apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: {{ .To.ServiceName }}
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  action: DENY
  rules:
    - to:
        - operation: # HTTP
            ports: [ "{{ (.To.PortForName `http`).WorkloadPort }}", "{{ (.To.PortForName `http2`).WorkloadPort }}" ]
            paths: [ "/deny*" ]
            notPaths: ["/deny/allow"]
            methods: [ "GET" ]
      from:
        - source:
            principals: [ "{{ .Denied.SpiffeIdentity }}" ]
    - to:
        - operation: # GRPC
            ports: [ "{{ (.To.PortForName `grpc`).WorkloadPort }}" ]
            paths: [ "/proto.EchoTestService/Echo" ]
            methods: [ "POST" ]
      from:
        - source:
            principals: [ "{{ .Denied.SpiffeIdentity }}" ]
    - to:
        - operation: # TCP
            ports: [ "{{ (.To.PortForName `tcp`).WorkloadPort }}" ]
      from:
        - source:
            principals: [ "{{ .Denied.SpiffeIdentity }}" ]
