<p>i tried to create a firewall rule in k8s istio with &quot;istio-system&quot; ns, <br />
and i have a services within different ns. <br />
i need to create firewall rule with istio ingress that block all requests Besides &quot;POST&quot; requests.
i tried to create new rule in firewall like that:</p>
<pre><code>apiVersion: security.istio.io/v1beta1 
kind: AuthorizationPolicy 
metadata: 
   name: deny-all
   namespace: istio-system  
spec: 
  {}
</code></pre>
<p>and that really block all the requests and after that i tried to apply this rule:</p>
<pre><code>apiVersion: security.istio.io/v1beta1 
kind: AuthorizationPolicy 
metadata:  
  name: httpbin   
  namespace: test 
spec:  
  action: ALLOW  
  selector:    
    matchLabels: 
      app: test  
 rules:    
   to:
    - operation:
        hosts: [&quot;https://ABCD.xxx.ddd&quot;]
        methods: [&quot;POST&quot;]
        paths: [&quot;/*&quot;]
</code></pre>
<p>and that not successed <br />
To my current understanding, I can't block services that are on one namespace, <br />
using firewall rules as part of istio (within different ns) that is on another namespace. <br />
My question is is it possible to do this, and if so how?</p>

Saar Wintrov
<blockquote>
<p>i need to create firewall rule with istio ingress that block all requests Besides &quot;POST&quot; requests</p>
</blockquote>
<p>Maybe just create one authorization policy which deny every single one of them besides POST?</p>
<hr />
<p>I have made an example which does allow only GET requests and deny rest. Take a look.</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin
  namespace: istio-system
spec:
  action: DENY
  selector:
    matchLabels:
      istio: ingressgateway
  rules:
  - to:
    - operation:
        methods: [&quot;POST&quot;, &quot;HEAD&quot;, &quot;PUT&quot;, &quot;DELETE&quot;, &quot;CONNECT&quot;, &quot;OPTIONS&quot;, &quot;TRACE&quot;, &quot;PATCH&quot;]
</code></pre>
<p>And some tests</p>
<pre><code>root@httpbin-779c54bf49-s6g6r:/# curl http://xx.xx.xxx.xxx/productpage -X GET -s -o /dev/null -w &quot;%{http_code}\n&quot;
200
root@httpbin-779c54bf49-s6g6r:/# curl http://xx.xx.xxx.xxx/productpage -X POST -s -o /dev/null -w &quot;%{http_code}\n&quot;
403
root@httpbin-779c54bf49-s6g6r:/# curl http://xx.xx.xxx.xxx/productpage -X PUT -s -o /dev/null -w &quot;%{http_code}\n&quot;
403
</code></pre>
<hr />
<p>Related documentation about AuthorizationPolicy:</p>
<ul>
<li><a href="https://istio.io/latest/docs/reference/config/security/authorization-policy/" rel="nofollow noreferrer">https://istio.io/latest/docs/reference/config/security/authorization-policy/</a></li>
<li><a href="https://istio.io/latest/docs/tasks/security/authorization/authz-http/" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/security/authorization/authz-http/</a></li>
<li><a href="https://istio.io/latest/docs/tasks/security/authorization/authz-deny/" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/security/authorization/authz-deny/</a></li>
</ul>
<hr />
<p>Let me know if you have any more questions.</p>
