<p>I have an application running on K8s/istio in <code>foo</code> namespace. I don't have any Authorization Policy and everything works as expected. Now I want to ALLOW access to a specific path only from within <code>bar</code> namespace. So I created an AuthorizationPolicy as follow:</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-specific-path
  namespace: foo
spec:
  selector:
    matchLabels:
      app: myapp
  action: DENY
  rules:
    - to:
      - operation:
          paths: [&quot;/specific/path/*&quot;]
    - from:
      - source:
          notNamespaces: [&quot;bar&quot;]
</code></pre>
<p>My understanding is the above AP should only allow access to <code>/specific/path/*</code> path from <code>bar</code> namespace. Any other path access should not get affected and work as before. But this causes other paths in my application to be denied including accessing home page <code>/home</code> of the app. What is wrong here? appreciate any help.</p>

Nisman
<blockquote>
<p>My understanding is the above AP should only allow access to /specific/path/* path from bar namespace.</p>
</blockquote>
<p>This is not correct, because of the list of elements in your <code>rules</code> section. You have two rules here.</p>
<pre><code>  rules:
    - to:
      - operation:
          paths: [&quot;/specific/path/*&quot;]
    - from:
      - source:
          notNamespaces: [&quot;bar&quot;]
</code></pre>
<p>The first rule applies to requests targeting <code>/specific/path/*</code> and the second rule applies to requests coming from anywhere except the <code>bar</code> namespace.</p>
<p>Each element in a list or <code>rules</code> is OR'd together. It sounds like you want to AND these two rules together, so try removing the <code>-</code> from the second one (making it into one rule with a <code>from</code> and <code>to</code> clause).</p>
