ml>apiVersion: &quot;rbac.istio.io/v1alpha1&quot;
kind: ServiceRole
metadata:
  name: products-viewer
  namespace: default
spec:
  rules:
  - services: [&quot;products.svc.cluster.local&quot;]
    methods: [&quot;GET&quot;, &quot;HEAD&quot;]
    constraints:
    - key: &quot;destination.labels[version]&quot;
      values: [&quot;v1&quot;, &quot;v2&quot;]
</code></pre><p>A ServiceRoleBinding specification includes two parts:</p><ul><li>The <code>roleRef</code> field that refers to a ServiceRole object in the