portLevelMtls:
    {{ (.To.PortForName `http`).WorkloadPort }}:
      mode: {{ .MTLSModeOverride }}
    {{ (.To.PortForName `http2`).WorkloadPort }}:
      mode: {{ .MTLSModeOverride }}
    {{ (.To.PortForName `https`).WorkloadPort }}:
      mode: {{ .MTLSModeOverride }}
    {{ (.To.PortForName `tcp`).WorkloadPort }}:
      mode: {{ .MTLSModeOverride }}
    {{ (.To.PortForName `grpc`).WorkloadPort }}:

        - operation: # HTTP
            ports: [ "{{ (.To.PortForName `http`).WorkloadPort }}", "{{ (.To.PortForName `http2`).WorkloadPort }}" ]
            paths: [ "/allow" ]
            methods: [ "GET" ]
      from:
        - source:
            namespaces: [ "{{ .Allowed.NamespaceName }}" ]
    - to:
        - operation: # GRPC
            ports: [ "{{ (.To.PortForName `grpc`).WorkloadPort }}" ]

            ports: [ "{{ (.To.PortForName `http`).WorkloadPort }}", "{{ (.To.PortForName `http2`).WorkloadPort }}" ]
            paths: [ "/deny*" ]
            notPaths: ["/deny/allow"]
            methods: [ "GET" ]
      from:
        - source:
            principals: [ "{{ .Denied.ServiceAccountName }}" ]
    - to:
        - operation: # GRPC
            ports: [ "{{ (.To.PortForName `grpc`).WorkloadPort }}" ]

            ports: [ "{{ (.To.PortForName `http`).WorkloadPort }}", "{{ (.To.PortForName `http2`).WorkloadPort }}" ]
            paths: [ "/deny*" ]
            notPaths: ["/deny/allow"]
            methods: [ "GET" ]
      from:
        - source:
            namespaces: [ "{{ .Denied.NamespaceName }}" ]
    - to:
        - operation: # GRPC
            ports: [ "{{ (.To.PortForName `grpc`).WorkloadPort }}" ]

  provider:
    name: "{{ .Provider.Name }}"
  rules:
  - to:
    - operation: # HTTP
        ports: [ "{{ (.To.PortForName `http`).WorkloadPort }}", "{{ (.To.PortForName `http2`).WorkloadPort }}" ]
        paths: [ "/custom" ]
        methods: [ "GET" ]
  - to:
    - operation: # GRPC
        ports: [ "{{ (.To.PortForName `grpc`).WorkloadPort }}" ]
        paths: [ "/proto.EchoTestService/Echo" ]
        methods: [ "POST" ]
  - to:

        - operation: # HTTP
            ports: [ "{{ (.To.PortForName `http`).WorkloadPort }}", "{{ (.To.PortForName `http2`).WorkloadPort }}" ]
            paths: [ "/allow" ]
            methods: [ "GET" ]
      from:
        - source:
            principals: [ "{{ .Allowed.ServiceAccountName }}" ]
    - to:
        - operation: # GRPC
            ports: [ "{{ (.To.PortForName `grpc`).WorkloadPort }}" ]

kind: PeerAuthentication
metadata:
  name: {{ .To.ServiceName }}-mtls
spec:
  selector:
    matchLabels:
      app: {{ .To.ServiceName }}
  mtls:
    mode: DISABLE
  portLevelMtls:
    {{ (.To.PortForName "tcp-wl-only").WorkloadPort }}:
      mode: STRICT`,
					expected: []expect{
						{
							port:              ports.TCPWorkloadOnly,
							plaintextSucceeds: false,
							mtlsSucceeds:      true,
						},

  - "*.{{ .To.ServiceName }}.com"
  rules:
  - matches:
    - path: 
        type: PathPrefix
        value: /allow
      method: GET
    backendRefs:
    - name: "{{ .To.ServiceName }}"

metadata:
  name: {{ .To.ServiceName }}-allow
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  action: ALLOW
  rules:
    - to:
      - operation:

spec:
  parentRefs:
  - name: {{ .To.ServiceName }}-gateway
  hostnames:
  - "*.{{ .To.ServiceName }}.com"
  rules:
  - backendRefs:
    - name: "{{ .To.ServiceName }}"