apiVersion: "config.istio.io/v1alpha2"
kind: denier
metadata:
  name: deny-testapp-db
spec:
  status:
    code: 7
    message: Not allowed
---
apiVersion: "config.istio.io/v1alpha2"
kind: checknothing
metadata:
  name: deny-testapp-db
spec:
---
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
  name: deny-testapp-db
spec:
  match: destination.labels["app"] == "testapp-db"
  actions:
  - handler: deny-testapp-db.denier
    instances: [ deny-testapp-db.checknothing ]