crementally.</p><ol><li><p>Run the following command to create a <code>deny-all</code> policy in the <code>default</code> namespace.
The policy doesn&rsquo;t have a <code>selector</code> field, which applies the policy to every workload in the
<code>default</code> namespace. The <code>spec:</code> field of the policy has the empty value <code>{}</code>.
That value means that no traffic is permitted, effectively denying all requests.</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ k