apiVersion: v1
kind: Pod
metadata:
  name: target
  namespace: istio-vt-t06
  labels:
    app: target
  annotations:
    sidecar.istio.io/inject: "false"
spec:
  containers:
  - name: http
    image: hashicorp/http-echo:0.2.3
    args: ["-text=target-ok", "-listen=:8080"]
    ports:
    - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: target
  namespace: istio-vt-t06
spec:
  selector:
    app: target
  ports:
  - port: 8080
    targetPort: 8080
---
apiVersion: v1
kind: Pod
metadata:
  name: trusted-caller
  namespace: istio-vt-t06
  labels:
    app: trusted-caller
    role: trusted
  annotations:
    sidecar.istio.io/inject: "false"
spec:
  containers:
  - name: curl
    image: curlimages/curl:8.14.1
    command: ["sleep", "infinity"]
---
apiVersion: v1
kind: Pod
metadata:
  name: other-caller
  namespace: istio-vt-t06
  labels:
    app: other-caller
    role: other
  annotations:
    sidecar.istio.io/inject: "false"
spec:
  containers:
  - name: curl
    image: curlimages/curl:8.14.1
    command: ["sleep", "infinity"]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: target-allow-trusted-only
  namespace: istio-vt-t06
spec:
  podSelector:
    matchLabels:
      app: target
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: trusted