apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: deny-external-token-endpoints
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  action: DENY
  rules:
    - to:
        - operation:
            paths:
              - /api/token/user/*
              - /internal/*