apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: httpbin-deny
  namespace: foo
spec:
  action: ALLOW
  rules:
    - from:
        - source:
            requestPrincipals: ["id-1"]
      to:
        - operation:
            methods: ["GET"]
    - from:
        - source:
            namespaces: ["ns-1"]
      to:
        - operation:
            ports: ["8080"]
            methods: ["GET"]
    - from:
        - source:
            namespaces: ["ns-2"]
            requestPrincipals: ["id-2"]
      to:
        - operation:
            ports: ["9090"]
    - from:
        - source:
            namespaces: ["ns-1"]
      to:
        - operation:
            ports: ["80"]
