"key": "istio_dry_run_deny_shadow_effective_policy_id"
                                    }
                                  ]
                                }
                              }
                            },
                            {
                              "tag": "istio.authorization.dry_run.deny_policy.result",
                              "metadata": {

                                      "key": "istio_dry_run_deny_shadow_effective_policy_id"
                                    }
                                  ]
                                }
                              }
                            },
                            {
                              "tag": "istio.authorization.dry_run.deny_policy.result",
                              "metadata": {

            properties:
              action:
                description: |-
                  Optional.

                  Valid Options: ALLOW, DENY, AUDIT, CUSTOM
                enum:
                - ALLOW
                - DENY
                - AUDIT
                - CUSTOM
                type: string
              provider:

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "stable-channel-default-policy-binding.istio.io"
spec:
  policyName: "stable-channel-default-policy.istio.io"
  validationActions: [Deny]

					addPolicy(action, anonymousName, "0")
				}
			}
		}
	}

	buf := strings.Builder{}
	buf.WriteString("ACTION\tAuthorizationPolicy\tRULES\n")
	for _, action := range []rbacpb.RBAC_Action{rbacpb.RBAC_DENY, rbacpb.RBAC_ALLOW, rbacpb.RBAC_LOG} {
		if names, ok := actionToPolicy[action]; ok {
			sortedNames := make([]string, 0, len(names))
			for name := range names {
				sortedNames = append(sortedNames, name)
			}

access control on workloads. See more details at: https://istio.io/docs/reference/config/security/authorization-policy.html' oneOf: - not: anyOf: - required: - provider - required: - provider properties: action: description: Optional. enum: - ALLOW - DENY - AUDIT - CUSTOM type: string provider: description: Specifies detailed configuration of the CUSTOM action. properties: name: description: Specifies the name of the extension provider. type: string type: object rules: description: Optional. items:...

                                      "key": "istio_dry_run_deny_shadow_effective_policy_id"
                                    }
                                  ]
                                }
                              }
                            },
                            {
                              "tag": "istio.authorization.dry_run.deny_policy.result",
                              "metadata": {

              {
               "tag": "istio.authorization.dry_run.deny_policy.name",
               "metadata": {
                "kind": {
                 "request": {}
                },
                "metadata_key": {
                 "key": "envoy.filters.http.rbac",
                 "path": [
                  {
                   "key": "istio_dry_run_deny_shadow_effective_policy_id"
                  }

spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: STRICT
  portLevelMtls:
    9090:
      mode: PERMISSIVE
```

will be translated into this `Authorization`:

```yaml
action: DENY
groups:
- rules:
  - matches:
    - notPrincipals:
      - presence: {}
- rules:
  - matches:
    - notDestinationPorts:
      - 9090
name: converted_peer_authentication_strict-and-permissive-mtls

            properties:
              action:
                description: |-
                  Optional.

                  Valid Options: ALLOW, DENY, AUDIT, CUSTOM
                enum:
                - ALLOW
                - DENY
                - AUDIT
                - CUSTOM
                type: string
              provider: