name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin-1]-rule[0]:
        permissions:
        - andRules:
            rules:
            - any: true
        principals:
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: spiffe://.+/ns/my-ns/(.+/|)sa/my-sa(/.+)?
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: spiffe://.+/ns/foo/(.+/|)sa/sa-only(/.+)?
            - notId:
                orIds:
                  ids:
                  - authenticated:
                      principalName:
                        safeRegex:
                          regex: spiffe://.+/ns/my-ns/(.+/|)sa/my-sa-not(/.+)?
                  - authenticated:
                      principalName:
                        safeRegex:
                          regex: spiffe://.+/ns/foo/(.+/|)sa/sa-not-only(/.+)?
      ns[foo]-policy[httpbin-1]-rule[1]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - header:
                    name: :authority
                    stringMatch:
                      exact: exact.com
                      ignoreCase: true
                - header:
                    name: :authority
                    stringMatch:
                      ignoreCase: true
                      suffix: .suffix.com
                - header:
                    name: :authority
                    stringMatch:
                      ignoreCase: true
                      prefix: prefix.
                - header:
                    name: :authority
                    presentMatch: true
            - notRule:
                orRules:
                  rules:
                  - header:
                      name: :authority
                      stringMatch:
                        exact: not-exact.com
                        ignoreCase: true
                  - header:
                      name: :authority
                      stringMatch:
                        ignoreCase: true
                        suffix: .not-suffix.com
                  - header:
                      name: :authority
                      stringMatch:
                        ignoreCase: true
                        prefix: not-prefix.
                  - header:
                      name: :authority
                      presentMatch: true
            - orRules:
                rules:
                - header:
                    name: :method
                    stringMatch:
                      exact: method
                - header:
                    name: :method
                    stringMatch:
                      prefix: method-prefix-
                - header:
                    name: :method
                    stringMatch:
                      suffix: -suffix-method
                - header:
                    name: :method
                    presentMatch: true
            - notRule:
                orRules:
                  rules:
                  - header:
                      name: :method
                      stringMatch:
                        exact: not-method
                  - header:
                      name: :method
                      stringMatch:
                        prefix: not-method-prefix-
                  - header:
                      name: :method
                      stringMatch:
                        suffix: -not-suffix-method
                  - header:
                      name: :method
                      presentMatch: true
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /exact
                - urlPath:
                    path:
                      prefix: /prefix/
                - urlPath:
                    path:
                      suffix: /suffix
                - urlPath:
                    path:
                      safeRegex:
                        regex: .+
                - uriTemplate:
                    name: uri-template
                    typedConfig:
                      '@type': type.googleapis.com/envoy.extensions.path.match.uri_template.v3.UriTemplateMatchConfig
                      pathTemplate: /path/template/*
                - uriTemplate:
                    name: uri-template
                    typedConfig:
                      '@type': type.googleapis.com/envoy.extensions.path.match.uri_template.v3.UriTemplateMatchConfig
                      pathTemplate: /**/path/template
            - notRule:
                orRules:
                  rules:
                  - urlPath:
                      path:
                        exact: /not-exact
                  - urlPath:
                      path:
                        prefix: /not-prefix/
                  - urlPath:
                      path:
                        suffix: /not-suffix
                  - urlPath:
                      path:
                        safeRegex:
                          regex: .+
                  - uriTemplate:
                      name: uri-template
                      typedConfig:
                        '@type': type.googleapis.com/envoy.extensions.path.match.uri_template.v3.UriTemplateMatchConfig
                        pathTemplate: /not-path/template/*
                  - uriTemplate:
                      name: uri-template
                      typedConfig:
                        '@type': type.googleapis.com/envoy.extensions.path.match.uri_template.v3.UriTemplateMatchConfig
                        pathTemplate: /**/not-path/template
            - orRules:
                rules:
                - destinationPort: 80
                - destinationPort: 90
            - notRule:
                orRules:
                  rules:
                  - destinationPort: 8000
                  - destinationPort: 9000
            - orRules:
                rules:
                - destinationIp:
                    addressPrefix: 10.10.10.10
                    prefixLen: 32
                - destinationIp:
                    addressPrefix: 192.168.10.0
                    prefixLen: 24
            - notRule:
                orRules:
                  rules:
                  - destinationIp:
                      addressPrefix: 90.10.10.10
                      prefixLen: 32
                  - destinationIp:
                      addressPrefix: 90.168.10.0
                      prefixLen: 24
            - orRules:
                rules:
                - destinationPort: 91
                - destinationPort: 92
            - notRule:
                orRules:
                  rules:
                  - destinationPort: 9001
                  - destinationPort: 9002
            - orRules:
                rules:
                - requestedServerName:
                    exact: exact.com
                - requestedServerName:
                    suffix: .suffix.com
                - requestedServerName:
                    prefix: prefix.
