groups:
- rules:
  - matches:
    - notPrincipals:
      - exact: not-principal
      - prefix: not-principal-prefix-
      - suffix: -suffix-not-principal
      - presence: {}
      principals:
      - exact: principal
      - prefix: principal-prefix-
      - suffix: -suffix-principal
      - presence: {}
- rules:
  - matches:
    - namespaces:
      - exact: ns
      - prefix: ns-prefix-
      - suffix: -ns-suffix

action: DENY
groups:
- rules:
  - matches:
    - destinationPorts:
      - 9090
      notPrincipals:
      - presence: {}
name: converted_peer_authentication_disable-strict-mtls

action: DENY
groups:
- rules:
  - matches:
    - destinationPorts:
      - 9090
      notPrincipals:
      - presence: {}
name: converted_peer_authentication_permissive-strict-mtls

action: DENY
groups:
- rules:
  - matches:
    - destinationPorts:
      - 8080
      notPrincipals:
      - presence: {}
name: converted_peer_authentication_strict-mtls

action: DENY
groups:
- rules:
  - matches:
    - notPrincipals:
      - presence: {}
  - matches:
    - notDestinationPorts:
      - 9090
name: converted_peer_authentication_strict-and-disable-mtls

action: DENY
groups:
- rules:
  - matches:
    - notPrincipals:
      - presence: {}
  - matches:
    - notDestinationPorts:
      - 9090
name: converted_peer_authentication_strict-and-permissive-mtls

	Namespaces          []StringMatch `json:"namespaces,omitempty"`
	NotNamespaces       []StringMatch `json:"notNamespaces,omitempty"`
	Principals          []StringMatch `json:"principals,omitempty"`
	NotPrincipals       []StringMatch `json:"notPrincipals,omitempty"`
	SourceIps           []string      `json:"sourceIps,omitempty"`
	NotSourceIps        []string      `json:"notSourceIps,omitempty"`

			NotSourceIps:  stringToIP(op.NotIpBlocks),
			Namespaces:    stringToMatch(op.Namespaces),
			NotNamespaces: stringToMatch(op.NotNamespaces),
			Principals:    stringToMatch(op.Principals),
			NotPrincipals: stringToMatch(op.NotPrincipals),
		}
		fromMatches = append(fromMatches, match)
	}

	rules := []*security.Rules{}
	if len(toMatches) > 0 {
		rules = append(rules, &security.Rules{Matches: toMatches})
	}

  namespace: {{ .To.NamespaceName }}
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  action: DENY
  rules:
    - from:
        - source:
            notPrincipals: [ "*" ]

---
# This configures plaintext for the "To" service from any workload in the namespace.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: {{ .To.ServiceName }}

  - from:
    - source:
        principals: ["principal"]
        requestPrincipals: ["requestPrincipals"]
        namespaces: ["ns"]
        ipBlocks: ["1.2.3.4"]
        remoteIpBlocks: ["10.250.90.4"]
        notPrincipals: ["not-principal"]
        notRequestPrincipals: ["not-requestPrincipals"]
        notNamespaces: ["not-ns"]
        notIpBlocks: ["9.0.0.1"]
        notRemoteIpBlocks: ["10.133.154.65"]
    to:
    - operation: