You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@dubbo.apache.org by al...@apache.org on 2023/03/02 11:28:13 UTC

[dubbo-admin] 02/03: Add crds

This is an automated email from the ASF dual-hosted git repository.

albumenj pushed a commit to branch refactor-with-go
in repository https://gitbox.apache.org/repos/asf/dubbo-admin.git

commit 8e46d622352f3c4100ee1a78a8608b1d53616896
Author: Albumen Kevin <jh...@gmail.com>
AuthorDate: Thu Mar 2 19:27:44 2023 +0800

    Add crds
---
 ca/deploy/crd.yaml                                 | 203 +++++++++++-
 ca/deploy/example-peerauthentication.yaml          |  20 +-
 ca/pkg/apis/dubbo.apache.org/v1beta1/register.go   | 126 ++++++--
 ca/pkg/apis/dubbo.apache.org/v1beta1/type.go       |   3 +-
 .../v1beta1/zz_generated.deepcopy.go               | 346 ++++++++++++++++++---
 ...erauthentication.go => authenticationpolicy.go} |  48 +--
 ...tendconfig.go => authenticationpolicyextend.go} |  14 +-
 .../{rule.go => authenticationpolicyrule.go}       |  18 +-
 .../{source.go => authenticationpolicysource.go}   |  42 +--
 ...ticationspec.go => authenticationpolicyspec.go} |  26 +-
 .../{target.go => authenticationpolicytarget.go}   |  34 +-
 ...eerauthentication.go => authorizationpolicy.go} |  48 +--
 .../v1beta1/authorizationpolicycondition.go        |  66 ++++
 ...xtendconfig.go => authorizationpolicyextend.go} |  14 +-
 ...extendconfig.go => authorizationpolicymatch.go} |  22 +-
 .../{rule.go => authorizationpolicyrule.go}        |  27 +-
 .../{source.go => authorizationpolicysource.go}    |  42 +--
 ...nticationspec.go => authorizationpolicyspec.go} |  32 +-
 .../{target.go => authorizationpolicytarget.go}    |  34 +-
 ca/pkg/generated/applyconfiguration/utils.go       |  40 ++-
 .../v1beta1/authenticationpolicy.go                | 207 ++++++++++++
 .../v1beta1/authorizationpolicy.go                 | 207 ++++++++++++
 .../v1beta1/dubbo.apache.org_client.go             |  11 +-
 .../v1beta1/fake/fake_authenticationpolicy.go      | 153 +++++++++
 .../v1beta1/fake/fake_authorizationpolicy.go       | 153 +++++++++
 .../v1beta1/fake/fake_dubbo.apache.org_client.go   |   8 +-
 .../v1beta1/fake/fake_peerauthentication.go        | 153 ---------
 .../v1beta1/generated_expansion.go                 |   4 +-
 .../dubbo.apache.org/v1beta1/peerauthentication.go | 207 ------------
 ...erauthentication.go => authenticationpolicy.go} |  38 +--
 ...eerauthentication.go => authorizationpolicy.go} |  38 +--
 .../dubbo.apache.org/v1beta1/interface.go          |  17 +-
 .../informers/externalversions/generic.go          |   6 +-
 .../v1beta1/authenticationpolicy.go                |  98 ++++++
 .../v1beta1/authorizationpolicy.go                 |  98 ++++++
 .../v1beta1/expansion_generated.go                 |  20 +-
 .../dubbo.apache.org/v1beta1/peerauthentication.go |  98 ------
 ca/pkg/k8s/client.go                               |   9 +-
 ca/pkg/k8s/controller.go                           | 173 +++++++++--
 ca/pkg/k8s/controller_test.go                      |   3 +-
 ca/pkg/rule/authentication/definition.go           |  51 +--
 ca/pkg/rule/authentication/handler.go              |  27 +-
 ca/pkg/rule/authorization/definition.go            |  71 +++++
 43 files changed, 2195 insertions(+), 860 deletions(-)

diff --git a/ca/deploy/crd.yaml b/ca/deploy/crd.yaml
index 1e51ee8..054008a 100644
--- a/ca/deploy/crd.yaml
+++ b/ca/deploy/crd.yaml
@@ -1,7 +1,7 @@
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
-  name: peerauthentications.dubbo.apache.org
+  name: authenticationpolicies.dubbo.apache.org
 spec:
   group: dubbo.apache.org
   versions:
@@ -150,8 +150,201 @@ spec:
                 - action
   scope: Namespaced
   names:
-    plural: peerauthentications
-    singular: peerauthentication
-    kind: PeerAuthentication
+    plural: authenticationpolicies
+    singular: authenticationpolicy
+    kind: AuthenticationPolicy
     shortNames:
-      - pa
+      - ac
+
+---
+
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: authorizationpolicies.dubbo.apache.org
+spec:
+  group: dubbo.apache.org
+  versions:
+    - name: v1beta1
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                action:
+                  type: string
+                  description: "The action to take when a rule is matched."
+                  enum:
+                    - ALLOW
+                    - DENY
+                    - ADUIT
+                rules:
+                  type: array
+                  items:
+                    type: object
+                    properties:
+                      from:
+                        type: object
+                        description: "The source of the traffic to be matched."
+                        properties:
+                          namespaces:
+                            type: array
+                            description: "The namespaces to match of the source workload."
+                            items:
+                              type: string
+                          notNamespaces:
+                            type: array
+                            description: "The namespaces not to match of the source workload."
+                            items:
+                              type: string
+                          ipBlocks:
+                            type: array
+                            description: "The IP addresses to match of the source workload."
+                            items:
+                              type: string
+                          notIpBlocks:
+                            type: array
+                            description: "The IP addresses not to match of the source workload."
+                            items:
+                              type: string
+                          principals:
+                            type: array
+                            description: "The identities(from spiffe) to match of the source workload."
+                            items:
+                              type: string
+                          notPrincipals:
+                            type: array
+                            description: "The identities(from spiffe) not to match of the source workload."
+                            items:
+                              type: string
+                          extends:
+                            type: array
+                            description: "The extended identities(from Dubbo Auth) to match of the source workload."
+                            items:
+                              type: object
+                              properties:
+                                key:
+                                  type: string
+                                  description: "The key of the extended identity."
+                                value:
+                                  type: string
+                                  description: "The value of the extended identity."
+                          notExtends:
+                            type: array
+                            description: "The extended identities(from Dubbo Auth) not to match of the source workload."
+                            items:
+                              type: object
+                              properties:
+                                key:
+                                  type: string
+                                  description: "The key of the extended identity."
+                                value:
+                                  type: string
+                                  description: "The value of the extended identity."
+                      to:
+                        type: object
+                        description: "The destination of the traffic to be matched."
+                        properties:
+                          ipBlocks:
+                            type: array
+                            description: "The IP addresses to match of the destination workload."
+                            items:
+                              type: string
+                          notIpBlocks:
+                            type: array
+                            description: "The IP addresses not to match of the destination workload."
+                            items:
+                              type: string
+                          principals:
+                            type: array
+                            description: "The identities(from spiffe) to match of the destination workload."
+                            items:
+                              type: string
+                          notPrincipals:
+                            type: array
+                            description: "The identities(from spiffe) not to match of the destination workload."
+                            items:
+                              type: string
+                          extends:
+                            type: array
+                            description: "The extended identities(from Dubbo Auth) to match of the destination workload."
+                            items:
+                              type: object
+                              properties:
+                                key:
+                                  type: string
+                                  description: "The key of the extended identity."
+                                value:
+                                  type: string
+                                  description: "The value of the extended identity."
+                          notExtends:
+                            type: array
+                            description: "The extended identities(from Dubbo Auth) not to match of the destination workload."
+                            items:
+                              type: object
+                              properties:
+                                key:
+                                  type: string
+                                  description: "The key of the extended identity."
+                                value:
+                                  type: string
+                                  description: "The value of the extended identity."
+                      when:
+                        type: object
+                        properties:
+                          key:
+                            type: string
+                          values:
+                            type: array
+                            items:
+                              type: object
+                              properties:
+                                type:
+                                  type: string
+                                  enum:
+                                    - equals
+                                    - regex
+                                    - ognl
+                                  default: equals
+                                value:
+                                  type: string
+                          notValues:
+                            type: array
+                            items:
+                              type: object
+                              properties:
+                                type:
+                                  type: string
+                                  enum:
+                                    - equals
+                                    - regex
+                                    - ognl
+                                  default: equals
+                                value:
+                                  type: string
+                samples:
+                  type: number
+                  description: "The sample rate of the rule. The value is between 0 and 100."
+                  minimum: 0
+                  default: 100
+                  maximum: 100
+                matchType:
+                  type: string
+                  description: "The match type of the rules."
+                  enum:
+                    - anyMatch
+                    - allMatch
+                  default: anyMatch
+              required:
+                - action
+  scope: Namespaced
+  names:
+    plural: authorizationpolicies
+    singular: authorizationpolicy
+    kind: AuthorizationPolicy
+    shortNames:
+      - az
diff --git a/ca/deploy/example-peerauthentication.yaml b/ca/deploy/example-peerauthentication.yaml
index 718ac6b..7af0c80 100644
--- a/ca/deploy/example-peerauthentication.yaml
+++ b/ca/deploy/example-peerauthentication.yaml
@@ -1,5 +1,5 @@
 apiVersion: dubbo.apache.org/v1beta1
-kind: PeerAuthentication
+kind: AuthenticationPolicy
 metadata:
   name: default
   namespace: default
@@ -11,4 +11,20 @@ spec:
         namespaces: ["test"]
       to:
         principals: ["cluster.local/ns/default/sa/sleep"]
-  order: 0
\ No newline at end of file
+  order: 0
+
+---
+apiVersion: dubbo.apache.org/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: default
+  namespace: default
+spec:
+  action: ALLOW
+  rules:
+    - from:
+        principals: ["cluster.local/ns/default/sa/sleep"]
+        namespaces: ["test"]
+      to:
+        principals: ["cluster.local/ns/default/sa/sleep"]
+  samples: 0.12
diff --git a/ca/pkg/apis/dubbo.apache.org/v1beta1/register.go b/ca/pkg/apis/dubbo.apache.org/v1beta1/register.go
index 3aae549..8b2ef90 100644
--- a/ca/pkg/apis/dubbo.apache.org/v1beta1/register.go
+++ b/ca/pkg/apis/dubbo.apache.org/v1beta1/register.go
@@ -22,55 +22,123 @@ import (
 // +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
-type PeerAuthentication struct {
+type AuthenticationPolicy struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
 
-	Spec PeerAuthenticationSpec `json:"spec"`
+	Spec AuthenticationPolicySpec `json:"spec"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
-type PeerAuthenticationList struct {
+type AuthenticationPolicyList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata"`
 
-	Items []PeerAuthentication `json:"items"`
+	Items []AuthenticationPolicy `json:"items"`
 }
 
-type PeerAuthenticationSpec struct {
-	Action    string `json:"action,omitempty"`
-	Rules     []Rule `json:"rules,omitempty"`
-	Order     int    `json:"order,omitempty"`
-	MatchType string `json:"matchType,omitempty"`
+type AuthenticationPolicySpec struct {
+	Action    string                     `json:"action,omitempty"`
+	Rules     []AuthenticationPolicyRule `json:"rules,omitempty"`
+	Order     int                        `json:"order,omitempty"`
+	MatchType string                     `json:"matchType,omitempty"`
 }
 
-type Rule struct {
-	From Source `json:"from,omitempty"`
-	To   Target `json:"to,omitempty"`
+type AuthenticationPolicyRule struct {
+	From AuthenticationPolicySource `json:"from,omitempty"`
+	To   AuthenticationPolicyTarget `json:"to,omitempty"`
 }
 
-type Source struct {
-	Namespaces    []string       `json:"namespaces,omitempty"`
-	NotNamespaces []string       `json:"notNamespaces,omitempty"`
-	IpBlocks      []string       `json:"ipBlocks,omitempty"`
-	NotIpBlocks   []string       `json:"notIpBlocks,omitempty"`
-	Principals    []string       `json:"principals,omitempty"`
-	NotPrincipals []string       `json:"notPrincipals,omitempty"`
-	Extends       []ExtendConfig `json:"extends,omitempty"`
-	NotExtends    []ExtendConfig `json:"notExtends,omitempty"`
+type AuthenticationPolicySource struct {
+	Namespaces    []string                     `json:"namespaces,omitempty"`
+	NotNamespaces []string                     `json:"notNamespaces,omitempty"`
+	IpBlocks      []string                     `json:"ipBlocks,omitempty"`
+	NotIpBlocks   []string                     `json:"notIpBlocks,omitempty"`
+	Principals    []string                     `json:"principals,omitempty"`
+	NotPrincipals []string                     `json:"notPrincipals,omitempty"`
+	Extends       []AuthenticationPolicyExtend `json:"extends,omitempty"`
+	NotExtends    []AuthenticationPolicyExtend `json:"notExtends,omitempty"`
 }
 
-type Target struct {
-	IpBlocks      []string       `json:"ipBlocks,omitempty"`
-	NotIpBlocks   []string       `json:"notIpBlocks,omitempty"`
-	Principals    []string       `json:"principals,omitempty"`
-	NotPrincipals []string       `json:"notPrincipals,omitempty"`
-	Extends       []ExtendConfig `json:"extends,omitempty"`
-	NotExtends    []ExtendConfig `json:"notExtends,omitempty"`
+type AuthenticationPolicyTarget struct {
+	IpBlocks      []string                     `json:"ipBlocks,omitempty"`
+	NotIpBlocks   []string                     `json:"notIpBlocks,omitempty"`
+	Principals    []string                     `json:"principals,omitempty"`
+	NotPrincipals []string                     `json:"notPrincipals,omitempty"`
+	Extends       []AuthenticationPolicyExtend `json:"extends,omitempty"`
+	NotExtends    []AuthenticationPolicyExtend `json:"notExtends,omitempty"`
 }
 
-type ExtendConfig struct {
+type AuthenticationPolicyExtend struct {
+	Key   string `json:"key,omitempty"`
+	Value string `json:"value,omitempty"`
+}
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+type AuthorizationPolicy struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec AuthorizationPolicySpec `json:"spec"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+type AuthorizationPolicyList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+
+	Items []AuthorizationPolicy `json:"items"`
+}
+
+type AuthorizationPolicySpec struct {
+	Action    string                    `json:"action,omitempty"`
+	Rules     []AuthorizationPolicyRule `json:"rules,omitempty"`
+	Samples   float32                   `json:"samples,omitempty"`
+	MatchType string                    `json:"matchType,omitempty"`
+}
+
+type AuthorizationPolicyRule struct {
+	From AuthorizationPolicySource    `json:"from,omitempty"`
+	To   AuthorizationPolicyTarget    `json:"to,omitempty"`
+	When AuthorizationPolicyCondition `json:"when,omitempty"`
+}
+
+type AuthorizationPolicySource struct {
+	Namespaces    []string                    `json:"namespaces,omitempty"`
+	NotNamespaces []string                    `json:"notNamespaces,omitempty"`
+	IpBlocks      []string                    `json:"ipBlocks,omitempty"`
+	NotIpBlocks   []string                    `json:"notIpBlocks,omitempty"`
+	Principals    []string                    `json:"principals,omitempty"`
+	NotPrincipals []string                    `json:"notPrincipals,omitempty"`
+	Extends       []AuthorizationPolicyExtend `json:"extends,omitempty"`
+	NotExtends    []AuthorizationPolicyExtend `json:"notExtends,omitempty"`
+}
+
+type AuthorizationPolicyTarget struct {
+	IpBlocks      []string                    `json:"ipBlocks,omitempty"`
+	NotIpBlocks   []string                    `json:"notIpBlocks,omitempty"`
+	Principals    []string                    `json:"principals,omitempty"`
+	NotPrincipals []string                    `json:"notPrincipals,omitempty"`
+	Extends       []AuthorizationPolicyExtend `json:"extends,omitempty"`
+	NotExtends    []AuthorizationPolicyExtend `json:"notExtends,omitempty"`
+}
+
+type AuthorizationPolicyCondition struct {
+	Key       string                     `json:"key,omitempty"`
+	Values    []AuthorizationPolicyMatch `json:"values,omitempty"`
+	NotValues []AuthorizationPolicyMatch `json:"notValues,omitempty"`
+}
+
+type AuthorizationPolicyMatch struct {
+	Type  string `json:"type,omitempty"`
+	Value string `json:"value,omitempty"`
+}
+
+type AuthorizationPolicyExtend struct {
 	Key   string `json:"key,omitempty"`
 	Value string `json:"value,omitempty"`
 }
diff --git a/ca/pkg/apis/dubbo.apache.org/v1beta1/type.go b/ca/pkg/apis/dubbo.apache.org/v1beta1/type.go
index a5d8071..3e575c2 100644
--- a/ca/pkg/apis/dubbo.apache.org/v1beta1/type.go
+++ b/ca/pkg/apis/dubbo.apache.org/v1beta1/type.go
@@ -44,7 +44,8 @@ var (
 // Adds the list of known types to Scheme.
 func addKnownTypes(scheme *runtime.Scheme) error {
 	scheme.AddKnownTypes(SchemeGroupVersion,
-		&PeerAuthentication{},
+		&AuthenticationPolicy{},
+		&AuthorizationPolicy{},
 	)
 	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
 	return nil
diff --git a/ca/pkg/apis/dubbo.apache.org/v1beta1/zz_generated.deepcopy.go b/ca/pkg/apis/dubbo.apache.org/v1beta1/zz_generated.deepcopy.go
index c100b2c..df27a91 100644
--- a/ca/pkg/apis/dubbo.apache.org/v1beta1/zz_generated.deepcopy.go
+++ b/ca/pkg/apis/dubbo.apache.org/v1beta1/zz_generated.deepcopy.go
@@ -25,23 +25,226 @@ import (
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ExtendConfig) DeepCopyInto(out *ExtendConfig) {
+func (in *AuthenticationPolicy) DeepCopyInto(out *AuthenticationPolicy) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthenticationPolicy.
+func (in *AuthenticationPolicy) DeepCopy() *AuthenticationPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(AuthenticationPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *AuthenticationPolicy) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AuthenticationPolicyExtend) DeepCopyInto(out *AuthenticationPolicyExtend) {
 	*out = *in
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtendConfig.
-func (in *ExtendConfig) DeepCopy() *ExtendConfig {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthenticationPolicyExtend.
+func (in *AuthenticationPolicyExtend) DeepCopy() *AuthenticationPolicyExtend {
 	if in == nil {
 		return nil
 	}
-	out := new(ExtendConfig)
+	out := new(AuthenticationPolicyExtend)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PeerAuthentication) DeepCopyInto(out *PeerAuthentication) {
+func (in *AuthenticationPolicyList) DeepCopyInto(out *AuthenticationPolicyList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]AuthenticationPolicy, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthenticationPolicyList.
+func (in *AuthenticationPolicyList) DeepCopy() *AuthenticationPolicyList {
+	if in == nil {
+		return nil
+	}
+	out := new(AuthenticationPolicyList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *AuthenticationPolicyList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AuthenticationPolicyRule) DeepCopyInto(out *AuthenticationPolicyRule) {
+	*out = *in
+	in.From.DeepCopyInto(&out.From)
+	in.To.DeepCopyInto(&out.To)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthenticationPolicyRule.
+func (in *AuthenticationPolicyRule) DeepCopy() *AuthenticationPolicyRule {
+	if in == nil {
+		return nil
+	}
+	out := new(AuthenticationPolicyRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AuthenticationPolicySource) DeepCopyInto(out *AuthenticationPolicySource) {
+	*out = *in
+	if in.Namespaces != nil {
+		in, out := &in.Namespaces, &out.Namespaces
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.NotNamespaces != nil {
+		in, out := &in.NotNamespaces, &out.NotNamespaces
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.IpBlocks != nil {
+		in, out := &in.IpBlocks, &out.IpBlocks
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.NotIpBlocks != nil {
+		in, out := &in.NotIpBlocks, &out.NotIpBlocks
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Principals != nil {
+		in, out := &in.Principals, &out.Principals
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.NotPrincipals != nil {
+		in, out := &in.NotPrincipals, &out.NotPrincipals
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Extends != nil {
+		in, out := &in.Extends, &out.Extends
+		*out = make([]AuthenticationPolicyExtend, len(*in))
+		copy(*out, *in)
+	}
+	if in.NotExtends != nil {
+		in, out := &in.NotExtends, &out.NotExtends
+		*out = make([]AuthenticationPolicyExtend, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthenticationPolicySource.
+func (in *AuthenticationPolicySource) DeepCopy() *AuthenticationPolicySource {
+	if in == nil {
+		return nil
+	}
+	out := new(AuthenticationPolicySource)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AuthenticationPolicySpec) DeepCopyInto(out *AuthenticationPolicySpec) {
+	*out = *in
+	if in.Rules != nil {
+		in, out := &in.Rules, &out.Rules
+		*out = make([]AuthenticationPolicyRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthenticationPolicySpec.
+func (in *AuthenticationPolicySpec) DeepCopy() *AuthenticationPolicySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(AuthenticationPolicySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AuthenticationPolicyTarget) DeepCopyInto(out *AuthenticationPolicyTarget) {
+	*out = *in
+	if in.IpBlocks != nil {
+		in, out := &in.IpBlocks, &out.IpBlocks
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.NotIpBlocks != nil {
+		in, out := &in.NotIpBlocks, &out.NotIpBlocks
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Principals != nil {
+		in, out := &in.Principals, &out.Principals
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.NotPrincipals != nil {
+		in, out := &in.NotPrincipals, &out.NotPrincipals
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Extends != nil {
+		in, out := &in.Extends, &out.Extends
+		*out = make([]AuthenticationPolicyExtend, len(*in))
+		copy(*out, *in)
+	}
+	if in.NotExtends != nil {
+		in, out := &in.NotExtends, &out.NotExtends
+		*out = make([]AuthenticationPolicyExtend, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthenticationPolicyTarget.
+func (in *AuthenticationPolicyTarget) DeepCopy() *AuthenticationPolicyTarget {
+	if in == nil {
+		return nil
+	}
+	out := new(AuthenticationPolicyTarget)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AuthorizationPolicy) DeepCopyInto(out *AuthorizationPolicy) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
@@ -49,18 +252,18 @@ func (in *PeerAuthentication) DeepCopyInto(out *PeerAuthentication) {
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PeerAuthentication.
-func (in *PeerAuthentication) DeepCopy() *PeerAuthentication {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationPolicy.
+func (in *AuthorizationPolicy) DeepCopy() *AuthorizationPolicy {
 	if in == nil {
 		return nil
 	}
-	out := new(PeerAuthentication)
+	out := new(AuthorizationPolicy)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PeerAuthentication) DeepCopyObject() runtime.Object {
+func (in *AuthorizationPolicy) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -68,13 +271,55 @@ func (in *PeerAuthentication) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PeerAuthenticationList) DeepCopyInto(out *PeerAuthenticationList) {
+func (in *AuthorizationPolicyCondition) DeepCopyInto(out *AuthorizationPolicyCondition) {
+	*out = *in
+	if in.Values != nil {
+		in, out := &in.Values, &out.Values
+		*out = make([]AuthorizationPolicyMatch, len(*in))
+		copy(*out, *in)
+	}
+	if in.NotValues != nil {
+		in, out := &in.NotValues, &out.NotValues
+		*out = make([]AuthorizationPolicyMatch, len(*in))
+		copy(*out, *in)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationPolicyCondition.
+func (in *AuthorizationPolicyCondition) DeepCopy() *AuthorizationPolicyCondition {
+	if in == nil {
+		return nil
+	}
+	out := new(AuthorizationPolicyCondition)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AuthorizationPolicyExtend) DeepCopyInto(out *AuthorizationPolicyExtend) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationPolicyExtend.
+func (in *AuthorizationPolicyExtend) DeepCopy() *AuthorizationPolicyExtend {
+	if in == nil {
+		return nil
+	}
+	out := new(AuthorizationPolicyExtend)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AuthorizationPolicyList) DeepCopyInto(out *AuthorizationPolicyList) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
 	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
-		*out = make([]PeerAuthentication, len(*in))
+		*out = make([]AuthorizationPolicy, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
@@ -82,18 +327,18 @@ func (in *PeerAuthenticationList) DeepCopyInto(out *PeerAuthenticationList) {
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PeerAuthenticationList.
-func (in *PeerAuthenticationList) DeepCopy() *PeerAuthenticationList {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationPolicyList.
+func (in *AuthorizationPolicyList) DeepCopy() *AuthorizationPolicyList {
 	if in == nil {
 		return nil
 	}
-	out := new(PeerAuthenticationList)
+	out := new(AuthorizationPolicyList)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
-func (in *PeerAuthenticationList) DeepCopyObject() runtime.Object {
+func (in *AuthorizationPolicyList) DeepCopyObject() runtime.Object {
 	if c := in.DeepCopy(); c != nil {
 		return c
 	}
@@ -101,48 +346,42 @@ func (in *PeerAuthenticationList) DeepCopyObject() runtime.Object {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *PeerAuthenticationSpec) DeepCopyInto(out *PeerAuthenticationSpec) {
+func (in *AuthorizationPolicyMatch) DeepCopyInto(out *AuthorizationPolicyMatch) {
 	*out = *in
-	if in.Rules != nil {
-		in, out := &in.Rules, &out.Rules
-		*out = make([]Rule, len(*in))
-		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
-		}
-	}
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PeerAuthenticationSpec.
-func (in *PeerAuthenticationSpec) DeepCopy() *PeerAuthenticationSpec {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationPolicyMatch.
+func (in *AuthorizationPolicyMatch) DeepCopy() *AuthorizationPolicyMatch {
 	if in == nil {
 		return nil
 	}
-	out := new(PeerAuthenticationSpec)
+	out := new(AuthorizationPolicyMatch)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Rule) DeepCopyInto(out *Rule) {
+func (in *AuthorizationPolicyRule) DeepCopyInto(out *AuthorizationPolicyRule) {
 	*out = *in
 	in.From.DeepCopyInto(&out.From)
 	in.To.DeepCopyInto(&out.To)
+	in.When.DeepCopyInto(&out.When)
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Rule.
-func (in *Rule) DeepCopy() *Rule {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationPolicyRule.
+func (in *AuthorizationPolicyRule) DeepCopy() *AuthorizationPolicyRule {
 	if in == nil {
 		return nil
 	}
-	out := new(Rule)
+	out := new(AuthorizationPolicyRule)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Source) DeepCopyInto(out *Source) {
+func (in *AuthorizationPolicySource) DeepCopyInto(out *AuthorizationPolicySource) {
 	*out = *in
 	if in.Namespaces != nil {
 		in, out := &in.Namespaces, &out.Namespaces
@@ -176,29 +415,52 @@ func (in *Source) DeepCopyInto(out *Source) {
 	}
 	if in.Extends != nil {
 		in, out := &in.Extends, &out.Extends
-		*out = make([]ExtendConfig, len(*in))
+		*out = make([]AuthorizationPolicyExtend, len(*in))
 		copy(*out, *in)
 	}
 	if in.NotExtends != nil {
 		in, out := &in.NotExtends, &out.NotExtends
-		*out = make([]ExtendConfig, len(*in))
+		*out = make([]AuthorizationPolicyExtend, len(*in))
 		copy(*out, *in)
 	}
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Source.
-func (in *Source) DeepCopy() *Source {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationPolicySource.
+func (in *AuthorizationPolicySource) DeepCopy() *AuthorizationPolicySource {
+	if in == nil {
+		return nil
+	}
+	out := new(AuthorizationPolicySource)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AuthorizationPolicySpec) DeepCopyInto(out *AuthorizationPolicySpec) {
+	*out = *in
+	if in.Rules != nil {
+		in, out := &in.Rules, &out.Rules
+		*out = make([]AuthorizationPolicyRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationPolicySpec.
+func (in *AuthorizationPolicySpec) DeepCopy() *AuthorizationPolicySpec {
 	if in == nil {
 		return nil
 	}
-	out := new(Source)
+	out := new(AuthorizationPolicySpec)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Target) DeepCopyInto(out *Target) {
+func (in *AuthorizationPolicyTarget) DeepCopyInto(out *AuthorizationPolicyTarget) {
 	*out = *in
 	if in.IpBlocks != nil {
 		in, out := &in.IpBlocks, &out.IpBlocks
@@ -222,23 +484,23 @@ func (in *Target) DeepCopyInto(out *Target) {
 	}
 	if in.Extends != nil {
 		in, out := &in.Extends, &out.Extends
-		*out = make([]ExtendConfig, len(*in))
+		*out = make([]AuthorizationPolicyExtend, len(*in))
 		copy(*out, *in)
 	}
 	if in.NotExtends != nil {
 		in, out := &in.NotExtends, &out.NotExtends
-		*out = make([]ExtendConfig, len(*in))
+		*out = make([]AuthorizationPolicyExtend, len(*in))
 		copy(*out, *in)
 	}
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Target.
-func (in *Target) DeepCopy() *Target {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationPolicyTarget.
+func (in *AuthorizationPolicyTarget) DeepCopy() *AuthorizationPolicyTarget {
 	if in == nil {
 		return nil
 	}
-	out := new(Target)
+	out := new(AuthorizationPolicyTarget)
 	in.DeepCopyInto(out)
 	return out
 }
diff --git a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/peerauthentication.go b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicy.go
similarity index 74%
copy from ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/peerauthentication.go
copy to ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicy.go
index de083b2..363b048 100644
--- a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/peerauthentication.go
+++ b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicy.go
@@ -23,21 +23,21 @@ import (
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
 )
 
-// PeerAuthenticationApplyConfiguration represents an declarative configuration of the PeerAuthentication type for use
+// AuthenticationPolicyApplyConfiguration represents an declarative configuration of the AuthenticationPolicy type for use
 // with apply.
-type PeerAuthenticationApplyConfiguration struct {
+type AuthenticationPolicyApplyConfiguration struct {
 	v1.TypeMetaApplyConfiguration    `json:",inline"`
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	Spec                             *PeerAuthenticationSpecApplyConfiguration `json:"spec,omitempty"`
+	Spec                             *AuthenticationPolicySpecApplyConfiguration `json:"spec,omitempty"`
 }
 
