       - name: opa-policy
          secret:
            secretName: opa-policy
EOF
</code></pre></div><div hidden id=tabset-blog-2021-better-external-authz-1-1-panel role=tabpanel tabindex=0 aria-labelledby=tabset-blog-2021-better-external-authz-1-1-tab><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl apply -f - &lt;&lt;EOF
apiVersion: v1
kind: Service
metadata:
  name: opa
  labels:
    app: opa
spec:
  ports:
  - name: grpc
    port: 9191
    targetPort: 9191
  selector:
    