hosts: ["exact.com"]
            ports: ["80"]
            paths: ["/exact"]
            notMethods: ["not-method"]
            notHosts: ["not-exact.com"]
            notPorts: ["8000"]
            notPaths: ["/not-exact"]
      when:
        - key: "request.headers[X-header]"
          values: ["header"]

    matchLabels:
      app: httpbin
      version: v1
  rules:
    - to:
        - operation:
            paths: ["/exact", "/prefix/*", "*/suffix", "*", "/path/template/{*}", "/{**}/path/template"]

  rules:
    - to:
        - operation: # HTTP
            ports: [ "{{ (.To.PortForName `http`).WorkloadPort }}", "{{ (.To.PortForName `http2`).WorkloadPort }}" ]
            paths: [ "/deny*" ]
            notPaths: ["/deny/allow"]
            methods: [ "GET" ]
      from:
        - source:
            principals: [ "{{ .Denied.ServiceAccountName }}" ]
    - to:
        - operation: # GRPC

        # traffic is TCP, the policy will attempt to be as restrictive as
        # possible and block all traffic through the eastwest-gateway.
        ports: [ "18080", "18085" ]
        paths: ["/global-deny*"]
        notPaths: ["/global-deny/allow"]

  rules:
    - to:
        - operation: # HTTP
            ports: [ "{{ (.To.PortForName `http`).WorkloadPort }}", "{{ (.To.PortForName `http2`).WorkloadPort }}" ]
            paths: [ "/deny*" ]
            notPaths: ["/deny/allow"]
            methods: [ "GET" ]
      from:
        - source:
            namespaces: [ "{{ .Denied.NamespaceName }}" ]
    - to:
        - operation: # GRPC

        methods: ["method"]
        hosts: ["exact.com"]
        ports: ["80"]
        paths: ["/exact"]
        notMethods: ["not-method"]
        notHosts: ["not-exact.com"]
        notPorts: ["8000"]
        notPaths: ["/not-exact"]
    when:
      - key: "request.headers[X-header]"
        values: ["header"]
        notValues: ["not-header"]
      - key: "source.ip"
        values: ["10.10.10.10"]

            notMethods: ["not-method", "not-method-prefix-*", "*-not-suffix-method", "*"]
            notHosts: ["not-exact.com", "*.not-suffix.com", "not-prefix.*", "*"]
            notPorts: ["8000", "9000"]
            notPaths: ["/not-exact", "/not-prefix/*", "*/not-suffix", "*", "/not-path/template/{*}", "/{**}/not-path/template"]
      when:
        - key: "request.headers[X-header]"

  - to:
    - operation:
        ports: ["80", "90"]
        notPorts: ["800", "900"]
  - to:
    - operation:
        paths: ["/exact", "/prefix/*", "*/suffix", "*"]
        notPaths: ["/not-exact", "/not-prefix/*", "*/not-suffix", "*"]
  - when:
    - key: "request.headers[X-header]"
      values: ["header", "header-prefix-*", "*-suffix-header", "*"]

        methods: ["method"]
        hosts: ["exact.com"]
        ports: ["80"]
        paths: ["/exact"]
        notMethods: ["not-method"]
        notHosts: ["not-exact.com"]
        notPorts: ["8000"]
        notPaths: ["/not-exact"]
    when:
      - key: "request.headers[X-header]"
        values: ["header"]
        notValues: ["not-header"]
      - key: "source.ip"
        values: ["10.10.10.10"]

		merged := basePermission.copy()
		if o := to.Operation; o != nil {
			merged.insertFront(destPortGenerator{}, attrDestPort, o.Ports, o.NotPorts)
			merged.insertFront(pathGenerator{}, pathMatcher, o.Paths, o.NotPaths)
			merged.insertFront(methodGenerator{}, methodHeader, o.Methods, o.NotMethods)
			merged.insertFront(hostGenerator{}, hostHeader, o.Hosts, o.NotHosts)
		}
		m.permissions = append(m.permissions, merged)
	}