-// PeerAuthentication constructs an declarative configuration of the PeerAuthentication type for use with
+// AuthenticationPolicy constructs an declarative configuration of the AuthenticationPolicy type for use with
 // apply.
-func PeerAuthentication(name, namespace string) *PeerAuthenticationApplyConfiguration {
-	b := &PeerAuthenticationApplyConfiguration{}
+func AuthenticationPolicy(name, namespace string) *AuthenticationPolicyApplyConfiguration {
+	b := &AuthenticationPolicyApplyConfiguration{}
 	b.WithName(name)
 	b.WithNamespace(namespace)
-	b.WithKind("PeerAuthentication")
+	b.WithKind("AuthenticationPolicy")
 	b.WithAPIVersion("dubbo.apache.org/v1beta1")
 	return b
 }
@@ -45,7 +45,7 @@ func PeerAuthentication(name, namespace string) *PeerAuthenticationApplyConfigur
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Kind field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithKind(value string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithKind(value string) *AuthenticationPolicyApplyConfiguration {
 	b.Kind = &value
 	return b
 }
@@ -53,7 +53,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithKind(value string) *PeerAuthe
 // WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the APIVersion field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithAPIVersion(value string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithAPIVersion(value string) *AuthenticationPolicyApplyConfiguration {
 	b.APIVersion = &value
 	return b
 }
@@ -61,7 +61,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithAPIVersion(value string) *Pee
 // WithName sets the Name field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Name field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithName(value string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithName(value string) *AuthenticationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.Name = &value
 	return b
@@ -70,7 +70,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithName(value string) *PeerAuthe
 // WithGenerateName sets the GenerateName field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the GenerateName field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithGenerateName(value string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithGenerateName(value string) *AuthenticationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.GenerateName = &value
 	return b
@@ -79,7 +79,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithGenerateName(value string) *P
 // WithNamespace sets the Namespace field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Namespace field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithNamespace(value string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithNamespace(value string) *AuthenticationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.Namespace = &value
 	return b
@@ -88,7 +88,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithNamespace(value string) *Peer
 // WithUID sets the UID field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the UID field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithUID(value types.UID) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithUID(value types.UID) *AuthenticationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.UID = &value
 	return b
@@ -97,7 +97,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithUID(value types.UID) *PeerAut
 // WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the ResourceVersion field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithResourceVersion(value string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithResourceVersion(value string) *AuthenticationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.ResourceVersion = &value
 	return b
@@ -106,7 +106,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithResourceVersion(value string)
 // WithGeneration sets the Generation field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Generation field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithGeneration(value int64) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithGeneration(value int64) *AuthenticationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.Generation = &value
 	return b
@@ -115,7 +115,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithGeneration(value int64) *Peer
 // WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the CreationTimestamp field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithCreationTimestamp(value metav1.Time) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithCreationTimestamp(value metav1.Time) *AuthenticationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.CreationTimestamp = &value
 	return b
@@ -124,7 +124,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithCreationTimestamp(value metav
 // WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the DeletionTimestamp field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *AuthenticationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.DeletionTimestamp = &value
 	return b
@@ -133,7 +133,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithDeletionTimestamp(value metav
 // WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *AuthenticationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.DeletionGracePeriodSeconds = &value
 	return b
@@ -143,7 +143,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithDeletionGracePeriodSeconds(va
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, the entries provided by each call will be put on the Labels field,
 // overwriting an existing map entries in Labels field with the same key.
-func (b *PeerAuthenticationApplyConfiguration) WithLabels(entries map[string]string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithLabels(entries map[string]string) *AuthenticationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	if b.Labels == nil && len(entries) > 0 {
 		b.Labels = make(map[string]string, len(entries))
@@ -158,7 +158,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithLabels(entries map[string]str
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, the entries provided by each call will be put on the Annotations field,
 // overwriting an existing map entries in Annotations field with the same key.
-func (b *PeerAuthenticationApplyConfiguration) WithAnnotations(entries map[string]string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithAnnotations(entries map[string]string) *AuthenticationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	if b.Annotations == nil && len(entries) > 0 {
 		b.Annotations = make(map[string]string, len(entries))
@@ -172,7 +172,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithAnnotations(entries map[strin
 // WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the OwnerReferences field.
-func (b *PeerAuthenticationApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *AuthenticationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	for i := range values {
 		if values[i] == nil {
@@ -186,7 +186,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithOwnerReferences(values ...*v1
 // WithFinalizers adds the given value to the Finalizers field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Finalizers field.
-func (b *PeerAuthenticationApplyConfiguration) WithFinalizers(values ...string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithFinalizers(values ...string) *AuthenticationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	for i := range values {
 		b.Finalizers = append(b.Finalizers, values[i])
@@ -194,7 +194,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithFinalizers(values ...string)
 	return b
 }
 
-func (b *PeerAuthenticationApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+func (b *AuthenticationPolicyApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
 	if b.ObjectMetaApplyConfiguration == nil {
 		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
 	}
@@ -203,7 +203,7 @@ func (b *PeerAuthenticationApplyConfiguration) ensureObjectMetaApplyConfiguratio
 // WithSpec sets the Spec field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Spec field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithSpec(value *PeerAuthenticationSpecApplyConfiguration) *PeerAuthenticationApplyConfiguration {
+func (b *AuthenticationPolicyApplyConfiguration) WithSpec(value *AuthenticationPolicySpecApplyConfiguration) *AuthenticationPolicyApplyConfiguration {
 	b.Spec = value
 	return b
 }
diff --git a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/extendconfig.go b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicyextend.go
similarity index 68%
copy from ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/extendconfig.go
copy to ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicyextend.go
index 74f3c01..9b9b4bf 100644
--- a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/extendconfig.go
+++ b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicyextend.go
@@ -17,23 +17,23 @@
 
 package v1beta1
 
-// ExtendConfigApplyConfiguration represents an declarative configuration of the ExtendConfig type for use
+// AuthenticationPolicyExtendApplyConfiguration represents an declarative configuration of the AuthenticationPolicyExtend type for use
 // with apply.
-type ExtendConfigApplyConfiguration struct {
+type AuthenticationPolicyExtendApplyConfiguration struct {
 	Key   *string `json:"key,omitempty"`
 	Value *string `json:"value,omitempty"`
 }
 
-// ExtendConfigApplyConfiguration constructs an declarative configuration of the ExtendConfig type for use with
+// AuthenticationPolicyExtendApplyConfiguration constructs an declarative configuration of the AuthenticationPolicyExtend type for use with
 // apply.
-func ExtendConfig() *ExtendConfigApplyConfiguration {
-	return &ExtendConfigApplyConfiguration{}
+func AuthenticationPolicyExtend() *AuthenticationPolicyExtendApplyConfiguration {
+	return &AuthenticationPolicyExtendApplyConfiguration{}
 }
 
 // WithKey sets the Key field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Key field is set to the value of the last call.
-func (b *ExtendConfigApplyConfiguration) WithKey(value string) *ExtendConfigApplyConfiguration {
+func (b *AuthenticationPolicyExtendApplyConfiguration) WithKey(value string) *AuthenticationPolicyExtendApplyConfiguration {
 	b.Key = &value
 	return b
 }
@@ -41,7 +41,7 @@ func (b *ExtendConfigApplyConfiguration) WithKey(value string) *ExtendConfigAppl
 // WithValue sets the Value field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Value field is set to the value of the last call.
-func (b *ExtendConfigApplyConfiguration) WithValue(value string) *ExtendConfigApplyConfiguration {
+func (b *AuthenticationPolicyExtendApplyConfiguration) WithValue(value string) *AuthenticationPolicyExtendApplyConfiguration {
 	b.Value = &value
 	return b
 }
diff --git a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/rule.go b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicyrule.go
similarity index 61%
copy from ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/rule.go
copy to ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicyrule.go
index ec122d4..676e58f 100644
--- a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/rule.go
+++ b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicyrule.go
@@ -17,23 +17,23 @@
 
 package v1beta1
 
-// RuleApplyConfiguration represents an declarative configuration of the Rule type for use
+// AuthenticationPolicyRuleApplyConfiguration represents an declarative configuration of the AuthenticationPolicyRule type for use
 // with apply.
-type RuleApplyConfiguration struct {
-	From *SourceApplyConfiguration `json:"from,omitempty"`
-	To   *TargetApplyConfiguration `json:"to,omitempty"`
+type AuthenticationPolicyRuleApplyConfiguration struct {
+	From *AuthenticationPolicySourceApplyConfiguration `json:"from,omitempty"`
+	To   *AuthenticationPolicyTargetApplyConfiguration `json:"to,omitempty"`
 }
 
-// RuleApplyConfiguration constructs an declarative configuration of the Rule type for use with
+// AuthenticationPolicyRuleApplyConfiguration constructs an declarative configuration of the AuthenticationPolicyRule type for use with
 // apply.
-func Rule() *RuleApplyConfiguration {
-	return &RuleApplyConfiguration{}
+func AuthenticationPolicyRule() *AuthenticationPolicyRuleApplyConfiguration {
+	return &AuthenticationPolicyRuleApplyConfiguration{}
 }
 
 // WithFrom sets the From field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the From field is set to the value of the last call.
-func (b *RuleApplyConfiguration) WithFrom(value *SourceApplyConfiguration) *RuleApplyConfiguration {
+func (b *AuthenticationPolicyRuleApplyConfiguration) WithFrom(value *AuthenticationPolicySourceApplyConfiguration) *AuthenticationPolicyRuleApplyConfiguration {
 	b.From = value
 	return b
 }
@@ -41,7 +41,7 @@ func (b *RuleApplyConfiguration) WithFrom(value *SourceApplyConfiguration) *Rule
 // WithTo sets the To field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the To field is set to the value of the last call.
-func (b *RuleApplyConfiguration) WithTo(value *TargetApplyConfiguration) *RuleApplyConfiguration {
+func (b *AuthenticationPolicyRuleApplyConfiguration) WithTo(value *AuthenticationPolicyTargetApplyConfiguration) *AuthenticationPolicyRuleApplyConfiguration {
 	b.To = value
 	return b
 }
diff --git a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/source.go b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicysource.go
similarity index 63%
copy from ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/source.go
copy to ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicysource.go
index 0229465..9a3414d 100644
--- a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/source.go
+++ b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicysource.go
@@ -17,29 +17,29 @@
 
 package v1beta1
 
-// SourceApplyConfiguration represents an declarative configuration of the Source type for use
+// AuthenticationPolicySourceApplyConfiguration represents an declarative configuration of the AuthenticationPolicySource type for use
 // with apply.
-type SourceApplyConfiguration struct {
-	Namespaces    []string                         `json:"namespaces,omitempty"`
-	NotNamespaces []string                         `json:"notNamespaces,omitempty"`
-	IpBlocks      []string                         `json:"ipBlocks,omitempty"`
-	NotIpBlocks   []string                         `json:"notIpBlocks,omitempty"`
-	Principals    []string                         `json:"principals,omitempty"`
-	NotPrincipals []string                         `json:"notPrincipals,omitempty"`
-	Extends       []ExtendConfigApplyConfiguration `json:"extends,omitempty"`
-	NotExtends    []ExtendConfigApplyConfiguration `json:"notExtends,omitempty"`
+type AuthenticationPolicySourceApplyConfiguration struct {
+	Namespaces    []string                                       `json:"namespaces,omitempty"`
+	NotNamespaces []string                                       `json:"notNamespaces,omitempty"`
+	IpBlocks      []string                                       `json:"ipBlocks,omitempty"`
+	NotIpBlocks   []string                                       `json:"notIpBlocks,omitempty"`
+	Principals    []string                                       `json:"principals,omitempty"`
+	NotPrincipals []string                                       `json:"notPrincipals,omitempty"`
+	Extends       []AuthenticationPolicyExtendApplyConfiguration `json:"extends,omitempty"`
+	NotExtends    []AuthenticationPolicyExtendApplyConfiguration `json:"notExtends,omitempty"`
 }
 
-// SourceApplyConfiguration constructs an declarative configuration of the Source type for use with
+// AuthenticationPolicySourceApplyConfiguration constructs an declarative configuration of the AuthenticationPolicySource type for use with
 // apply.
-func Source() *SourceApplyConfiguration {
-	return &SourceApplyConfiguration{}
+func AuthenticationPolicySource() *AuthenticationPolicySourceApplyConfiguration {
+	return &AuthenticationPolicySourceApplyConfiguration{}
 }
 
 // WithNamespaces adds the given value to the Namespaces field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Namespaces field.
-func (b *SourceApplyConfiguration) WithNamespaces(values ...string) *SourceApplyConfiguration {
+func (b *AuthenticationPolicySourceApplyConfiguration) WithNamespaces(values ...string) *AuthenticationPolicySourceApplyConfiguration {
 	for i := range values {
 		b.Namespaces = append(b.Namespaces, values[i])
 	}
@@ -49,7 +49,7 @@ func (b *SourceApplyConfiguration) WithNamespaces(values ...string) *SourceApply
 // WithNotNamespaces adds the given value to the NotNamespaces field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the NotNamespaces field.
-func (b *SourceApplyConfiguration) WithNotNamespaces(values ...string) *SourceApplyConfiguration {
+func (b *AuthenticationPolicySourceApplyConfiguration) WithNotNamespaces(values ...string) *AuthenticationPolicySourceApplyConfiguration {
 	for i := range values {
 		b.NotNamespaces = append(b.NotNamespaces, values[i])
 	}
@@ -59,7 +59,7 @@ func (b *SourceApplyConfiguration) WithNotNamespaces(values ...string) *SourceAp
 // WithIpBlocks adds the given value to the IpBlocks field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the IpBlocks field.
-func (b *SourceApplyConfiguration) WithIpBlocks(values ...string) *SourceApplyConfiguration {
+func (b *AuthenticationPolicySourceApplyConfiguration) WithIpBlocks(values ...string) *AuthenticationPolicySourceApplyConfiguration {
 	for i := range values {
 		b.IpBlocks = append(b.IpBlocks, values[i])
 	}
@@ -69,7 +69,7 @@ func (b *SourceApplyConfiguration) WithIpBlocks(values ...string) *SourceApplyCo
 // WithNotIpBlocks adds the given value to the NotIpBlocks field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the NotIpBlocks field.
-func (b *SourceApplyConfiguration) WithNotIpBlocks(values ...string) *SourceApplyConfiguration {
+func (b *AuthenticationPolicySourceApplyConfiguration) WithNotIpBlocks(values ...string) *AuthenticationPolicySourceApplyConfiguration {
 	for i := range values {
 		b.NotIpBlocks = append(b.NotIpBlocks, values[i])
 	}
@@ -79,7 +79,7 @@ func (b *SourceApplyConfiguration) WithNotIpBlocks(values ...string) *SourceAppl
 // WithPrincipals adds the given value to the Principals field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Principals field.
-func (b *SourceApplyConfiguration) WithPrincipals(values ...string) *SourceApplyConfiguration {
+func (b *AuthenticationPolicySourceApplyConfiguration) WithPrincipals(values ...string) *AuthenticationPolicySourceApplyConfiguration {
 	for i := range values {
 		b.Principals = append(b.Principals, values[i])
 	}
@@ -89,7 +89,7 @@ func (b *SourceApplyConfiguration) WithPrincipals(values ...string) *SourceApply
 // WithNotPrincipals adds the given value to the NotPrincipals field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the NotPrincipals field.
-func (b *SourceApplyConfiguration) WithNotPrincipals(values ...string) *SourceApplyConfiguration {
+func (b *AuthenticationPolicySourceApplyConfiguration) WithNotPrincipals(values ...string) *AuthenticationPolicySourceApplyConfiguration {
 	for i := range values {
 		b.NotPrincipals = append(b.NotPrincipals, values[i])
 	}
@@ -99,7 +99,7 @@ func (b *SourceApplyConfiguration) WithNotPrincipals(values ...string) *SourceAp
 // WithExtends adds the given value to the Extends field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Extends field.
-func (b *SourceApplyConfiguration) WithExtends(values ...*ExtendConfigApplyConfiguration) *SourceApplyConfiguration {
+func (b *AuthenticationPolicySourceApplyConfiguration) WithExtends(values ...*AuthenticationPolicyExtendApplyConfiguration) *AuthenticationPolicySourceApplyConfiguration {
 	for i := range values {
 		if values[i] == nil {
 			panic("nil value passed to WithExtends")
@@ -112,7 +112,7 @@ func (b *SourceApplyConfiguration) WithExtends(values ...*ExtendConfigApplyConfi
 // WithNotExtends adds the given value to the NotExtends field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the NotExtends field.
-func (b *SourceApplyConfiguration) WithNotExtends(values ...*ExtendConfigApplyConfiguration) *SourceApplyConfiguration {
+func (b *AuthenticationPolicySourceApplyConfiguration) WithNotExtends(values ...*AuthenticationPolicyExtendApplyConfiguration) *AuthenticationPolicySourceApplyConfiguration {
 	for i := range values {
 		if values[i] == nil {
 			panic("nil value passed to WithNotExtends")
diff --git a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/peerauthenticationspec.go b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicyspec.go
similarity index 62%
copy from ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/peerauthenticationspec.go
copy to ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicyspec.go
index 2cef730..7151509 100644
--- a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/peerauthenticationspec.go
+++ b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicyspec.go
@@ -17,25 +17,25 @@
 
 package v1beta1
 
-// PeerAuthenticationSpecApplyConfiguration represents an declarative configuration of the PeerAuthenticationSpec type for use
+// AuthenticationPolicySpecApplyConfiguration represents an declarative configuration of the AuthenticationPolicySpec type for use
 // with apply.
-type PeerAuthenticationSpecApplyConfiguration struct {
-	Action    *string                  `json:"action,omitempty"`
-	Rules     []RuleApplyConfiguration `json:"rules,omitempty"`
-	Order     *int                     `json:"order,omitempty"`
-	MatchType *string                  `json:"matchType,omitempty"`
+type AuthenticationPolicySpecApplyConfiguration struct {
+	Action    *string                                      `json:"action,omitempty"`
+	Rules     []AuthenticationPolicyRuleApplyConfiguration `json:"rules,omitempty"`
+	Order     *int                                         `json:"order,omitempty"`
+	MatchType *string                                      `json:"matchType,omitempty"`
 }
 
