apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: {{ .To.ServiceName }}-deny
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  action: DENY
  rules:
    - from:
      - source:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test
spec:
  replicas: 3
  selector:
    matchLabels:
      name: test
  template:
    metadata:
      labels:
        name: test
    spec:
      containers:
      - name: nginx

kind: WasmPlugin
metadata:
  name: {{ .WasmPluginName }}
  {{- if .WasmPluginVersion }}
  annotations:
    wasmPluginVersion: {{ .WasmPluginVersion }}
  {{- end }}
spec:
  phase: STATS
  selector:
    matchLabels:
      app: {{ .TargetAppName }}
  {{- if .TestWasmModuleURL }}
  url: {{ .TestWasmModuleURL }}
  {{- end }}
  imagePullSecret: reg-cred
  {{- if .ImagePullPolicy }}
  imagePullPolicy: {{ .ImagePullPolicy }}

apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: valid
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  url: oci://private-registry:5000/openid-connect/openid:latest
  imagePullPolicy: IfNotPresent
  imagePullSecret: private-registry-pull-secret
  phase: AUTHN
  pluginConfig:
    openid_server: authn

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: strict-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:

apiVersion: apps/v1
ind: Deployment
metadata:
  name: nginx2-deployment
  labels:
    app: nginx2-deployment
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx2
  template:
    metadata:
      labels:
        app: nginx2
    spec:
      containers:
      - name: nginx
        image: registry.k8s.io/nginx:1.7.9
        ports:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx1-deployment
  labels:
    app: nginx1-deployment
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx1
  template:
    metadata:
      labels:
        app: nginx1
    spec:
      containers:
      - name: nginx
        image: registry.k8s.io/nginx:1.7.9
        ports:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: traffic
spec:
  replicas: 7
  selector:
    matchLabels:
      app: traffic
  template:
    metadata:
      labels:
        app: traffic
    spec:
      containers:
        - name: traffic
          image: "fake.docker.io/google-samples/traffic-go-gke:1.0"
          ports:
            - name: http

apiVersion: apps/v1
kind: Deployment
metadata:
  name: invalid-nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  replicas: 4
  foo: bar
  baz: baq
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin
  namespace: foo
spec:
  selector:
    matchLabels:
      app: httpbin
      version: v1
  rules:
    - from:
        - source:
            namespaces: ["istio-system"]
      when:
        - key: "source.principal"