action: DENY
groups:
- rules:
  - matches:
    - notDestinationPorts:
      - 9090
  - matches:
    - notPrincipals:
      - presence: {}
name: converted_peer_authentication_workload
namespace: foo
scope: WORKLOAD_SELECTOR