-// PeerAuthenticationSpecApplyConfiguration constructs an declarative configuration of the PeerAuthenticationSpec type for use with
+// AuthenticationPolicySpecApplyConfiguration constructs an declarative configuration of the AuthenticationPolicySpec type for use with
 // apply.
-func PeerAuthenticationSpec() *PeerAuthenticationSpecApplyConfiguration {
-	return &PeerAuthenticationSpecApplyConfiguration{}
+func AuthenticationPolicySpec() *AuthenticationPolicySpecApplyConfiguration {
+	return &AuthenticationPolicySpecApplyConfiguration{}
 }
 
 // WithAction sets the Action field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Action field is set to the value of the last call.
-func (b *PeerAuthenticationSpecApplyConfiguration) WithAction(value string) *PeerAuthenticationSpecApplyConfiguration {
+func (b *AuthenticationPolicySpecApplyConfiguration) WithAction(value string) *AuthenticationPolicySpecApplyConfiguration {
 	b.Action = &value
 	return b
 }
@@ -43,7 +43,7 @@ func (b *PeerAuthenticationSpecApplyConfiguration) WithAction(value string) *Pee
 // WithRules adds the given value to the Rules field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Rules field.
-func (b *PeerAuthenticationSpecApplyConfiguration) WithRules(values ...*RuleApplyConfiguration) *PeerAuthenticationSpecApplyConfiguration {
+func (b *AuthenticationPolicySpecApplyConfiguration) WithRules(values ...*AuthenticationPolicyRuleApplyConfiguration) *AuthenticationPolicySpecApplyConfiguration {
 	for i := range values {
 		if values[i] == nil {
 			panic("nil value passed to WithRules")
@@ -56,7 +56,7 @@ func (b *PeerAuthenticationSpecApplyConfiguration) WithRules(values ...*RuleAppl
 // WithOrder sets the Order field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Order field is set to the value of the last call.
-func (b *PeerAuthenticationSpecApplyConfiguration) WithOrder(value int) *PeerAuthenticationSpecApplyConfiguration {
+func (b *AuthenticationPolicySpecApplyConfiguration) WithOrder(value int) *AuthenticationPolicySpecApplyConfiguration {
 	b.Order = &value
 	return b
 }
@@ -64,7 +64,7 @@ func (b *PeerAuthenticationSpecApplyConfiguration) WithOrder(value int) *PeerAut
 // WithMatchType sets the MatchType field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the MatchType field is set to the value of the last call.
-func (b *PeerAuthenticationSpecApplyConfiguration) WithMatchType(value string) *PeerAuthenticationSpecApplyConfiguration {
+func (b *AuthenticationPolicySpecApplyConfiguration) WithMatchType(value string) *AuthenticationPolicySpecApplyConfiguration {
 	b.MatchType = &value
 	return b
 }
diff --git a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/target.go b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicytarget.go
similarity index 63%
copy from ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/target.go
copy to ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicytarget.go
index 865bf12..a9cb034 100644
--- a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/target.go
+++ b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authenticationpolicytarget.go
@@ -17,27 +17,27 @@
 
 package v1beta1
 
-// TargetApplyConfiguration represents an declarative configuration of the Target type for use
+// AuthenticationPolicyTargetApplyConfiguration represents an declarative configuration of the AuthenticationPolicyTarget type for use
 // with apply.
-type TargetApplyConfiguration struct {
-	IpBlocks      []string                         `json:"ipBlocks,omitempty"`
-	NotIpBlocks   []string                         `json:"notIpBlocks,omitempty"`
-	Principals    []string                         `json:"principals,omitempty"`
-	NotPrincipals []string                         `json:"notPrincipals,omitempty"`
-	Extends       []ExtendConfigApplyConfiguration `json:"extends,omitempty"`
-	NotExtends    []ExtendConfigApplyConfiguration `json:"notExtends,omitempty"`
+type AuthenticationPolicyTargetApplyConfiguration struct {
+	IpBlocks      []string                                       `json:"ipBlocks,omitempty"`
+	NotIpBlocks   []string                                       `json:"notIpBlocks,omitempty"`
+	Principals    []string                                       `json:"principals,omitempty"`
+	NotPrincipals []string                                       `json:"notPrincipals,omitempty"`
+	Extends       []AuthenticationPolicyExtendApplyConfiguration `json:"extends,omitempty"`
+	NotExtends    []AuthenticationPolicyExtendApplyConfiguration `json:"notExtends,omitempty"`
 }
 
-// TargetApplyConfiguration constructs an declarative configuration of the Target type for use with
+// AuthenticationPolicyTargetApplyConfiguration constructs an declarative configuration of the AuthenticationPolicyTarget type for use with
 // apply.
-func Target() *TargetApplyConfiguration {
-	return &TargetApplyConfiguration{}
+func AuthenticationPolicyTarget() *AuthenticationPolicyTargetApplyConfiguration {
+	return &AuthenticationPolicyTargetApplyConfiguration{}
 }
 
 // WithIpBlocks adds the given value to the IpBlocks field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the IpBlocks field.
-func (b *TargetApplyConfiguration) WithIpBlocks(values ...string) *TargetApplyConfiguration {
+func (b *AuthenticationPolicyTargetApplyConfiguration) WithIpBlocks(values ...string) *AuthenticationPolicyTargetApplyConfiguration {
 	for i := range values {
 		b.IpBlocks = append(b.IpBlocks, values[i])
 	}
@@ -47,7 +47,7 @@ func (b *TargetApplyConfiguration) WithIpBlocks(values ...string) *TargetApplyCo
 // WithNotIpBlocks adds the given value to the NotIpBlocks field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the NotIpBlocks field.
-func (b *TargetApplyConfiguration) WithNotIpBlocks(values ...string) *TargetApplyConfiguration {
+func (b *AuthenticationPolicyTargetApplyConfiguration) WithNotIpBlocks(values ...string) *AuthenticationPolicyTargetApplyConfiguration {
 	for i := range values {
 		b.NotIpBlocks = append(b.NotIpBlocks, values[i])
 	}
@@ -57,7 +57,7 @@ func (b *TargetApplyConfiguration) WithNotIpBlocks(values ...string) *TargetAppl
 // WithPrincipals adds the given value to the Principals field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Principals field.
-func (b *TargetApplyConfiguration) WithPrincipals(values ...string) *TargetApplyConfiguration {
+func (b *AuthenticationPolicyTargetApplyConfiguration) WithPrincipals(values ...string) *AuthenticationPolicyTargetApplyConfiguration {
 	for i := range values {
 		b.Principals = append(b.Principals, values[i])
 	}
@@ -67,7 +67,7 @@ func (b *TargetApplyConfiguration) WithPrincipals(values ...string) *TargetApply
 // WithNotPrincipals adds the given value to the NotPrincipals field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the NotPrincipals field.
-func (b *TargetApplyConfiguration) WithNotPrincipals(values ...string) *TargetApplyConfiguration {
+func (b *AuthenticationPolicyTargetApplyConfiguration) WithNotPrincipals(values ...string) *AuthenticationPolicyTargetApplyConfiguration {
 	for i := range values {
 		b.NotPrincipals = append(b.NotPrincipals, values[i])
 	}
@@ -77,7 +77,7 @@ func (b *TargetApplyConfiguration) WithNotPrincipals(values ...string) *TargetAp
 // WithExtends adds the given value to the Extends field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Extends field.
-func (b *TargetApplyConfiguration) WithExtends(values ...*ExtendConfigApplyConfiguration) *TargetApplyConfiguration {
+func (b *AuthenticationPolicyTargetApplyConfiguration) WithExtends(values ...*AuthenticationPolicyExtendApplyConfiguration) *AuthenticationPolicyTargetApplyConfiguration {
 	for i := range values {
 		if values[i] == nil {
 			panic("nil value passed to WithExtends")
@@ -90,7 +90,7 @@ func (b *TargetApplyConfiguration) WithExtends(values ...*ExtendConfigApplyConfi
 // WithNotExtends adds the given value to the NotExtends field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the NotExtends field.
-func (b *TargetApplyConfiguration) WithNotExtends(values ...*ExtendConfigApplyConfiguration) *TargetApplyConfiguration {
+func (b *AuthenticationPolicyTargetApplyConfiguration) WithNotExtends(values ...*AuthenticationPolicyExtendApplyConfiguration) *AuthenticationPolicyTargetApplyConfiguration {
 	for i := range values {
 		if values[i] == nil {
 			panic("nil value passed to WithNotExtends")
diff --git a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/peerauthentication.go b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicy.go
similarity index 74%
rename from ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/peerauthentication.go
rename to ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicy.go
index de083b2..19599ef 100644
--- a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/peerauthentication.go
+++ b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicy.go
@@ -23,21 +23,21 @@ import (
 	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
 )
 
-// PeerAuthenticationApplyConfiguration represents an declarative configuration of the PeerAuthentication type for use
+// AuthorizationPolicyApplyConfiguration represents an declarative configuration of the AuthorizationPolicy type for use
 // with apply.
-type PeerAuthenticationApplyConfiguration struct {
+type AuthorizationPolicyApplyConfiguration struct {
 	v1.TypeMetaApplyConfiguration    `json:",inline"`
 	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
-	Spec                             *PeerAuthenticationSpecApplyConfiguration `json:"spec,omitempty"`
+	Spec                             *AuthorizationPolicySpecApplyConfiguration `json:"spec,omitempty"`
 }
 
-// PeerAuthentication constructs an declarative configuration of the PeerAuthentication type for use with
+// AuthorizationPolicy constructs an declarative configuration of the AuthorizationPolicy type for use with
 // apply.
-func PeerAuthentication(name, namespace string) *PeerAuthenticationApplyConfiguration {
-	b := &PeerAuthenticationApplyConfiguration{}
+func AuthorizationPolicy(name, namespace string) *AuthorizationPolicyApplyConfiguration {
+	b := &AuthorizationPolicyApplyConfiguration{}
 	b.WithName(name)
 	b.WithNamespace(namespace)
-	b.WithKind("PeerAuthentication")
+	b.WithKind("AuthorizationPolicy")
 	b.WithAPIVersion("dubbo.apache.org/v1beta1")
 	return b
 }
@@ -45,7 +45,7 @@ func PeerAuthentication(name, namespace string) *PeerAuthenticationApplyConfigur
 // WithKind sets the Kind field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Kind field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithKind(value string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithKind(value string) *AuthorizationPolicyApplyConfiguration {
 	b.Kind = &value
 	return b
 }
@@ -53,7 +53,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithKind(value string) *PeerAuthe
 // WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the APIVersion field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithAPIVersion(value string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithAPIVersion(value string) *AuthorizationPolicyApplyConfiguration {
 	b.APIVersion = &value
 	return b
 }
@@ -61,7 +61,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithAPIVersion(value string) *Pee
 // WithName sets the Name field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Name field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithName(value string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithName(value string) *AuthorizationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.Name = &value
 	return b
@@ -70,7 +70,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithName(value string) *PeerAuthe
 // WithGenerateName sets the GenerateName field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the GenerateName field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithGenerateName(value string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithGenerateName(value string) *AuthorizationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.GenerateName = &value
 	return b
@@ -79,7 +79,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithGenerateName(value string) *P
 // WithNamespace sets the Namespace field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Namespace field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithNamespace(value string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithNamespace(value string) *AuthorizationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.Namespace = &value
 	return b
@@ -88,7 +88,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithNamespace(value string) *Peer
 // WithUID sets the UID field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the UID field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithUID(value types.UID) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithUID(value types.UID) *AuthorizationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.UID = &value
 	return b
@@ -97,7 +97,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithUID(value types.UID) *PeerAut
 // WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the ResourceVersion field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithResourceVersion(value string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithResourceVersion(value string) *AuthorizationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.ResourceVersion = &value
 	return b
@@ -106,7 +106,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithResourceVersion(value string)
 // WithGeneration sets the Generation field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Generation field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithGeneration(value int64) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithGeneration(value int64) *AuthorizationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.Generation = &value
 	return b
@@ -115,7 +115,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithGeneration(value int64) *Peer
 // WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the CreationTimestamp field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithCreationTimestamp(value metav1.Time) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithCreationTimestamp(value metav1.Time) *AuthorizationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.CreationTimestamp = &value
 	return b
@@ -124,7 +124,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithCreationTimestamp(value metav
 // WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the DeletionTimestamp field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *AuthorizationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.DeletionTimestamp = &value
 	return b
@@ -133,7 +133,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithDeletionTimestamp(value metav
 // WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *AuthorizationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	b.DeletionGracePeriodSeconds = &value
 	return b
@@ -143,7 +143,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithDeletionGracePeriodSeconds(va
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, the entries provided by each call will be put on the Labels field,
 // overwriting an existing map entries in Labels field with the same key.
-func (b *PeerAuthenticationApplyConfiguration) WithLabels(entries map[string]string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithLabels(entries map[string]string) *AuthorizationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	if b.Labels == nil && len(entries) > 0 {
 		b.Labels = make(map[string]string, len(entries))
@@ -158,7 +158,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithLabels(entries map[string]str
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, the entries provided by each call will be put on the Annotations field,
 // overwriting an existing map entries in Annotations field with the same key.
-func (b *PeerAuthenticationApplyConfiguration) WithAnnotations(entries map[string]string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithAnnotations(entries map[string]string) *AuthorizationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	if b.Annotations == nil && len(entries) > 0 {
 		b.Annotations = make(map[string]string, len(entries))
@@ -172,7 +172,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithAnnotations(entries map[strin
 // WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the OwnerReferences field.
-func (b *PeerAuthenticationApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *AuthorizationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	for i := range values {
 		if values[i] == nil {
@@ -186,7 +186,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithOwnerReferences(values ...*v1
 // WithFinalizers adds the given value to the Finalizers field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Finalizers field.
-func (b *PeerAuthenticationApplyConfiguration) WithFinalizers(values ...string) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithFinalizers(values ...string) *AuthorizationPolicyApplyConfiguration {
 	b.ensureObjectMetaApplyConfigurationExists()
 	for i := range values {
 		b.Finalizers = append(b.Finalizers, values[i])
@@ -194,7 +194,7 @@ func (b *PeerAuthenticationApplyConfiguration) WithFinalizers(values ...string)
 	return b
 }
 
