# istio_deny-groups-in.yaml
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: groups-deny
spec:
  action: DENY
  rules:
  # Has mix of L4 and L7 in from
  - from:
    - source:
        principals: ["from-mix-principal"]
        requestPrincipals: ["from-mix-requestPrincipals"]
        namespaces: ["from-mix-ns"]
    to:
    - operation:
        ports: ["80"]
  # Has mix of L4 and L7 in to
  - from:
    - source:
        principals: ["to-mix-principal"]
        namespaces: ["to-mix-ns"]
    to:
    - operation:
        ports: ["80"]
        methods: ["to-mix-method"]
  # Only L4
  - from:
    - source:
        principals: ["only-l4-principals"]
        namespaces: ["only-l4-ns"]
    to:
    - operation:
        ports: ["80"]
  # Only L7
  - from:
    - source:
        requestPrincipals: ["l7-principal"]
    to:
    - operation:
        paths: ["/l7-foo"]
        methods: ["l7-method"]
  # L4 and L7 when
  - when:
    - key: "source.namespace"
      values: ["when-l4-l7-ns"]
    - key: "connection.sni"
      values: [ "when-l4-l7-sni"]
  # L4 only when
  - when:
    - key: "source.namespace"
      values: ["when-l4-ns"]
    - key: "source.ip"
      values: ["10.10.10.10"]
      notValues: ["20.20.20.20"]
  # L7 only when
  - when:
    - key: "connection.sni"
      values: [ "when-l7-sni"]
    - key: "request.headers[X-header]"
      values: ["when-l7-header"]