2 id=configure-deny-authorization-policy-for-a-tcp-workload>Configure DENY authorization policy for a TCP workload</h2><ol><li><p>Add a DENY policy with HTTP-only fields using the following command:</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl apply -f - &lt;&lt;EOF
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: tcp-policy
  namespace: foo
spec:
  selector:
    matchLabels:
      app: tcp-echo
  action: DENY
  rules:
  - to:
    - operation: