<p>I’ve been testing istio (1.6) authorization policies and would like to confirm the following:</p>

<ol>
<li>Can I use k8s service names as shown below where <code>httpbin.bar</code> is the service name for deployment/workload httpbin:</li>
</ol>

<pre><code>   - to:
     - operation:
         hosts: ["httpbin.bar"]
</code></pre>

<ol start="2">
<li>I have the following rule; only ALLOW access to the <code>httpbin.bar</code> service from service account <code>sleep</code> in <code>foo</code> namespace.</li>
</ol>

<pre><code>---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: whitelist-httpbin-bar
  namespace: bar
  action: ALLOW 
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/foo/sa/sleep"]
  - to:
    - operation:
        hosts: ["httpbin.bar"]
</code></pre>

<p>I setup 2 services; <code>httpbin.bar</code> and <code>privatehttpbin.bar</code>. My assumption was that it would block access to <code>privatehttpbin.bar</code> but this is not the case. On a side note, I deliberately avoided adding <code>selector.matchLabels</code> because as far as I can tell the rule should only succeed for <code>httpbin.bar</code>.</p>

<p>The docs state:</p>

<blockquote>
  <p>A match occurs when at least one source, operation and condition matches the request.</p>
</blockquote>

<p>as per <a href="https://istio.io/latest/docs/reference/config/security/authorization-policy/#Rule" rel="nofollow noreferrer">here</a>.</p>

<p>I interpreted that AND logic will apply to the <code>source</code> and <code>operation</code>. </p>

<p>Would appreciate if I can find out why this may not be working or if my understanding needs to be corrected.</p>

kaizenCoder
<p>With your <code>AuthorizationPolicy</code> object, you have two rules in the namespace bar:</p>

<ul>
<li>Allow any request coming from <code>foo</code> namespace; with service account <code>sleep</code> to any service.</li>
<li>Allow any request to <code>httpbin</code> service; from any namespace, with any service account.</li>
</ul>

<p>So it is an OR, you are applying.</p>

<p>If you want and AND to be applied; meaning allow any request from the namespace <code>foo</code> with service account <code>sleep</code> to talk to the service <code>httpbin</code>, in the namespace bar, you need to apply the following rule:</p>

<pre><code>apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: whitelist-httpbin-bar
  namespace: bar
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/foo/sa/sleep"]
    to:                     # &lt;- remove the dash (-) from here
    - operation:
        hosts: ["httpbin.bar"]
</code></pre>
