - operation:
        hosts: ["exact.com", "*.suffix.com", "prefix.*", "*"]

        notRemoteIpBlocks: ["192.168.244.139"]
    to:
    - operation:
        methods: ["method"]
        hosts: ["exact.com"]
        ports: ["80"]
        paths: ["/exact"]
        notMethods: ["not-method"]
        notHosts: ["not-exact.com"]
        notPorts: ["8000"]
        notPaths: ["/not-exact"]
    when:
      - key: "request.headers[X-header]"
        values: ["header"]

			merged.insertFront(destPortGenerator{}, attrDestPort, o.Ports, o.NotPorts)
			merged.insertFront(pathGenerator{}, pathMatcher, o.Paths, o.NotPaths)
			merged.insertFront(methodGenerator{}, methodHeader, o.Methods, o.NotMethods)
			merged.insertFront(hostGenerator{}, hostHeader, o.Hosts, o.NotHosts)
		}
		m.permissions = append(m.permissions, merged)
	}
	if len(r.To) == 0 {
		m.permissions = append(m.permissions, basePermission)
	}

	toMatches := []*security.Match{}
	for _, to := range rule.To {
		op := to.Operation
		if action == security.Action_ALLOW && anyNonEmpty(op.Hosts, op.NotHosts, op.Methods, op.NotMethods, op.Paths, op.NotPaths) {
			// L7 policies never match for ALLOW
			// For DENY they will always match, so it is more restrictive
			return nil
		}
		match := &security.Match{

					errs = appendErrors(errs, security.CheckEmptyValues("Hosts", op.Hosts))
					errs = appendErrors(errs, security.CheckEmptyValues("NotPorts", op.NotPorts))
					errs = appendErrors(errs, security.CheckEmptyValues("NotMethods", op.NotMethods))
					errs = appendErrors(errs, security.CheckEmptyValues("NotPaths", op.NotPaths))
					errs = appendErrors(errs, security.CheckEmptyValues("NotHosts", op.NotHosts))

						},
					},
				},
			},
			valid: false,
		},
		{
			name: "NotMethods-empty",
			in: &security_beta.AuthorizationPolicy{
				Rules: []*security_beta.Rule{
					{
						To: []*security_beta.Rule_To{
							{
								Operation: &security_beta.Operation{
									NotMethods: []string{"GET", ""},
								},
							},
						},
					},
				},
			},