                - requestedServerName:
                    safeRegex:
                      regex: .+
            - notRule:
                orRules:
                  rules:
                  - requestedServerName:
                      exact: not-exact.com
                  - requestedServerName:
                      suffix: .not-suffix.com
                  - requestedServerName:
                      prefix: not-prefix.
                  - requestedServerName:
                      safeRegex:
                        regex: .+
            - metadata:
                filter: envoy.filters.a.b
                path:
                - key: c
                value:
                  orMatch:
                    valueMatchers:
                    - stringMatch:
                        exact: exact
                    - stringMatch:
                        prefix: prefix-
                    - stringMatch:
                        suffix: -suffix
                    - stringMatch:
                        safeRegex:
                          regex: .+
            - notRule:
                metadata:
                  filter: envoy.filters.a.b
                  path:
                  - key: c
                  value:
                    orMatch:
                      valueMatchers:
                      - stringMatch:
                          exact: not-exact
                      - stringMatch:
                          prefix: not-prefix-
                      - stringMatch:
                          suffix: -not-suffix
                      - stringMatch:
                          safeRegex:
                            regex: .+
        principals:
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://principal
                - authenticated:
                    principalName:
                      prefix: spiffe://principal-prefix-
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: spiffe://.*-suffix-principal
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .+
            - notId:
                orIds:
                  ids:
                  - authenticated:
                      principalName:
                        exact: spiffe://not-principal
                  - authenticated:
                      principalName:
                        prefix: spiffe://not-principal-prefix-
                  - authenticated:
                      principalName:
                        safeRegex:
                          regex: spiffe://.*-not-suffix-principal
                  - authenticated:
                      principalName:
                        safeRegex:
                          regex: .+
            - orIds:
                ids:
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            exact: requestPrincipals
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            exact: ""
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            prefix: requestPrincipals-prefix-
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            safeRegex:
                              regex: .+
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            safeRegex:
                              regex: .+
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            suffix: -suffix-requestPrincipals
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            safeRegex:
                              regex: .+
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            safeRegex:
                              regex: .+
            - notId:
                orIds:
                  ids:
                  - andIds:
                      ids:
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: iss
                          value:
                            stringMatch:
                              exact: not-requestPrincipals
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: sub
                          value:
                            stringMatch:
                              exact: ""
                  - andIds:
                      ids:
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: iss
                          value:
                            stringMatch:
                              prefix: not-requestPrincipals-prefix-
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: sub
                          value:
                            stringMatch:
                              safeRegex:
                                regex: .+
                  - andIds:
                      ids:
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: iss
                          value:
                            stringMatch:
                              safeRegex:
                                regex: .+
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: sub
                          value:
                            stringMatch:
                              suffix: -not-suffix-requestPrincipals
                  - andIds:
                      ids:
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: iss
                          value:
                            stringMatch:
                              safeRegex:
                                regex: .+
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: sub
                          value:
                            stringMatch:
                              safeRegex:
                                regex: .+
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/ns/.*
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/ns-prefix-.*/.*
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/.*-ns-suffix/.*
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/.*/.*
            - notId:
                orIds:
                  ids:
                  - authenticated:
                      principalName:
                        safeRegex:
                          regex: .*/ns/not-ns/.*
                  - authenticated:
                      principalName:
                        safeRegex:
                          regex: .*/ns/not-ns-prefix-.*/.*
                  - authenticated:
                      principalName:
                        safeRegex:
                          regex: .*/ns/.*-not-ns-suffix/.*
                  - authenticated:
                      principalName:
                        safeRegex:
