apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: payments-api-only-frontend
  namespace: payments-mesh
spec:
  selector:
    matchLabels:
      app: payments-api
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/web-mesh/sa/frontend"]
    to:
    - operation:
        ports: ["8080"]