s:
    - key: &#34;destination.labels[visibility]”
      values: [&#34;external&#34;]
---
apiVersion: &#34;rbac.istio.io/v1alpha1&#34;
kind: ServiceRoleBinding
metadata:
  name: external-api-caller
  namespace: backend
spec:
  subjects:
  - properties:
      source.namespace: &#34;frontend”
  roleRef:
    kind: ServiceRole
    name: &#34;external-api-caller&#34;
</code></pre><p>The <code>ServiceRole</code> and <code>ServiceRoleBinding</code> above expressed &ldquo;<em>who</em> is allowed to do <em>what<