                          regex: .*/ns/.*/.*
            - orIds:
                ids:
                - remoteIp:
                    addressPrefix: 1.2.3.4
                    prefixLen: 32
                - remoteIp:
                    addressPrefix: 5.6.0.0
                    prefixLen: 16
            - notId:
                orIds:
                  ids:
                  - remoteIp:
                      addressPrefix: 9.0.0.1
                      prefixLen: 32
                  - remoteIp:
                      addressPrefix: 9.2.0.0
                      prefixLen: 16
            - orIds:
                ids:
                - directRemoteIp:
                    addressPrefix: 1.2.3.4
                    prefixLen: 32
                - directRemoteIp:
                    addressPrefix: 5.6.0.0
                    prefixLen: 16
            - notId:
                orIds:
                  ids:
                  - directRemoteIp:
                      addressPrefix: 9.0.0.1
                      prefixLen: 32
                  - directRemoteIp:
                      addressPrefix: 9.2.0.0
                      prefixLen: 16
            - orIds:
                ids:
                - header:
                    name: X-header
                    stringMatch:
                      exact: header
                - header:
                    name: X-header
                    stringMatch:
                      prefix: header-prefix-
                - header:
                    name: X-header
                    stringMatch:
                      suffix: -suffix-header
                - header:
                    name: X-header
                    presentMatch: true
            - notId:
                orIds:
                  ids:
                  - header:
                      name: X-header
                      stringMatch:
                        exact: not-header
                  - header:
                      name: X-header
                      stringMatch:
                        prefix: not-header-prefix-
                  - header:
                      name: X-header
                      stringMatch:
                        suffix: -not-suffix-header
                  - header:
                      name: X-header
                      presentMatch: true
            - orIds:
                ids:
                - directRemoteIp:
                    addressPrefix: 10.10.10.10
                    prefixLen: 32
                - directRemoteIp:
                    addressPrefix: 192.168.10.0
                    prefixLen: 24
            - notId:
                orIds:
                  ids:
                  - directRemoteIp:
                      addressPrefix: 90.10.10.10
                      prefixLen: 32
                  - directRemoteIp:
                      addressPrefix: 90.168.10.0
                      prefixLen: 24
            - orIds:
                ids:
                - remoteIp:
                    addressPrefix: 10.10.10.10
                    prefixLen: 32
                - remoteIp:
                    addressPrefix: 192.168.10.0
                    prefixLen: 24
            - notId:
                orIds:
                  ids:
                  - remoteIp:
                      addressPrefix: 90.10.10.10
                      prefixLen: 32
                  - remoteIp:
                      addressPrefix: 90.168.10.0
                      prefixLen: 24
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/ns/.*
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/ns-prefix-.*/.*
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/.*-ns-suffix/.*
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/.*/.*
            - notId:
                orIds:
                  ids:
                  - authenticated:
                      principalName:
                        safeRegex:
                          regex: .*/ns/not-ns/.*
                  - authenticated:
                      principalName:
                        safeRegex:
                          regex: .*/ns/not-ns-prefix-.*/.*
                  - authenticated:
                      principalName:
                        safeRegex:
                          regex: .*/ns/.*-not-ns-suffix/.*
                  - authenticated:
                      principalName:
                        safeRegex:
                          regex: .*/ns/.*/.*
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://principal
                - authenticated:
                    principalName:
                      prefix: spiffe://principal-prefix-
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: spiffe://.*-suffix-principal
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .+
            - notId:
                orIds:
                  ids:
                  - authenticated:
                      principalName:
                        exact: spiffe://not-principal
                  - authenticated:
                      principalName:
                        prefix: spiffe://not-principal-prefix-
                  - authenticated:
                      principalName:
                        safeRegex:
                          regex: spiffe://.*-not-suffix-principal
                  - authenticated:
                      principalName:
                        safeRegex:
                          regex: .+
            - orIds:
                ids:
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            exact: requestPrincipals
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            exact: ""
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            prefix: requestPrincipals-prefix-
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            safeRegex:
                              regex: .+
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            safeRegex:
                              regex: .+
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            suffix: -suffix-requestPrincipals
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            safeRegex:
                              regex: .+
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            safeRegex:
                              regex: .+
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            exact: https://example.com
