ty.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: ns-isolation-except-ingress
  namespace: foo
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        namespaces: [&#34;foo&#34;]
    - source:
        principals: [&#34;cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account&#34;]
</code></pre><h2 id=require-mtls-in-authorization-layer-defense-in-depth>Require mTLS in authorization layer (defense in depth)</h2><p>You have configured <code>PeerAuthentication</code> to <code>