kind: AuthorizationPolicy
metadata:
  name: {{ .To.ServiceName }}-allow
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  action: ALLOW
  rules:
    - to:
      - operation:

metadata:
  name: allow-policy
spec:
  action: ALLOW
  selector:
    matchLabels:
      "istio": {{.GatewayIstioLabel | default "ingressgateway"}}
  rules:
  - to:
    - operation:
        notPorts: ["100"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-policy
spec:
  action: DENY
  selector:
    matchLabels:

    to:
    - operation:
        methods: ["method"]
        hosts: ["exact.com"]
        ports: ["80"]
        paths: ["/exact"]
        notMethods: ["not-method"]
        notHosts: ["not-exact.com"]
        notPorts: ["8000"]
        notPaths: ["/not-exact"]
    when:
      - key: "request.headers[X-header]"
        values: ["header"]
        notValues: ["not-header"]
      - key: "source.ip"
        values: ["10.10.10.10"]

            methods: ["method"]
            hosts: ["exact.com"]
            ports: ["80"]
            paths: ["/exact"]
            notMethods: ["not-method"]
            notHosts: ["not-exact.com"]
            notPorts: ["8000"]
            notPaths: ["/not-exact"]
      when:
        - key: "request.headers[X-header]"
          values: ["header"]

            notMethods: ["not-method", "not-method-prefix-*", "*-not-suffix-method", "*"]
            notHosts: ["not-exact.com", "*.not-suffix.com", "not-prefix.*", "*"]
            notPorts: ["8000", "9000"]
            notPaths: ["/not-exact", "/not-prefix/*", "*/not-suffix", "*", "/not-path/template/{*}", "/{**}/not-path/template"]
      when:
        - key: "request.headers[X-header]"

                            field.
                          items:
                            type: string
                          type: array
                        notPorts:
                          description: NotPorts is the negated version of the Ports
                            field. Since only some protocols have ports, if any ports
                            are specified it requires the Protocol match in the Rule

                            field.
                          items:
                            type: string
                          type: array
                        notPorts:
                          description: NotPorts is the negated version of the Ports
                            field. Since only some protocols have ports, if any ports
                            are specified it requires the Protocol match in the Rule

    - operation:
        hosts: ["exact.com", "*.suffix.com", "prefix.*", "*"]
        notHosts: ["not-exact.com", "*.not-suffix.com", "not-prefix.*", "*"]
  - to:
    - operation:
        ports: ["80", "90"]
        notPorts: ["800", "900"]
  - to:
    - operation:
        paths: ["/exact", "/prefix/*", "*/suffix", "*"]
        notPaths: ["/not-exact", "/not-prefix/*", "*/not-suffix", "*"]
  - when:
    - key: "request.headers[X-header]"

- source:
    requestPrincipals: ["td-1/ns/foo/sa/sleep-3"]
    notRequestPrincipals: ["td-1/ns/foo/sa/sleep-4"]
to:
- operation:
    ports: ["8001"]
    notPorts: ["8002"]
- operation:
    ports: ["8003"]
    notPorts: ["8004"]
when:
- key: "source.principal"
  values: ["td-1/ns/foo/sa/httpbin-1"]
  notValues: ["td-1/ns/foo/sa/httpbin-2"]
- key: "destination.ip"
  values: ["10.0.0.1"]

    to:
    - operation:
        methods: ["method"]
        hosts: ["exact.com"]
        ports: ["80"]
        paths: ["/exact"]
        notMethods: ["not-method"]
        notHosts: ["not-exact.com"]
        notPorts: ["8000"]
        notPaths: ["/not-exact"]
    when:
      - key: "request.headers[X-header]"
        values: ["header"]
        notValues: ["not-header"]
      - key: "source.ip"
        values: ["10.10.10.10"]