-func (b *PeerAuthenticationApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+func (b *AuthorizationPolicyApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
 	if b.ObjectMetaApplyConfiguration == nil {
 		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
 	}
@@ -203,7 +203,7 @@ func (b *PeerAuthenticationApplyConfiguration) ensureObjectMetaApplyConfiguratio
 // WithSpec sets the Spec field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Spec field is set to the value of the last call.
-func (b *PeerAuthenticationApplyConfiguration) WithSpec(value *PeerAuthenticationSpecApplyConfiguration) *PeerAuthenticationApplyConfiguration {
+func (b *AuthorizationPolicyApplyConfiguration) WithSpec(value *AuthorizationPolicySpecApplyConfiguration) *AuthorizationPolicyApplyConfiguration {
 	b.Spec = value
 	return b
 }
diff --git a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicycondition.go b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicycondition.go
new file mode 100644
index 0000000..fab1bcb
--- /dev/null
+++ b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicycondition.go
@@ -0,0 +1,66 @@
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1beta1
+
+// AuthorizationPolicyConditionApplyConfiguration represents an declarative configuration of the AuthorizationPolicyCondition type for use
+// with apply.
+type AuthorizationPolicyConditionApplyConfiguration struct {
+	Key       *string                                      `json:"key,omitempty"`
+	Values    []AuthorizationPolicyMatchApplyConfiguration `json:"values,omitempty"`
+	NotValues []AuthorizationPolicyMatchApplyConfiguration `json:"notValues,omitempty"`
+}
+
+// AuthorizationPolicyConditionApplyConfiguration constructs an declarative configuration of the AuthorizationPolicyCondition type for use with
+// apply.
+func AuthorizationPolicyCondition() *AuthorizationPolicyConditionApplyConfiguration {
+	return &AuthorizationPolicyConditionApplyConfiguration{}
+}
+
+// WithKey sets the Key field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Key field is set to the value of the last call.
+func (b *AuthorizationPolicyConditionApplyConfiguration) WithKey(value string) *AuthorizationPolicyConditionApplyConfiguration {
+	b.Key = &value
+	return b
+}
+
+// WithValues adds the given value to the Values field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Values field.
+func (b *AuthorizationPolicyConditionApplyConfiguration) WithValues(values ...*AuthorizationPolicyMatchApplyConfiguration) *AuthorizationPolicyConditionApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithValues")
+		}
+		b.Values = append(b.Values, *values[i])
+	}
+	return b
+}
+
+// WithNotValues adds the given value to the NotValues field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the NotValues field.
+func (b *AuthorizationPolicyConditionApplyConfiguration) WithNotValues(values ...*AuthorizationPolicyMatchApplyConfiguration) *AuthorizationPolicyConditionApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithNotValues")
+		}
+		b.NotValues = append(b.NotValues, *values[i])
+	}
+	return b
+}
diff --git a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/extendconfig.go b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicyextend.go
similarity index 68%
copy from ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/extendconfig.go
copy to ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicyextend.go
index 74f3c01..9ab353d 100644
--- a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/extendconfig.go
+++ b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicyextend.go
@@ -17,23 +17,23 @@
 
 package v1beta1
 
-// ExtendConfigApplyConfiguration represents an declarative configuration of the ExtendConfig type for use
+// AuthorizationPolicyExtendApplyConfiguration represents an declarative configuration of the AuthorizationPolicyExtend type for use
 // with apply.
-type ExtendConfigApplyConfiguration struct {
+type AuthorizationPolicyExtendApplyConfiguration struct {
 	Key   *string `json:"key,omitempty"`
 	Value *string `json:"value,omitempty"`
 }
 
-// ExtendConfigApplyConfiguration constructs an declarative configuration of the ExtendConfig type for use with
+// AuthorizationPolicyExtendApplyConfiguration constructs an declarative configuration of the AuthorizationPolicyExtend type for use with
 // apply.
-func ExtendConfig() *ExtendConfigApplyConfiguration {
-	return &ExtendConfigApplyConfiguration{}
+func AuthorizationPolicyExtend() *AuthorizationPolicyExtendApplyConfiguration {
+	return &AuthorizationPolicyExtendApplyConfiguration{}
 }
 
 // WithKey sets the Key field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Key field is set to the value of the last call.
-func (b *ExtendConfigApplyConfiguration) WithKey(value string) *ExtendConfigApplyConfiguration {
+func (b *AuthorizationPolicyExtendApplyConfiguration) WithKey(value string) *AuthorizationPolicyExtendApplyConfiguration {
 	b.Key = &value
 	return b
 }
@@ -41,7 +41,7 @@ func (b *ExtendConfigApplyConfiguration) WithKey(value string) *ExtendConfigAppl
 // WithValue sets the Value field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Value field is set to the value of the last call.
-func (b *ExtendConfigApplyConfiguration) WithValue(value string) *ExtendConfigApplyConfiguration {
+func (b *AuthorizationPolicyExtendApplyConfiguration) WithValue(value string) *AuthorizationPolicyExtendApplyConfiguration {
 	b.Value = &value
 	return b
 }
diff --git a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/extendconfig.go b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicymatch.go
similarity index 59%
rename from ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/extendconfig.go
rename to ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicymatch.go
index 74f3c01..fdc4843 100644
--- a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/extendconfig.go
+++ b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicymatch.go
@@ -17,31 +17,31 @@
 
 package v1beta1
 
-// ExtendConfigApplyConfiguration represents an declarative configuration of the ExtendConfig type for use
+// AuthorizationPolicyMatchApplyConfiguration represents an declarative configuration of the AuthorizationPolicyMatch type for use
 // with apply.
-type ExtendConfigApplyConfiguration struct {
-	Key   *string `json:"key,omitempty"`
+type AuthorizationPolicyMatchApplyConfiguration struct {
+	Type  *string `json:"type,omitempty"`
 	Value *string `json:"value,omitempty"`
 }
 
-// ExtendConfigApplyConfiguration constructs an declarative configuration of the ExtendConfig type for use with
+// AuthorizationPolicyMatchApplyConfiguration constructs an declarative configuration of the AuthorizationPolicyMatch type for use with
 // apply.
-func ExtendConfig() *ExtendConfigApplyConfiguration {
-	return &ExtendConfigApplyConfiguration{}
+func AuthorizationPolicyMatch() *AuthorizationPolicyMatchApplyConfiguration {
+	return &AuthorizationPolicyMatchApplyConfiguration{}
 }
 
-// WithKey sets the Key field in the declarative configuration to the given value
+// WithType sets the Type field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the Key field is set to the value of the last call.
-func (b *ExtendConfigApplyConfiguration) WithKey(value string) *ExtendConfigApplyConfiguration {
-	b.Key = &value
+// If called multiple times, the Type field is set to the value of the last call.
+func (b *AuthorizationPolicyMatchApplyConfiguration) WithType(value string) *AuthorizationPolicyMatchApplyConfiguration {
+	b.Type = &value
 	return b
 }
 
 // WithValue sets the Value field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Value field is set to the value of the last call.
-func (b *ExtendConfigApplyConfiguration) WithValue(value string) *ExtendConfigApplyConfiguration {
+func (b *AuthorizationPolicyMatchApplyConfiguration) WithValue(value string) *AuthorizationPolicyMatchApplyConfiguration {
 	b.Value = &value
 	return b
 }
diff --git a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/rule.go b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicyrule.go
similarity index 50%
rename from ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/rule.go
rename to ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicyrule.go
index ec122d4..e53d7c3 100644
--- a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/rule.go
+++ b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicyrule.go
@@ -17,23 +17,24 @@
 
 package v1beta1
 
-// RuleApplyConfiguration represents an declarative configuration of the Rule type for use
+// AuthorizationPolicyRuleApplyConfiguration represents an declarative configuration of the AuthorizationPolicyRule type for use
 // with apply.
-type RuleApplyConfiguration struct {
-	From *SourceApplyConfiguration `json:"from,omitempty"`
-	To   *TargetApplyConfiguration `json:"to,omitempty"`
+type AuthorizationPolicyRuleApplyConfiguration struct {
+	From *AuthorizationPolicySourceApplyConfiguration    `json:"from,omitempty"`
+	To   *AuthorizationPolicyTargetApplyConfiguration    `json:"to,omitempty"`
+	When *AuthorizationPolicyConditionApplyConfiguration `json:"when,omitempty"`
 }
 
-// RuleApplyConfiguration constructs an declarative configuration of the Rule type for use with
+// AuthorizationPolicyRuleApplyConfiguration constructs an declarative configuration of the AuthorizationPolicyRule type for use with
 // apply.
-func Rule() *RuleApplyConfiguration {
-	return &RuleApplyConfiguration{}
+func AuthorizationPolicyRule() *AuthorizationPolicyRuleApplyConfiguration {
+	return &AuthorizationPolicyRuleApplyConfiguration{}
 }
 
 // WithFrom sets the From field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the From field is set to the value of the last call.
-func (b *RuleApplyConfiguration) WithFrom(value *SourceApplyConfiguration) *RuleApplyConfiguration {
+func (b *AuthorizationPolicyRuleApplyConfiguration) WithFrom(value *AuthorizationPolicySourceApplyConfiguration) *AuthorizationPolicyRuleApplyConfiguration {
 	b.From = value
 	return b
 }
@@ -41,7 +42,15 @@ func (b *RuleApplyConfiguration) WithFrom(value *SourceApplyConfiguration) *Rule
 // WithTo sets the To field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the To field is set to the value of the last call.
-func (b *RuleApplyConfiguration) WithTo(value *TargetApplyConfiguration) *RuleApplyConfiguration {
+func (b *AuthorizationPolicyRuleApplyConfiguration) WithTo(value *AuthorizationPolicyTargetApplyConfiguration) *AuthorizationPolicyRuleApplyConfiguration {
 	b.To = value
 	return b
 }
+
+// WithWhen sets the When field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the When field is set to the value of the last call.
+func (b *AuthorizationPolicyRuleApplyConfiguration) WithWhen(value *AuthorizationPolicyConditionApplyConfiguration) *AuthorizationPolicyRuleApplyConfiguration {
+	b.When = value
+	return b
+}
diff --git a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/source.go b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicysource.go
similarity index 63%
rename from ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/source.go
rename to ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicysource.go
index 0229465..be9816a 100644
--- a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/source.go
+++ b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicysource.go
@@ -17,29 +17,29 @@
 
 package v1beta1
 
-// SourceApplyConfiguration represents an declarative configuration of the Source type for use
+// AuthorizationPolicySourceApplyConfiguration represents an declarative configuration of the AuthorizationPolicySource type for use
 // with apply.
-type SourceApplyConfiguration struct {
-	Namespaces    []string                         `json:"namespaces,omitempty"`
-	NotNamespaces []string                         `json:"notNamespaces,omitempty"`
-	IpBlocks      []string                         `json:"ipBlocks,omitempty"`
-	NotIpBlocks   []string                         `json:"notIpBlocks,omitempty"`
-	Principals    []string                         `json:"principals,omitempty"`
-	NotPrincipals []string                         `json:"notPrincipals,omitempty"`
-	Extends       []ExtendConfigApplyConfiguration `json:"extends,omitempty"`
-	NotExtends    []ExtendConfigApplyConfiguration `json:"notExtends,omitempty"`
+type AuthorizationPolicySourceApplyConfiguration struct {
+	Namespaces    []string                                      `json:"namespaces,omitempty"`
+	NotNamespaces []string                                      `json:"notNamespaces,omitempty"`
+	IpBlocks      []string                                      `json:"ipBlocks,omitempty"`
+	NotIpBlocks   []string                                      `json:"notIpBlocks,omitempty"`
+	Principals    []string                                      `json:"principals,omitempty"`
+	NotPrincipals []string                                      `json:"notPrincipals,omitempty"`
+	Extends       []AuthorizationPolicyExtendApplyConfiguration `json:"extends,omitempty"`
+	NotExtends    []AuthorizationPolicyExtendApplyConfiguration `json:"notExtends,omitempty"`
 }
 
-// SourceApplyConfiguration constructs an declarative configuration of the Source type for use with
+// AuthorizationPolicySourceApplyConfiguration constructs an declarative configuration of the AuthorizationPolicySource type for use with
 // apply.
-func Source() *SourceApplyConfiguration {
-	return &SourceApplyConfiguration{}
+func AuthorizationPolicySource() *AuthorizationPolicySourceApplyConfiguration {
+	return &AuthorizationPolicySourceApplyConfiguration{}
 }
 
 // WithNamespaces adds the given value to the Namespaces field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Namespaces field.
-func (b *SourceApplyConfiguration) WithNamespaces(values ...string) *SourceApplyConfiguration {
+func (b *AuthorizationPolicySourceApplyConfiguration) WithNamespaces(values ...string) *AuthorizationPolicySourceApplyConfiguration {
 	for i := range values {
 		b.Namespaces = append(b.Namespaces, values[i])
 	}
@@ -49,7 +49,7 @@ func (b *SourceApplyConfiguration) WithNamespaces(values ...string) *SourceApply
 // WithNotNamespaces adds the given value to the NotNamespaces field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the NotNamespaces field.
-func (b *SourceApplyConfiguration) WithNotNamespaces(values ...string) *SourceApplyConfiguration {
+func (b *AuthorizationPolicySourceApplyConfiguration) WithNotNamespaces(values ...string) *AuthorizationPolicySourceApplyConfiguration {
 	for i := range values {
 		b.NotNamespaces = append(b.NotNamespaces, values[i])
 	}
@@ -59,7 +59,7 @@ func (b *SourceApplyConfiguration) WithNotNamespaces(values ...string) *SourceAp
 // WithIpBlocks adds the given value to the IpBlocks field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the IpBlocks field.
-func (b *SourceApplyConfiguration) WithIpBlocks(values ...string) *SourceApplyConfiguration {
+func (b *AuthorizationPolicySourceApplyConfiguration) WithIpBlocks(values ...string) *AuthorizationPolicySourceApplyConfiguration {
 	for i := range values {
 		b.IpBlocks = append(b.IpBlocks, values[i])
 	}
@@ -69,7 +69,7 @@ func (b *SourceApplyConfiguration) WithIpBlocks(values ...string) *SourceApplyCo
 // WithNotIpBlocks adds the given value to the NotIpBlocks field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the NotIpBlocks field.
-func (b *SourceApplyConfiguration) WithNotIpBlocks(values ...string) *SourceApplyConfiguration {
+func (b *AuthorizationPolicySourceApplyConfiguration) WithNotIpBlocks(values ...string) *AuthorizationPolicySourceApplyConfiguration {
 	for i := range values {
 		b.NotIpBlocks = append(b.NotIpBlocks, values[i])
 	}
@@ -79,7 +79,7 @@ func (b *SourceApplyConfiguration) WithNotIpBlocks(values ...string) *SourceAppl
 // WithPrincipals adds the given value to the Principals field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Principals field.
-func (b *SourceApplyConfiguration) WithPrincipals(values ...string) *SourceApplyConfiguration {
+func (b *AuthorizationPolicySourceApplyConfiguration) WithPrincipals(values ...string) *AuthorizationPolicySourceApplyConfiguration {
 	for i := range values {
 		b.Principals = append(b.Principals, values[i])
 	}
@@ -89,7 +89,7 @@ func (b *SourceApplyConfiguration) WithPrincipals(values ...string) *SourceApply
 // WithNotPrincipals adds the given value to the NotPrincipals field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the NotPrincipals field.
-func (b *SourceApplyConfiguration) WithNotPrincipals(values ...string) *SourceApplyConfiguration {
+func (b *AuthorizationPolicySourceApplyConfiguration) WithNotPrincipals(values ...string) *AuthorizationPolicySourceApplyConfiguration {
 	for i := range values {
 		b.NotPrincipals = append(b.NotPrincipals, values[i])
 	}
@@ -99,7 +99,7 @@ func (b *SourceApplyConfiguration) WithNotPrincipals(values ...string) *SourceAp
 // WithExtends adds the given value to the Extends field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Extends field.
-func (b *SourceApplyConfiguration) WithExtends(values ...*ExtendConfigApplyConfiguration) *SourceApplyConfiguration {
+func (b *AuthorizationPolicySourceApplyConfiguration) WithExtends(values ...*AuthorizationPolicyExtendApplyConfiguration) *AuthorizationPolicySourceApplyConfiguration {
 	for i := range values {
 		if values[i] == nil {
 			panic("nil value passed to WithExtends")
@@ -112,7 +112,7 @@ func (b *SourceApplyConfiguration) WithExtends(values ...*ExtendConfigApplyConfi
 // WithNotExtends adds the given value to the NotExtends field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the NotExtends field.
-func (b *SourceApplyConfiguration) WithNotExtends(values ...*ExtendConfigApplyConfiguration) *SourceApplyConfiguration {
+func (b *AuthorizationPolicySourceApplyConfiguration) WithNotExtends(values ...*AuthorizationPolicyExtendApplyConfiguration) *AuthorizationPolicySourceApplyConfiguration {
 	for i := range values {
 		if values[i] == nil {
 			panic("nil value passed to WithNotExtends")
diff --git a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/peerauthenticationspec.go b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicyspec.go
similarity index 58%
rename from ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/peerauthenticationspec.go
rename to ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicyspec.go
index 2cef730..82de34b 100644
--- a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/peerauthenticationspec.go
+++ b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicyspec.go
@@ -17,25 +17,25 @@
 
 package v1beta1
 
-// PeerAuthenticationSpecApplyConfiguration represents an declarative configuration of the PeerAuthenticationSpec type for use
+// AuthorizationPolicySpecApplyConfiguration represents an declarative configuration of the AuthorizationPolicySpec type for use
 // with apply.
-type PeerAuthenticationSpecApplyConfiguration struct {
-	Action    *string                  `json:"action,omitempty"`
-	Rules     []RuleApplyConfiguration `json:"rules,omitempty"`
-	Order     *int                     `json:"order,omitempty"`
-	MatchType *string                  `json:"matchType,omitempty"`
+type AuthorizationPolicySpecApplyConfiguration struct {
+	Action    *string                                     `json:"action,omitempty"`
+	Rules     []AuthorizationPolicyRuleApplyConfiguration `json:"rules,omitempty"`
+	Samples   *float32                                    `json:"samples,omitempty"`
+	MatchType *string                                     `json:"matchType,omitempty"`
 }
 
