binding.yaml

apiGroup: security.knative.dev/v1alpha1
kind: PolicyBinding
metadata:
  name: green-service
spec:
  policy: green-policy
  targets:
  - apiGroup: serving.knative.dev/v1
    kind: Service
    selector:
      matchExpressions:  # Matcrh all services except those labelled with access=exposed
      - {key: access, operator: NotIn, values: [exposed]}
  - apiGroup: eventing.knative.dev/v1beta1
    kind: Broker
    name: x-broker