- suffix: -ns-suffix
      - presence: {}
      notNamespaces:
      - exact: not-ns
      - prefix: not-ns-prefix-
      - suffix: -not-ns-suffix
      - presence: {}
- rules:
  - matches:
    - notSourceIps:
      - address: AgIDBA==
        length: 32
      - address: BgYAAA==
        length: 16
      sourceIps:
      - address: AQIDBA==
        length: 32
      - address: BQYAAA==
        length: 16

    - {}
- rules:
  - matches:
    - namespaces:
      - exact: when-l4-l7-ns
  - matches:
    - {}
- rules:
  - matches:
    - namespaces:
      - exact: when-l4-ns
  - matches:
    - notSourceIps:
      - address: FBQUFA==
        length: 32
      sourceIps:
      - address: CgoKCg==
        length: 32
- rules:
  - matches:
    - {}
  - matches:
    - {}
name: groups-deny

	Principals          []StringMatch `json:"principals,omitempty"`
	NotPrincipals       []StringMatch `json:"notPrincipals,omitempty"`
	SourceIps           []string      `json:"sourceIps,omitempty"`
	NotSourceIps        []string      `json:"notSourceIps,omitempty"`
	DestinationIps      []string      `json:"destinationIps,omitempty"`
	NotDestinationIps   []string      `json:"notDestinationIps,omitempty"`

			// L7 policies never match for ALLOW
			// For DENY they will always match, so it is more restrictive
			return nil
		}
		match := &security.Match{
			SourceIps:     stringToIP(op.IpBlocks),
			NotSourceIps:  stringToIP(op.NotIpBlocks),
			Namespaces:    stringToMatch(op.Namespaces),
			NotNamespaces: stringToMatch(op.NotNamespaces),
			Principals:    stringToMatch(op.Principals),

	SourceIps           []*Address     `protobuf:"bytes,5,rep,name=source_ips,json=sourceIps,proto3" json:"source_ips,omitempty"`
	NotSourceIps        []*Address     `protobuf:"bytes,6,rep,name=not_source_ips,json=notSourceIps,proto3" json:"not_source_ips,omitempty"`
	DestinationIps      []*Address     `protobuf:"bytes,7,rep,name=destination_ips,json=destinationIps,proto3" json:"destination_ips,omitempty"`