# Deny all requests to namespace foo
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-nothing
  namespace: foo
spec:
  {}
---
# Deny all requests to namespace default
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-nothing
  namespace: default
spec:
  {}
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-from-istio-system
  namespace: foo
spec:
  action: ALLOW
  rules:
    - from:
        - source:
            namespaces: ["istio-ingress"]
        - source:
            principals: ["cluster.local/ns/istio-ingress/sa/myistio-ingressgateway-service-account%"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-head-from-default
  namespace: foo
spec:
  action: ALLOW
  rules:
    - from:
        - source:
            namespaces: ["default"]
        - source:
            principals: ["cluster.local/ns/default/sa/istio-helloworld-sa"]
      to:
      - operation:
          methods: ["HEAD"]
          notPaths: ["/secret*"]
---