-// PeerAuthenticationSpecApplyConfiguration constructs an declarative configuration of the PeerAuthenticationSpec type for use with
+// AuthorizationPolicySpecApplyConfiguration constructs an declarative configuration of the AuthorizationPolicySpec type for use with
 // apply.
-func PeerAuthenticationSpec() *PeerAuthenticationSpecApplyConfiguration {
-	return &PeerAuthenticationSpecApplyConfiguration{}
+func AuthorizationPolicySpec() *AuthorizationPolicySpecApplyConfiguration {
+	return &AuthorizationPolicySpecApplyConfiguration{}
 }
 
 // WithAction sets the Action field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the Action field is set to the value of the last call.
-func (b *PeerAuthenticationSpecApplyConfiguration) WithAction(value string) *PeerAuthenticationSpecApplyConfiguration {
+func (b *AuthorizationPolicySpecApplyConfiguration) WithAction(value string) *AuthorizationPolicySpecApplyConfiguration {
 	b.Action = &value
 	return b
 }
@@ -43,7 +43,7 @@ func (b *PeerAuthenticationSpecApplyConfiguration) WithAction(value string) *Pee
 // WithRules adds the given value to the Rules field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Rules field.
-func (b *PeerAuthenticationSpecApplyConfiguration) WithRules(values ...*RuleApplyConfiguration) *PeerAuthenticationSpecApplyConfiguration {
+func (b *AuthorizationPolicySpecApplyConfiguration) WithRules(values ...*AuthorizationPolicyRuleApplyConfiguration) *AuthorizationPolicySpecApplyConfiguration {
 	for i := range values {
 		if values[i] == nil {
 			panic("nil value passed to WithRules")
@@ -53,18 +53,18 @@ func (b *PeerAuthenticationSpecApplyConfiguration) WithRules(values ...*RuleAppl
 	return b
 }
 
-// WithOrder sets the Order field in the declarative configuration to the given value
+// WithSamples sets the Samples field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
-// If called multiple times, the Order field is set to the value of the last call.
-func (b *PeerAuthenticationSpecApplyConfiguration) WithOrder(value int) *PeerAuthenticationSpecApplyConfiguration {
-	b.Order = &value
+// If called multiple times, the Samples field is set to the value of the last call.
+func (b *AuthorizationPolicySpecApplyConfiguration) WithSamples(value float32) *AuthorizationPolicySpecApplyConfiguration {
+	b.Samples = &value
 	return b
 }
 
 // WithMatchType sets the MatchType field in the declarative configuration to the given value
 // and returns the receiver, so that objects can be built by chaining "With" function invocations.
 // If called multiple times, the MatchType field is set to the value of the last call.
-func (b *PeerAuthenticationSpecApplyConfiguration) WithMatchType(value string) *PeerAuthenticationSpecApplyConfiguration {
+func (b *AuthorizationPolicySpecApplyConfiguration) WithMatchType(value string) *AuthorizationPolicySpecApplyConfiguration {
 	b.MatchType = &value
 	return b
 }
diff --git a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/target.go b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicytarget.go
similarity index 63%
rename from ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/target.go
rename to ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicytarget.go
index 865bf12..474c043 100644
--- a/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/target.go
+++ b/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1/authorizationpolicytarget.go
@@ -17,27 +17,27 @@
 
 package v1beta1
 
-// TargetApplyConfiguration represents an declarative configuration of the Target type for use
+// AuthorizationPolicyTargetApplyConfiguration represents an declarative configuration of the AuthorizationPolicyTarget type for use
 // with apply.
-type TargetApplyConfiguration struct {
-	IpBlocks      []string                         `json:"ipBlocks,omitempty"`
-	NotIpBlocks   []string                         `json:"notIpBlocks,omitempty"`
-	Principals    []string                         `json:"principals,omitempty"`
-	NotPrincipals []string                         `json:"notPrincipals,omitempty"`
-	Extends       []ExtendConfigApplyConfiguration `json:"extends,omitempty"`
-	NotExtends    []ExtendConfigApplyConfiguration `json:"notExtends,omitempty"`
+type AuthorizationPolicyTargetApplyConfiguration struct {
+	IpBlocks      []string                                      `json:"ipBlocks,omitempty"`
+	NotIpBlocks   []string                                      `json:"notIpBlocks,omitempty"`
+	Principals    []string                                      `json:"principals,omitempty"`
+	NotPrincipals []string                                      `json:"notPrincipals,omitempty"`
+	Extends       []AuthorizationPolicyExtendApplyConfiguration `json:"extends,omitempty"`
+	NotExtends    []AuthorizationPolicyExtendApplyConfiguration `json:"notExtends,omitempty"`
 }
 
-// TargetApplyConfiguration constructs an declarative configuration of the Target type for use with
+// AuthorizationPolicyTargetApplyConfiguration constructs an declarative configuration of the AuthorizationPolicyTarget type for use with
 // apply.
-func Target() *TargetApplyConfiguration {
-	return &TargetApplyConfiguration{}
+func AuthorizationPolicyTarget() *AuthorizationPolicyTargetApplyConfiguration {
+	return &AuthorizationPolicyTargetApplyConfiguration{}
 }
 
 // WithIpBlocks adds the given value to the IpBlocks field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the IpBlocks field.
-func (b *TargetApplyConfiguration) WithIpBlocks(values ...string) *TargetApplyConfiguration {
+func (b *AuthorizationPolicyTargetApplyConfiguration) WithIpBlocks(values ...string) *AuthorizationPolicyTargetApplyConfiguration {
 	for i := range values {
 		b.IpBlocks = append(b.IpBlocks, values[i])
 	}
@@ -47,7 +47,7 @@ func (b *TargetApplyConfiguration) WithIpBlocks(values ...string) *TargetApplyCo
 // WithNotIpBlocks adds the given value to the NotIpBlocks field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the NotIpBlocks field.
-func (b *TargetApplyConfiguration) WithNotIpBlocks(values ...string) *TargetApplyConfiguration {
+func (b *AuthorizationPolicyTargetApplyConfiguration) WithNotIpBlocks(values ...string) *AuthorizationPolicyTargetApplyConfiguration {
 	for i := range values {
 		b.NotIpBlocks = append(b.NotIpBlocks, values[i])
 	}
@@ -57,7 +57,7 @@ func (b *TargetApplyConfiguration) WithNotIpBlocks(values ...string) *TargetAppl
 // WithPrincipals adds the given value to the Principals field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Principals field.
-func (b *TargetApplyConfiguration) WithPrincipals(values ...string) *TargetApplyConfiguration {
+func (b *AuthorizationPolicyTargetApplyConfiguration) WithPrincipals(values ...string) *AuthorizationPolicyTargetApplyConfiguration {
 	for i := range values {
 		b.Principals = append(b.Principals, values[i])
 	}
@@ -67,7 +67,7 @@ func (b *TargetApplyConfiguration) WithPrincipals(values ...string) *TargetApply
 // WithNotPrincipals adds the given value to the NotPrincipals field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the NotPrincipals field.
-func (b *TargetApplyConfiguration) WithNotPrincipals(values ...string) *TargetApplyConfiguration {
+func (b *AuthorizationPolicyTargetApplyConfiguration) WithNotPrincipals(values ...string) *AuthorizationPolicyTargetApplyConfiguration {
 	for i := range values {
 		b.NotPrincipals = append(b.NotPrincipals, values[i])
 	}
@@ -77,7 +77,7 @@ func (b *TargetApplyConfiguration) WithNotPrincipals(values ...string) *TargetAp
 // WithExtends adds the given value to the Extends field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the Extends field.
-func (b *TargetApplyConfiguration) WithExtends(values ...*ExtendConfigApplyConfiguration) *TargetApplyConfiguration {
+func (b *AuthorizationPolicyTargetApplyConfiguration) WithExtends(values ...*AuthorizationPolicyExtendApplyConfiguration) *AuthorizationPolicyTargetApplyConfiguration {
 	for i := range values {
 		if values[i] == nil {
 			panic("nil value passed to WithExtends")
@@ -90,7 +90,7 @@ func (b *TargetApplyConfiguration) WithExtends(values ...*ExtendConfigApplyConfi
 // WithNotExtends adds the given value to the NotExtends field in the declarative configuration
 // and returns the receiver, so that objects can be build by chaining "With" function invocations.
 // If called multiple times, values provided by each call will be appended to the NotExtends field.
-func (b *TargetApplyConfiguration) WithNotExtends(values ...*ExtendConfigApplyConfiguration) *TargetApplyConfiguration {
+func (b *AuthorizationPolicyTargetApplyConfiguration) WithNotExtends(values ...*AuthorizationPolicyExtendApplyConfiguration) *AuthorizationPolicyTargetApplyConfiguration {
 	for i := range values {
 		if values[i] == nil {
 			panic("nil value passed to WithNotExtends")
diff --git a/ca/pkg/generated/applyconfiguration/utils.go b/ca/pkg/generated/applyconfiguration/utils.go
index 9a0426c..22f7c42 100644
--- a/ca/pkg/generated/applyconfiguration/utils.go
+++ b/ca/pkg/generated/applyconfiguration/utils.go
@@ -28,18 +28,34 @@ import (
 func ForKind(kind schema.GroupVersionKind) interface{} {
 	switch kind {
 	// Group=dubbo.apache.org, Version=v1beta1
-	case v1beta1.SchemeGroupVersion.WithKind("ExtendConfig"):
-		return &dubboapacheorgv1beta1.ExtendConfigApplyConfiguration{}
-	case v1beta1.SchemeGroupVersion.WithKind("PeerAuthentication"):
-		return &dubboapacheorgv1beta1.PeerAuthenticationApplyConfiguration{}
-	case v1beta1.SchemeGroupVersion.WithKind("PeerAuthenticationSpec"):
-		return &dubboapacheorgv1beta1.PeerAuthenticationSpecApplyConfiguration{}
-	case v1beta1.SchemeGroupVersion.WithKind("Rule"):
-		return &dubboapacheorgv1beta1.RuleApplyConfiguration{}
-	case v1beta1.SchemeGroupVersion.WithKind("Source"):
-		return &dubboapacheorgv1beta1.SourceApplyConfiguration{}
-	case v1beta1.SchemeGroupVersion.WithKind("Target"):
-		return &dubboapacheorgv1beta1.TargetApplyConfiguration{}
+	case v1beta1.SchemeGroupVersion.WithKind("AuthenticationPolicy"):
+		return &dubboapacheorgv1beta1.AuthenticationPolicyApplyConfiguration{}
+	case v1beta1.SchemeGroupVersion.WithKind("AuthenticationPolicyExtend"):
+		return &dubboapacheorgv1beta1.AuthenticationPolicyExtendApplyConfiguration{}
+	case v1beta1.SchemeGroupVersion.WithKind("AuthenticationPolicyRule"):
+		return &dubboapacheorgv1beta1.AuthenticationPolicyRuleApplyConfiguration{}
+	case v1beta1.SchemeGroupVersion.WithKind("AuthenticationPolicySource"):
+		return &dubboapacheorgv1beta1.AuthenticationPolicySourceApplyConfiguration{}
+	case v1beta1.SchemeGroupVersion.WithKind("AuthenticationPolicySpec"):
+		return &dubboapacheorgv1beta1.AuthenticationPolicySpecApplyConfiguration{}
+	case v1beta1.SchemeGroupVersion.WithKind("AuthenticationPolicyTarget"):
+		return &dubboapacheorgv1beta1.AuthenticationPolicyTargetApplyConfiguration{}
+	case v1beta1.SchemeGroupVersion.WithKind("AuthorizationPolicy"):
+		return &dubboapacheorgv1beta1.AuthorizationPolicyApplyConfiguration{}
+	case v1beta1.SchemeGroupVersion.WithKind("AuthorizationPolicyCondition"):
+		return &dubboapacheorgv1beta1.AuthorizationPolicyConditionApplyConfiguration{}
+	case v1beta1.SchemeGroupVersion.WithKind("AuthorizationPolicyExtend"):
+		return &dubboapacheorgv1beta1.AuthorizationPolicyExtendApplyConfiguration{}
+	case v1beta1.SchemeGroupVersion.WithKind("AuthorizationPolicyMatch"):
+		return &dubboapacheorgv1beta1.AuthorizationPolicyMatchApplyConfiguration{}
+	case v1beta1.SchemeGroupVersion.WithKind("AuthorizationPolicyRule"):
+		return &dubboapacheorgv1beta1.AuthorizationPolicyRuleApplyConfiguration{}
+	case v1beta1.SchemeGroupVersion.WithKind("AuthorizationPolicySource"):
+		return &dubboapacheorgv1beta1.AuthorizationPolicySourceApplyConfiguration{}
+	case v1beta1.SchemeGroupVersion.WithKind("AuthorizationPolicySpec"):
+		return &dubboapacheorgv1beta1.AuthorizationPolicySpecApplyConfiguration{}
+	case v1beta1.SchemeGroupVersion.WithKind("AuthorizationPolicyTarget"):
+		return &dubboapacheorgv1beta1.AuthorizationPolicyTargetApplyConfiguration{}
 
