 found in the proxy debug log in the format of <code>shadow denied, matched policy ns[foo]-policy[deny-path-headers]-rule[0]</code>.
Run the following command to check the log:</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl logs &#34;$(kubectl -n foo -l app=httpbin get pods -o jsonpath={.items..metadata.name})&#34; -c istio-proxy -n foo | grep &#34;shadow denied&#34;
2021-11-19T20:20:48.733099Z debug envoy rbac shadow denied, matched policy ns[foo]-policy[deny-path-headers