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            safeRegex:
                              regex: .+
            - notId:
                orIds:
                  ids:
                  - andIds:
                      ids:
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: iss
                          value:
                            stringMatch:
                              exact: not-requestPrincipals
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: sub
                          value:
                            stringMatch:
                              exact: ""
                  - andIds:
                      ids:
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: iss
                          value:
                            stringMatch:
                              prefix: not-requestPrincipals-prefix-
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: sub
                          value:
                            stringMatch:
                              safeRegex:
                                regex: .+
                  - andIds:
                      ids:
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: iss
                          value:
                            stringMatch:
                              safeRegex:
                                regex: .+
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: sub
                          value:
                            stringMatch:
                              suffix: -not-suffix-requestPrincipals
                  - andIds:
                      ids:
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: iss
                          value:
                            stringMatch:
                              safeRegex:
                                regex: .+
                      - metadata:
                          filter: envoy.filters.http.jwt_authn
                          path:
                          - key: payload
                          - key: sub
                          value:
                            stringMatch:
                              safeRegex:
                                regex: .+
            - metadata:
                filter: envoy.filters.http.jwt_authn
                path:
                - key: payload
                - key: aud
                value:
                  orMatch:
                    valueMatchers:
                    - listMatch:
                        oneOf:
                          orMatch:
                            valueMatchers:
                            - stringMatch:
                                exact: audiences
                            - stringMatch:
                                prefix: audiences-prefix-
                            - stringMatch:
                                suffix: -suffix-audiences
                            - stringMatch:
                                safeRegex:
                                  regex: .+
                    - orMatch:
                        valueMatchers:
                        - stringMatch:
                            exact: audiences
                        - stringMatch:
                            prefix: audiences-prefix-
                        - stringMatch:
                            suffix: -suffix-audiences
                        - stringMatch:
                            safeRegex:
                              regex: .+
            - notId:
                metadata:
                  filter: envoy.filters.http.jwt_authn
                  path:
                  - key: payload
                  - key: aud
                  value:
                    orMatch:
                      valueMatchers:
                      - listMatch:
                          oneOf:
                            orMatch:
                              valueMatchers:
                              - stringMatch:
                                  exact: not-audiences
                              - stringMatch:
                                  prefix: not-audiences-prefix-
                              - stringMatch:
                                  suffix: -not-suffix-audiences
                              - stringMatch:
                                  safeRegex:
                                    regex: .+
                      - orMatch:
                          valueMatchers:
                          - stringMatch:
                              exact: not-audiences
                          - stringMatch:
                              prefix: not-audiences-prefix-
                          - stringMatch:
                              suffix: -not-suffix-audiences
                          - stringMatch:
                              safeRegex:
                                regex: .+
            - metadata:
                filter: envoy.filters.http.jwt_authn
                path:
                - key: payload
                - key: azp
                value:
                  orMatch:
                    valueMatchers:
                    - listMatch:
                        oneOf:
                          orMatch:
                            valueMatchers:
                            - stringMatch:
                                exact: presenter
                            - stringMatch:
                                prefix: presenter-prefix-
                            - stringMatch:
                                suffix: -suffix-presenter
                            - stringMatch:
                                safeRegex:
                                  regex: .+
                    - orMatch:
                        valueMatchers:
                        - stringMatch:
                            exact: presenter
                        - stringMatch:
                            prefix: presenter-prefix-
                        - stringMatch:
                            suffix: -suffix-presenter
                        - stringMatch:
                            safeRegex:
                              regex: .+
            - notId:
                metadata:
                  filter: envoy.filters.http.jwt_authn
                  path:
                  - key: payload
                  - key: azp
                  value:
                    orMatch:
                      valueMatchers:
                      - listMatch:
                          oneOf:
                            orMatch:
                              valueMatchers:
                              - stringMatch:
                                  exact: not-presenter
                              - stringMatch:
                                  prefix: not-presenter-prefix-
                              - stringMatch:
                                  suffix: -not-suffix-presenter
                              - stringMatch:
                                  safeRegex:
                                    regex: .+
                      - orMatch:
                          valueMatchers:
                          - stringMatch:
                              exact: not-presenter
                          - stringMatch:
                              prefix: not-presenter-prefix-
                          - stringMatch:
                              suffix: -not-suffix-presenter
                          - stringMatch:
                              safeRegex:
                                regex: .+
            - metadata:
                filter: envoy.filters.http.jwt_authn
                path:
                - key: payload
                - key: iss
                value:
                  orMatch:
                    valueMatchers:
                    - listMatch:
                        oneOf:
                          orMatch:
                            valueMatchers:
                            - stringMatch:
                                exact: iss
                            - stringMatch:
                                prefix: iss-prefix-
                            - stringMatch:
                                suffix: -suffix-iss
                            - stringMatch:
                                safeRegex:
                                  regex: .+
                    - orMatch:
                        valueMatchers:
                        - stringMatch:
                            exact: iss
                        - stringMatch:
                            prefix: iss-prefix-
                        - stringMatch:
                            suffix: -suffix-iss
                        - stringMatch:
                            safeRegex:
                              regex: .+
            - notId:
                metadata:
                  filter: envoy.filters.http.jwt_authn
                  path:
                  - key: payload
                  - key: iss
                  value:
                    orMatch:
                      valueMatchers:
                      - listMatch:
                          oneOf:
                            orMatch:
                              valueMatchers:
                              - stringMatch:
                                  exact: not-iss
                              - stringMatch:
                                  prefix: not-iss-prefix-
                              - stringMatch:
                                  suffix: -not-suffix-iss
                              - stringMatch:
                                  safeRegex:
                                    regex: .+
                      - orMatch:
                          valueMatchers:
                          - stringMatch:
                              exact: not-iss
                          - stringMatch:
                              prefix: not-iss-prefix-
                          - stringMatch:
                              suffix: -not-suffix-iss
                          - stringMatch:
                              safeRegex:
                                regex: .+
            - metadata:
                filter: envoy.filters.http.jwt_authn
                path:
                - key: payload
                - key: nested1
                - key: nested2
                value:
                  orMatch:
                    valueMatchers:
                    - listMatch:
                        oneOf:
                          orMatch:
                            valueMatchers:
                            - stringMatch:
                                exact: nested
                            - stringMatch:
                                prefix: nested-prefix-
                            - stringMatch:
                                suffix: -suffix-nested
                            - stringMatch:
                                safeRegex:
                                  regex: .+
                    - orMatch:
                        valueMatchers:
                        - stringMatch:
                            exact: nested
                        - stringMatch:
                            prefix: nested-prefix-
                        - stringMatch:
                            suffix: -suffix-nested
                        - stringMatch:
                            safeRegex:
                              regex: .+
            - notId:
                metadata:
                  filter: envoy.filters.http.jwt_authn
                  path:
                  - key: payload
                  - key: nested1
                  - key: nested2
                  value:
                    orMatch:
                      valueMatchers:
                      - listMatch:
                          oneOf:
                            orMatch:
                              valueMatchers:
                              - stringMatch:
                                  exact: not-nested
                              - stringMatch:
                                  prefix: not-nested-prefix-
                              - stringMatch:
                                  suffix: -not-suffix-nested
                              - stringMatch:
                                  safeRegex:
                                    regex: .+
                      - orMatch:
                          valueMatchers:
                          - stringMatch:
                              exact: not-nested
                          - stringMatch:
                              prefix: not-nested-prefix-
                          - stringMatch:
                              suffix: -not-suffix-nested
                          - stringMatch:
                              safeRegex:
                                regex: .+
  shadowRulesStatPrefix: istio_dry_run_allow_