 	}
 	return nil
diff --git a/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/authenticationpolicy.go b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/authenticationpolicy.go
new file mode 100644
index 0000000..8a1e251
--- /dev/null
+++ b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/authenticationpolicy.go
@@ -0,0 +1,207 @@
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	"context"
+	json "encoding/json"
+	"fmt"
+	"time"
+
+	v1beta1 "github.com/apache/dubbo-admin/ca/pkg/apis/dubbo.apache.org/v1beta1"
+	dubboapacheorgv1beta1 "github.com/apache/dubbo-admin/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1"
+	scheme "github.com/apache/dubbo-admin/ca/pkg/generated/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// AuthenticationPoliciesGetter has a method to return a AuthenticationPolicyInterface.
+// A group's client should implement this interface.
+type AuthenticationPoliciesGetter interface {
+	AuthenticationPolicies(namespace string) AuthenticationPolicyInterface
+}
+
+// AuthenticationPolicyInterface has methods to work with AuthenticationPolicy resources.
+type AuthenticationPolicyInterface interface {
+	Create(ctx context.Context, authenticationPolicy *v1beta1.AuthenticationPolicy, opts v1.CreateOptions) (*v1beta1.AuthenticationPolicy, error)
+	Update(ctx context.Context, authenticationPolicy *v1beta1.AuthenticationPolicy, opts v1.UpdateOptions) (*v1beta1.AuthenticationPolicy, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1beta1.AuthenticationPolicy, error)
+	List(ctx context.Context, opts v1.ListOptions) (*v1beta1.AuthenticationPolicyList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1beta1.AuthenticationPolicy, err error)
+	Apply(ctx context.Context, authenticationPolicy *dubboapacheorgv1beta1.AuthenticationPolicyApplyConfiguration, opts v1.ApplyOptions) (result *v1beta1.AuthenticationPolicy, err error)
+	AuthenticationPolicyExpansion
+}
+
+// authenticationPolicies implements AuthenticationPolicyInterface
+type authenticationPolicies struct {
+	client rest.Interface
+	ns     string
+}
+
+// newAuthenticationPolicies returns a AuthenticationPolicies
+func newAuthenticationPolicies(c *DubboV1beta1Client, namespace string) *authenticationPolicies {
+	return &authenticationPolicies{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the authenticationPolicy, and returns the corresponding authenticationPolicy object, and an error if there is any.
+func (c *authenticationPolicies) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1beta1.AuthenticationPolicy, err error) {
+	result = &v1beta1.AuthenticationPolicy{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("authenticationpolicies").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of AuthenticationPolicies that match those selectors.
+func (c *authenticationPolicies) List(ctx context.Context, opts v1.ListOptions) (result *v1beta1.AuthenticationPolicyList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1beta1.AuthenticationPolicyList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("authenticationpolicies").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested authenticationPolicies.
+func (c *authenticationPolicies) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("authenticationpolicies").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch(ctx)
+}
+
+// Create takes the representation of a authenticationPolicy and creates it.  Returns the server's representation of the authenticationPolicy, and an error, if there is any.
+func (c *authenticationPolicies) Create(ctx context.Context, authenticationPolicy *v1beta1.AuthenticationPolicy, opts v1.CreateOptions) (result *v1beta1.AuthenticationPolicy, err error) {
+	result = &v1beta1.AuthenticationPolicy{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("authenticationpolicies").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(authenticationPolicy).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Update takes the representation of a authenticationPolicy and updates it. Returns the server's representation of the authenticationPolicy, and an error, if there is any.
+func (c *authenticationPolicies) Update(ctx context.Context, authenticationPolicy *v1beta1.AuthenticationPolicy, opts v1.UpdateOptions) (result *v1beta1.AuthenticationPolicy, err error) {
+	result = &v1beta1.AuthenticationPolicy{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("authenticationpolicies").
+		Name(authenticationPolicy.Name).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(authenticationPolicy).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Delete takes name of the authenticationPolicy and deletes it. Returns an error if one occurs.
+func (c *authenticationPolicies) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("authenticationpolicies").
+		Name(name).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *authenticationPolicies) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	var timeout time.Duration
+	if listOpts.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("authenticationpolicies").
+		VersionedParams(&listOpts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// Patch applies the patch and returns the patched authenticationPolicy.
+func (c *authenticationPolicies) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1beta1.AuthenticationPolicy, err error) {
+	result = &v1beta1.AuthenticationPolicy{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("authenticationpolicies").
+		Name(name).
+		SubResource(subresources...).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied authenticationPolicy.
+func (c *authenticationPolicies) Apply(ctx context.Context, authenticationPolicy *dubboapacheorgv1beta1.AuthenticationPolicyApplyConfiguration, opts v1.ApplyOptions) (result *v1beta1.AuthenticationPolicy, err error) {
+	if authenticationPolicy == nil {
+		return nil, fmt.Errorf("authenticationPolicy provided to Apply must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	data, err := json.Marshal(authenticationPolicy)
+	if err != nil {
+		return nil, err
+	}
+	name := authenticationPolicy.Name
+	if name == nil {
+		return nil, fmt.Errorf("authenticationPolicy.Name must be provided to Apply")
+	}
+	result = &v1beta1.AuthenticationPolicy{}
+	err = c.client.Patch(types.ApplyPatchType).
+		Namespace(c.ns).
+		Resource("authenticationpolicies").
+		Name(*name).
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}
diff --git a/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/authorizationpolicy.go b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/authorizationpolicy.go
new file mode 100644
index 0000000..29ba157
--- /dev/null
+++ b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/authorizationpolicy.go
@@ -0,0 +1,207 @@
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	"context"
+	json "encoding/json"
+	"fmt"
+	"time"
+
+	v1beta1 "github.com/apache/dubbo-admin/ca/pkg/apis/dubbo.apache.org/v1beta1"
+	dubboapacheorgv1beta1 "github.com/apache/dubbo-admin/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1"
+	scheme "github.com/apache/dubbo-admin/ca/pkg/generated/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// AuthorizationPoliciesGetter has a method to return a AuthorizationPolicyInterface.
+// A group's client should implement this interface.
+type AuthorizationPoliciesGetter interface {
+	AuthorizationPolicies(namespace string) AuthorizationPolicyInterface
+}
+
+// AuthorizationPolicyInterface has methods to work with AuthorizationPolicy resources.
+type AuthorizationPolicyInterface interface {
+	Create(ctx context.Context, authorizationPolicy *v1beta1.AuthorizationPolicy, opts v1.CreateOptions) (*v1beta1.AuthorizationPolicy, error)
+	Update(ctx context.Context, authorizationPolicy *v1beta1.AuthorizationPolicy, opts v1.UpdateOptions) (*v1beta1.AuthorizationPolicy, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1beta1.AuthorizationPolicy, error)
+	List(ctx context.Context, opts v1.ListOptions) (*v1beta1.AuthorizationPolicyList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1beta1.AuthorizationPolicy, err error)
+	Apply(ctx context.Context, authorizationPolicy *dubboapacheorgv1beta1.AuthorizationPolicyApplyConfiguration, opts v1.ApplyOptions) (result *v1beta1.AuthorizationPolicy, err error)
+	AuthorizationPolicyExpansion
+}
+
+// authorizationPolicies implements AuthorizationPolicyInterface
+type authorizationPolicies struct {
+	client rest.Interface
+	ns     string
+}
+
+// newAuthorizationPolicies returns a AuthorizationPolicies
+func newAuthorizationPolicies(c *DubboV1beta1Client, namespace string) *authorizationPolicies {
+	return &authorizationPolicies{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the authorizationPolicy, and returns the corresponding authorizationPolicy object, and an error if there is any.
+func (c *authorizationPolicies) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1beta1.AuthorizationPolicy, err error) {
+	result = &v1beta1.AuthorizationPolicy{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("authorizationpolicies").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of AuthorizationPolicies that match those selectors.
+func (c *authorizationPolicies) List(ctx context.Context, opts v1.ListOptions) (result *v1beta1.AuthorizationPolicyList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1beta1.AuthorizationPolicyList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("authorizationpolicies").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested authorizationPolicies.
+func (c *authorizationPolicies) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("authorizationpolicies").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch(ctx)
+}
+
+// Create takes the representation of a authorizationPolicy and creates it.  Returns the server's representation of the authorizationPolicy, and an error, if there is any.
+func (c *authorizationPolicies) Create(ctx context.Context, authorizationPolicy *v1beta1.AuthorizationPolicy, opts v1.CreateOptions) (result *v1beta1.AuthorizationPolicy, err error) {
+	result = &v1beta1.AuthorizationPolicy{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("authorizationpolicies").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(authorizationPolicy).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Update takes the representation of a authorizationPolicy and updates it. Returns the server's representation of the authorizationPolicy, and an error, if there is any.
+func (c *authorizationPolicies) Update(ctx context.Context, authorizationPolicy *v1beta1.AuthorizationPolicy, opts v1.UpdateOptions) (result *v1beta1.AuthorizationPolicy, err error) {
+	result = &v1beta1.AuthorizationPolicy{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("authorizationpolicies").
+		Name(authorizationPolicy.Name).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(authorizationPolicy).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Delete takes name of the authorizationPolicy and deletes it. Returns an error if one occurs.
+func (c *authorizationPolicies) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("authorizationpolicies").
+		Name(name).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *authorizationPolicies) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	var timeout time.Duration
+	if listOpts.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("authorizationpolicies").
+		VersionedParams(&listOpts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// Patch applies the patch and returns the patched authorizationPolicy.
+func (c *authorizationPolicies) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1beta1.AuthorizationPolicy, err error) {
+	result = &v1beta1.AuthorizationPolicy{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("authorizationpolicies").
+		Name(name).
+		SubResource(subresources...).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied authorizationPolicy.
+func (c *authorizationPolicies) Apply(ctx context.Context, authorizationPolicy *dubboapacheorgv1beta1.AuthorizationPolicyApplyConfiguration, opts v1.ApplyOptions) (result *v1beta1.AuthorizationPolicy, err error) {
+	if authorizationPolicy == nil {
+		return nil, fmt.Errorf("authorizationPolicy provided to Apply must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	data, err := json.Marshal(authorizationPolicy)
+	if err != nil {
+		return nil, err
+	}
+	name := authorizationPolicy.Name
+	if name == nil {
+		return nil, fmt.Errorf("authorizationPolicy.Name must be provided to Apply")
+	}
+	result = &v1beta1.AuthorizationPolicy{}
+	err = c.client.Patch(types.ApplyPatchType).
+		Namespace(c.ns).
+		Resource("authorizationpolicies").
+		Name(*name).
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}
diff --git a/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/dubbo.apache.org_client.go b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/dubbo.apache.org_client.go
index 4278f7d..5ac7eeb 100644
--- a/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/dubbo.apache.org_client.go
+++ b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/dubbo.apache.org_client.go
@@ -27,7 +27,8 @@ import (
 
 type DubboV1beta1Interface interface {
 	RESTClient() rest.Interface
-	PeerAuthenticationsGetter
+	AuthenticationPoliciesGetter
+	AuthorizationPoliciesGetter
 }
 
 // DubboV1beta1Client is used to interact with features provided by the dubbo.apache.org group.
@@ -35,8 +36,12 @@ type DubboV1beta1Client struct {
 	restClient rest.Interface
 }
 
-func (c *DubboV1beta1Client) PeerAuthentications(namespace string) PeerAuthenticationInterface {
-	return newPeerAuthentications(c, namespace)
+func (c *DubboV1beta1Client) AuthenticationPolicies(namespace string) AuthenticationPolicyInterface {
+	return newAuthenticationPolicies(c, namespace)
+}
+
+func (c *DubboV1beta1Client) AuthorizationPolicies(namespace string) AuthorizationPolicyInterface {
+	return newAuthorizationPolicies(c, namespace)
 }
 
 // NewForConfig creates a new DubboV1beta1Client for the given config.
diff --git a/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/fake/fake_authenticationpolicy.go b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/fake/fake_authenticationpolicy.go
new file mode 100644
index 0000000..0d755bc
--- /dev/null
+++ b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/fake/fake_authenticationpolicy.go
@@ -0,0 +1,153 @@
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	"context"
+	json "encoding/json"
+	"fmt"
+
+	v1beta1 "github.com/apache/dubbo-admin/ca/pkg/apis/dubbo.apache.org/v1beta1"
+	dubboapacheorgv1beta1 "github.com/apache/dubbo-admin/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeAuthenticationPolicies implements AuthenticationPolicyInterface
+type FakeAuthenticationPolicies struct {
+	Fake *FakeDubboV1beta1
+	ns   string
+}
+
+var authenticationpoliciesResource = v1beta1.SchemeGroupVersion.WithResource("authenticationpolicies")
+
+var authenticationpoliciesKind = v1beta1.SchemeGroupVersion.WithKind("AuthenticationPolicy")
+
+// Get takes name of the authenticationPolicy, and returns the corresponding authenticationPolicy object, and an error if there is any.
+func (c *FakeAuthenticationPolicies) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1beta1.AuthenticationPolicy, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(authenticationpoliciesResource, c.ns, name), &v1beta1.AuthenticationPolicy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1beta1.AuthenticationPolicy), err
+}
+
+// List takes label and field selectors, and returns the list of AuthenticationPolicies that match those selectors.
+func (c *FakeAuthenticationPolicies) List(ctx context.Context, opts v1.ListOptions) (result *v1beta1.AuthenticationPolicyList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(authenticationpoliciesResource, authenticationpoliciesKind, c.ns, opts), &v1beta1.AuthenticationPolicyList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1beta1.AuthenticationPolicyList{ListMeta: obj.(*v1beta1.AuthenticationPolicyList).ListMeta}
+	for _, item := range obj.(*v1beta1.AuthenticationPolicyList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested authenticationPolicies.
+func (c *FakeAuthenticationPolicies) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(authenticationpoliciesResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a authenticationPolicy and creates it.  Returns the server's representation of the authenticationPolicy, and an error, if there is any.
+func (c *FakeAuthenticationPolicies) Create(ctx context.Context, authenticationPolicy *v1beta1.AuthenticationPolicy, opts v1.CreateOptions) (result *v1beta1.AuthenticationPolicy, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(authenticationpoliciesResource, c.ns, authenticationPolicy), &v1beta1.AuthenticationPolicy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1beta1.AuthenticationPolicy), err
+}
+
+// Update takes the representation of a authenticationPolicy and updates it. Returns the server's representation of the authenticationPolicy, and an error, if there is any.
+func (c *FakeAuthenticationPolicies) Update(ctx context.Context, authenticationPolicy *v1beta1.AuthenticationPolicy, opts v1.UpdateOptions) (result *v1beta1.AuthenticationPolicy, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(authenticationpoliciesResource, c.ns, authenticationPolicy), &v1beta1.AuthenticationPolicy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1beta1.AuthenticationPolicy), err
+}
+
+// Delete takes name of the authenticationPolicy and deletes it. Returns an error if one occurs.
+func (c *FakeAuthenticationPolicies) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteActionWithOptions(authenticationpoliciesResource, c.ns, name, opts), &v1beta1.AuthenticationPolicy{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeAuthenticationPolicies) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(authenticationpoliciesResource, c.ns, listOpts)
+
+	_, err := c.Fake.Invokes(action, &v1beta1.AuthenticationPolicyList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched authenticationPolicy.
+func (c *FakeAuthenticationPolicies) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1beta1.AuthenticationPolicy, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(authenticationpoliciesResource, c.ns, name, pt, data, subresources...), &v1beta1.AuthenticationPolicy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1beta1.AuthenticationPolicy), err
+}
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied authenticationPolicy.
+func (c *FakeAuthenticationPolicies) Apply(ctx context.Context, authenticationPolicy *dubboapacheorgv1beta1.AuthenticationPolicyApplyConfiguration, opts v1.ApplyOptions) (result *v1beta1.AuthenticationPolicy, err error) {
+	if authenticationPolicy == nil {
+		return nil, fmt.Errorf("authenticationPolicy provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(authenticationPolicy)
+	if err != nil {
+		return nil, err
+	}
+	name := authenticationPolicy.Name
+	if name == nil {
+		return nil, fmt.Errorf("authenticationPolicy.Name must be provided to Apply")
+	}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(authenticationpoliciesResource, c.ns, *name, types.ApplyPatchType, data), &v1beta1.AuthenticationPolicy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1beta1.AuthenticationPolicy), err
+}
diff --git a/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/fake/fake_authorizationpolicy.go b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/fake/fake_authorizationpolicy.go
new file mode 100644
index 0000000..98c92b0
--- /dev/null
+++ b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/fake/fake_authorizationpolicy.go
@@ -0,0 +1,153 @@
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	"context"
+	json "encoding/json"
+	"fmt"
+
+	v1beta1 "github.com/apache/dubbo-admin/ca/pkg/apis/dubbo.apache.org/v1beta1"
+	dubboapacheorgv1beta1 "github.com/apache/dubbo-admin/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakeAuthorizationPolicies implements AuthorizationPolicyInterface
+type FakeAuthorizationPolicies struct {
+	Fake *FakeDubboV1beta1
+	ns   string
+}
+
+var authorizationpoliciesResource = v1beta1.SchemeGroupVersion.WithResource("authorizationpolicies")
+
+var authorizationpoliciesKind = v1beta1.SchemeGroupVersion.WithKind("AuthorizationPolicy")
+
+// Get takes name of the authorizationPolicy, and returns the corresponding authorizationPolicy object, and an error if there is any.
+func (c *FakeAuthorizationPolicies) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1beta1.AuthorizationPolicy, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(authorizationpoliciesResource, c.ns, name), &v1beta1.AuthorizationPolicy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1beta1.AuthorizationPolicy), err
+}
+
+// List takes label and field selectors, and returns the list of AuthorizationPolicies that match those selectors.
+func (c *FakeAuthorizationPolicies) List(ctx context.Context, opts v1.ListOptions) (result *v1beta1.AuthorizationPolicyList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(authorizationpoliciesResource, authorizationpoliciesKind, c.ns, opts), &v1beta1.AuthorizationPolicyList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1beta1.AuthorizationPolicyList{ListMeta: obj.(*v1beta1.AuthorizationPolicyList).ListMeta}
+	for _, item := range obj.(*v1beta1.AuthorizationPolicyList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested authorizationPolicies.
+func (c *FakeAuthorizationPolicies) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(authorizationpoliciesResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a authorizationPolicy and creates it.  Returns the server's representation of the authorizationPolicy, and an error, if there is any.
+func (c *FakeAuthorizationPolicies) Create(ctx context.Context, authorizationPolicy *v1beta1.AuthorizationPolicy, opts v1.CreateOptions) (result *v1beta1.AuthorizationPolicy, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(authorizationpoliciesResource, c.ns, authorizationPolicy), &v1beta1.AuthorizationPolicy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1beta1.AuthorizationPolicy), err
+}
+
+// Update takes the representation of a authorizationPolicy and updates it. Returns the server's representation of the authorizationPolicy, and an error, if there is any.
+func (c *FakeAuthorizationPolicies) Update(ctx context.Context, authorizationPolicy *v1beta1.AuthorizationPolicy, opts v1.UpdateOptions) (result *v1beta1.AuthorizationPolicy, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(authorizationpoliciesResource, c.ns, authorizationPolicy), &v1beta1.AuthorizationPolicy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1beta1.AuthorizationPolicy), err
+}
+
+// Delete takes name of the authorizationPolicy and deletes it. Returns an error if one occurs.
+func (c *FakeAuthorizationPolicies) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteActionWithOptions(authorizationpoliciesResource, c.ns, name, opts), &v1beta1.AuthorizationPolicy{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeAuthorizationPolicies) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(authorizationpoliciesResource, c.ns, listOpts)
+
+	_, err := c.Fake.Invokes(action, &v1beta1.AuthorizationPolicyList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched authorizationPolicy.
+func (c *FakeAuthorizationPolicies) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1beta1.AuthorizationPolicy, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(authorizationpoliciesResource, c.ns, name, pt, data, subresources...), &v1beta1.AuthorizationPolicy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1beta1.AuthorizationPolicy), err
+}
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied authorizationPolicy.
+func (c *FakeAuthorizationPolicies) Apply(ctx context.Context, authorizationPolicy *dubboapacheorgv1beta1.AuthorizationPolicyApplyConfiguration, opts v1.ApplyOptions) (result *v1beta1.AuthorizationPolicy, err error) {
+	if authorizationPolicy == nil {
+		return nil, fmt.Errorf("authorizationPolicy provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(authorizationPolicy)
+	if err != nil {
+		return nil, err
+	}
+	name := authorizationPolicy.Name
+	if name == nil {
+		return nil, fmt.Errorf("authorizationPolicy.Name must be provided to Apply")
+	}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(authorizationpoliciesResource, c.ns, *name, types.ApplyPatchType, data), &v1beta1.AuthorizationPolicy{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1beta1.AuthorizationPolicy), err
+}
diff --git a/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/fake/fake_dubbo.apache.org_client.go b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/fake/fake_dubbo.apache.org_client.go
index 99abb12..2940ced 100644
--- a/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/fake/fake_dubbo.apache.org_client.go
+++ b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/fake/fake_dubbo.apache.org_client.go
@@ -27,8 +27,12 @@ type FakeDubboV1beta1 struct {
 	*testing.Fake
 }
 
