incipal is <code>cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account</code>.</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: ns-isolation-except-ingress
  namespace: foo
spec:
  action: DENY
  rules:
  - from:
    - source:
        notNamespaces: [&#34;foo&#34;]
        notPrincipals: [&#34;cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account&#34;]
</code></pre></artic