groups:
- rules:
  - matches:
    - notPrincipals:
      - exact: not-principal
      - prefix: not-principal-prefix-
      - suffix: -suffix-not-principal
      - presence: {}
      principals:
      - exact: principal
      - prefix: principal-prefix-
      - suffix: -suffix-principal
      - presence: {}
- rules:
  - matches:
    - notServiceAccounts:
      - namespace: ns
        serviceAccount: sa-not
      - namespace: cfg
        serviceAccount: sa-not-only
      serviceAccounts:
      - namespace: ns
        serviceAccount: sa
      - namespace: cfg
        serviceAccount: sa-only
- rules:
  - matches:
    - namespaces:
      - exact: ns
      - prefix: ns-prefix-
      - suffix: -ns-suffix
      - presence: {}
      notNamespaces:
      - exact: not-ns
      - prefix: not-ns-prefix-
      - suffix: -not-ns-suffix
      - presence: {}
- rules:
  - matches:
    - notSourceIps:
      - address: AgIDBA==
        length: 32
      - address: BgYAAA==
        length: 16
      sourceIps:
      - address: AQIDBA==
        length: 32
      - address: BQYAAA==
        length: 16
- rules:
  - matches:
    - destinationPorts:
      - 80
      - 90
      notDestinationPorts:
      - 800
      - 900
- rules:
  - matches:
    - notSourceIps:
      - address: WgoKCg==
        length: 32
      - address: WqgKAA==
        length: 24
      sourceIps:
      - address: CgoKCg==
        length: 32
      - address: wKgKAA==
        length: 24
- rules:
  - matches:
    - namespaces:
      - exact: ns
      - prefix: ns-prefix-
      - suffix: -ns-suffix
      - presence: {}
      notNamespaces:
      - exact: not-ns
      - prefix: not-ns-prefix-
      - suffix: -not-ns-suffix
      - presence: {}
- rules:
  - matches:
    - notPrincipals:
      - exact: not-principal
      - prefix: not-principal-prefix-
      - suffix: -not-suffix-principal
      - presence: {}
      principals:
      - exact: principal
      - prefix: principal-prefix-
      - suffix: -suffix-principal
      - presence: {}
- rules:
  - matches:
    - destinationIps:
      - address: CgoKCg==
        length: 32
      - address: wKgKAA==
        length: 24
      notDestinationIps:
      - address: WgoKCg==
        length: 32
      - address: WqgKAA==
        length: 24
- rules:
  - matches:
    - destinationPorts:
      - 91
      - 92
      notDestinationPorts:
      - 9001
      - 9002
name: allow
namespace: cfg
scope: NAMESPACE
