istio-ext-authz-ns[foo]-policy[httpbin-deny]-rule[5]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - destinationPort: 80
            - notRule:
                orRules:
                  rules:
                  - destinationPort: 8000
        principals:
        - andIds:
            ids:
            - orIds:
                ids:

				Rules: permission,
			},
		},
	}
}

func permissionNot(permission *rbacpb.Permission) *rbacpb.Permission {
	return &rbacpb.Permission{
		Rule: &rbacpb.Permission_NotRule{
			NotRule: permission,
		},
	}
}

func permissionDestinationIP(cidr *core.CidrRange) *rbacpb.Permission {
	return &rbacpb.Permission{
		Rule: &rbacpb.Permission_DestinationIp{
			DestinationIp: cidr,
		},
	}
}

	"istio.io/istio/pkg/maps"
	"istio.io/istio/pkg/wellknown"
)

var rbacPolicyMatchNever = &rbacpb.Policy{
	Permissions: []*rbacpb.Permission{{Rule: &rbacpb.Permission_NotRule{
		NotRule: &rbacpb.Permission{Rule: &rbacpb.Permission_Any{Any: true}},
	}}},
	Principals: []*rbacpb.Principal{{Identifier: &rbacpb.Principal_NotId{
		NotId: &rbacpb.Principal{Identifier: &rbacpb.Principal_Any{Any: true}},
	}}},
}

	return true
}

// noteRule is an easy way to track if a rule is matched when writing
// new ones.  Make the rule of interest also conditional on
//
//	noteRule("note to self: rule of interest matched")
//
// and that message will print when the rule matches.
func noteRule(s string) bool {
	fmt.Println(s)
	return true
}