apiVersion: v1
kind: ConfigMap
metadata:
  name: opa-policy-default
data:
  policy.rego: |
    package istio.authz

    # Deny by default
    default allow = {
      "allowed": deny,
      "reason": "No OPA policy specified"
    }
