-2
$ istioctl install -y -f - &lt;&lt;EOF
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: usergroup-2
spec:
  profile: minimal
  revision: usergroup-2
  meshConfig:
    discoverySelectors:
      - matchLabels:
          usergroup: usergroup-2
  values:
    global:
      istioNamespace: usergroup-2
    pilot:
      env:
        ENABLE_ENHANCED_RESOURCE_SCOPING: true
EOF
</code></pre></li><li><p>Deploy a policy for workloads in the <code>usergroup-1</code> namespace to only ac