-func (c *FakeDubboV1beta1) PeerAuthentications(namespace string) v1beta1.PeerAuthenticationInterface {
-	return &FakePeerAuthentications{c, namespace}
+func (c *FakeDubboV1beta1) AuthenticationPolicies(namespace string) v1beta1.AuthenticationPolicyInterface {
+	return &FakeAuthenticationPolicies{c, namespace}
+}
+
+func (c *FakeDubboV1beta1) AuthorizationPolicies(namespace string) v1beta1.AuthorizationPolicyInterface {
+	return &FakeAuthorizationPolicies{c, namespace}
 }
 
 // RESTClient returns a RESTClient that is used to communicate
diff --git a/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/fake/fake_peerauthentication.go b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/fake/fake_peerauthentication.go
deleted file mode 100644
index d21665c..0000000
--- a/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/fake/fake_peerauthentication.go
+++ /dev/null
@@ -1,153 +0,0 @@
-// Licensed to the Apache Software Foundation (ASF) under one or more
-// contributor license agreements.  See the NOTICE file distributed with
-// this work for additional information regarding copyright ownership.
-// The ASF licenses this file to You under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance with
-// the License.  You may obtain a copy of the License at
-//
-//	http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package fake
-
-import (
-	"context"
-	json "encoding/json"
-	"fmt"
-
-	v1beta1 "github.com/apache/dubbo-admin/ca/pkg/apis/dubbo.apache.org/v1beta1"
-	dubboapacheorgv1beta1 "github.com/apache/dubbo-admin/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	labels "k8s.io/apimachinery/pkg/labels"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	testing "k8s.io/client-go/testing"
-)
-
-// FakePeerAuthentications implements PeerAuthenticationInterface
-type FakePeerAuthentications struct {
-	Fake *FakeDubboV1beta1
-	ns   string
-}
-
-var peerauthenticationsResource = v1beta1.SchemeGroupVersion.WithResource("peerauthentications")
-
-var peerauthenticationsKind = v1beta1.SchemeGroupVersion.WithKind("PeerAuthentication")
-
-// Get takes name of the peerAuthentication, and returns the corresponding peerAuthentication object, and an error if there is any.
-func (c *FakePeerAuthentications) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1beta1.PeerAuthentication, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(peerauthenticationsResource, c.ns, name), &v1beta1.PeerAuthentication{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1beta1.PeerAuthentication), err
-}
-
-// List takes label and field selectors, and returns the list of PeerAuthentications that match those selectors.
-func (c *FakePeerAuthentications) List(ctx context.Context, opts v1.ListOptions) (result *v1beta1.PeerAuthenticationList, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewListAction(peerauthenticationsResource, peerauthenticationsKind, c.ns, opts), &v1beta1.PeerAuthenticationList{})
-
-	if obj == nil {
-		return nil, err
-	}
-
-	label, _, _ := testing.ExtractFromListOptions(opts)
-	if label == nil {
-		label = labels.Everything()
-	}
-	list := &v1beta1.PeerAuthenticationList{ListMeta: obj.(*v1beta1.PeerAuthenticationList).ListMeta}
-	for _, item := range obj.(*v1beta1.PeerAuthenticationList).Items {
-		if label.Matches(labels.Set(item.Labels)) {
-			list.Items = append(list.Items, item)
-		}
-	}
-	return list, err
-}
-
-// Watch returns a watch.Interface that watches the requested peerAuthentications.
-func (c *FakePeerAuthentications) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	return c.Fake.
-		InvokesWatch(testing.NewWatchAction(peerauthenticationsResource, c.ns, opts))
-
-}
-
-// Create takes the representation of a peerAuthentication and creates it.  Returns the server's representation of the peerAuthentication, and an error, if there is any.
-func (c *FakePeerAuthentications) Create(ctx context.Context, peerAuthentication *v1beta1.PeerAuthentication, opts v1.CreateOptions) (result *v1beta1.PeerAuthentication, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(peerauthenticationsResource, c.ns, peerAuthentication), &v1beta1.PeerAuthentication{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1beta1.PeerAuthentication), err
-}
-
-// Update takes the representation of a peerAuthentication and updates it. Returns the server's representation of the peerAuthentication, and an error, if there is any.
-func (c *FakePeerAuthentications) Update(ctx context.Context, peerAuthentication *v1beta1.PeerAuthentication, opts v1.UpdateOptions) (result *v1beta1.PeerAuthentication, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(peerauthenticationsResource, c.ns, peerAuthentication), &v1beta1.PeerAuthentication{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1beta1.PeerAuthentication), err
-}
-
-// Delete takes name of the peerAuthentication and deletes it. Returns an error if one occurs.
-func (c *FakePeerAuthentications) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	_, err := c.Fake.
-		Invokes(testing.NewDeleteActionWithOptions(peerauthenticationsResource, c.ns, name, opts), &v1beta1.PeerAuthentication{})
-
-	return err
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *FakePeerAuthentications) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	action := testing.NewDeleteCollectionAction(peerauthenticationsResource, c.ns, listOpts)
-
-	_, err := c.Fake.Invokes(action, &v1beta1.PeerAuthenticationList{})
-	return err
-}
-
-// Patch applies the patch and returns the patched peerAuthentication.
-func (c *FakePeerAuthentications) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1beta1.PeerAuthentication, err error) {
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(peerauthenticationsResource, c.ns, name, pt, data, subresources...), &v1beta1.PeerAuthentication{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1beta1.PeerAuthentication), err
-}
-
-// Apply takes the given apply declarative configuration, applies it and returns the applied peerAuthentication.
-func (c *FakePeerAuthentications) Apply(ctx context.Context, peerAuthentication *dubboapacheorgv1beta1.PeerAuthenticationApplyConfiguration, opts v1.ApplyOptions) (result *v1beta1.PeerAuthentication, err error) {
-	if peerAuthentication == nil {
-		return nil, fmt.Errorf("peerAuthentication provided to Apply must not be nil")
-	}
-	data, err := json.Marshal(peerAuthentication)
-	if err != nil {
-		return nil, err
-	}
-	name := peerAuthentication.Name
-	if name == nil {
-		return nil, fmt.Errorf("peerAuthentication.Name must be provided to Apply")
-	}
-	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(peerauthenticationsResource, c.ns, *name, types.ApplyPatchType, data), &v1beta1.PeerAuthentication{})
-
-	if obj == nil {
-		return nil, err
-	}
-	return obj.(*v1beta1.PeerAuthentication), err
-}
diff --git a/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/generated_expansion.go b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/generated_expansion.go
index d68fe00..7811d7c 100644
--- a/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/generated_expansion.go
+++ b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/generated_expansion.go
@@ -17,4 +17,6 @@
 
 package v1beta1
 
-type PeerAuthenticationExpansion interface{}
+type AuthenticationPolicyExpansion interface{}
+
+type AuthorizationPolicyExpansion interface{}
diff --git a/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/peerauthentication.go b/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/peerauthentication.go
deleted file mode 100644
index 2e1cd50..0000000
--- a/ca/pkg/generated/clientset/versioned/typed/dubbo.apache.org/v1beta1/peerauthentication.go
+++ /dev/null
@@ -1,207 +0,0 @@
-// Licensed to the Apache Software Foundation (ASF) under one or more
-// contributor license agreements.  See the NOTICE file distributed with
-// this work for additional information regarding copyright ownership.
-// The ASF licenses this file to You under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance with
-// the License.  You may obtain a copy of the License at
-//
-//	http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by client-gen. DO NOT EDIT.
-
-package v1beta1
-
-import (
-	"context"
-	json "encoding/json"
-	"fmt"
-	"time"
-
-	v1beta1 "github.com/apache/dubbo-admin/ca/pkg/apis/dubbo.apache.org/v1beta1"
-	dubboapacheorgv1beta1 "github.com/apache/dubbo-admin/ca/pkg/generated/applyconfiguration/dubbo.apache.org/v1beta1"
-	scheme "github.com/apache/dubbo-admin/ca/pkg/generated/clientset/versioned/scheme"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	types "k8s.io/apimachinery/pkg/types"
-	watch "k8s.io/apimachinery/pkg/watch"
-	rest "k8s.io/client-go/rest"
-)
-
-// PeerAuthenticationsGetter has a method to return a PeerAuthenticationInterface.
-// A group's client should implement this interface.
-type PeerAuthenticationsGetter interface {
-	PeerAuthentications(namespace string) PeerAuthenticationInterface
-}
-
-// PeerAuthenticationInterface has methods to work with PeerAuthentication resources.
-type PeerAuthenticationInterface interface {
-	Create(ctx context.Context, peerAuthentication *v1beta1.PeerAuthentication, opts v1.CreateOptions) (*v1beta1.PeerAuthentication, error)
-	Update(ctx context.Context, peerAuthentication *v1beta1.PeerAuthentication, opts v1.UpdateOptions) (*v1beta1.PeerAuthentication, error)
-	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
-	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
-	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1beta1.PeerAuthentication, error)
-	List(ctx context.Context, opts v1.ListOptions) (*v1beta1.PeerAuthenticationList, error)
-	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
-	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1beta1.PeerAuthentication, err error)
-	Apply(ctx context.Context, peerAuthentication *dubboapacheorgv1beta1.PeerAuthenticationApplyConfiguration, opts v1.ApplyOptions) (result *v1beta1.PeerAuthentication, err error)
-	PeerAuthenticationExpansion
-}
-
-// peerAuthentications implements PeerAuthenticationInterface
-type peerAuthentications struct {
-	client rest.Interface
-	ns     string
-}
-
-// newPeerAuthentications returns a PeerAuthentications
-func newPeerAuthentications(c *DubboV1beta1Client, namespace string) *peerAuthentications {
-	return &peerAuthentications{
-		client: c.RESTClient(),
-		ns:     namespace,
-	}
-}
-
-// Get takes name of the peerAuthentication, and returns the corresponding peerAuthentication object, and an error if there is any.
-func (c *peerAuthentications) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1beta1.PeerAuthentication, err error) {
-	result = &v1beta1.PeerAuthentication{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("peerauthentications").
-		Name(name).
-		VersionedParams(&options, scheme.ParameterCodec).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// List takes label and field selectors, and returns the list of PeerAuthentications that match those selectors.
-func (c *peerAuthentications) List(ctx context.Context, opts v1.ListOptions) (result *v1beta1.PeerAuthenticationList, err error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	result = &v1beta1.PeerAuthenticationList{}
-	err = c.client.Get().
-		Namespace(c.ns).
-		Resource("peerauthentications").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Watch returns a watch.Interface that watches the requested peerAuthentications.
-func (c *peerAuthentications) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
-	var timeout time.Duration
-	if opts.TimeoutSeconds != nil {
-		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
-	}
-	opts.Watch = true
-	return c.client.Get().
-		Namespace(c.ns).
-		Resource("peerauthentications").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Watch(ctx)
-}
-
-// Create takes the representation of a peerAuthentication and creates it.  Returns the server's representation of the peerAuthentication, and an error, if there is any.
-func (c *peerAuthentications) Create(ctx context.Context, peerAuthentication *v1beta1.PeerAuthentication, opts v1.CreateOptions) (result *v1beta1.PeerAuthentication, err error) {
-	result = &v1beta1.PeerAuthentication{}
-	err = c.client.Post().
-		Namespace(c.ns).
-		Resource("peerauthentications").
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(peerAuthentication).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Update takes the representation of a peerAuthentication and updates it. Returns the server's representation of the peerAuthentication, and an error, if there is any.
-func (c *peerAuthentications) Update(ctx context.Context, peerAuthentication *v1beta1.PeerAuthentication, opts v1.UpdateOptions) (result *v1beta1.PeerAuthentication, err error) {
-	result = &v1beta1.PeerAuthentication{}
-	err = c.client.Put().
-		Namespace(c.ns).
-		Resource("peerauthentications").
-		Name(peerAuthentication.Name).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(peerAuthentication).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Delete takes name of the peerAuthentication and deletes it. Returns an error if one occurs.
-func (c *peerAuthentications) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("peerauthentications").
-		Name(name).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// DeleteCollection deletes a collection of objects.
-func (c *peerAuthentications) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
-	var timeout time.Duration
-	if listOpts.TimeoutSeconds != nil {
-		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
-	}
-	return c.client.Delete().
-		Namespace(c.ns).
-		Resource("peerauthentications").
-		VersionedParams(&listOpts, scheme.ParameterCodec).
-		Timeout(timeout).
-		Body(&opts).
-		Do(ctx).
-		Error()
-}
-
-// Patch applies the patch and returns the patched peerAuthentication.
-func (c *peerAuthentications) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1beta1.PeerAuthentication, err error) {
-	result = &v1beta1.PeerAuthentication{}
-	err = c.client.Patch(pt).
-		Namespace(c.ns).
-		Resource("peerauthentications").
-		Name(name).
-		SubResource(subresources...).
-		VersionedParams(&opts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}
-
-// Apply takes the given apply declarative configuration, applies it and returns the applied peerAuthentication.
-func (c *peerAuthentications) Apply(ctx context.Context, peerAuthentication *dubboapacheorgv1beta1.PeerAuthenticationApplyConfiguration, opts v1.ApplyOptions) (result *v1beta1.PeerAuthentication, err error) {
-	if peerAuthentication == nil {
-		return nil, fmt.Errorf("peerAuthentication provided to Apply must not be nil")
-	}
-	patchOpts := opts.ToPatchOptions()
-	data, err := json.Marshal(peerAuthentication)
-	if err != nil {
-		return nil, err
-	}
-	name := peerAuthentication.Name
-	if name == nil {
-		return nil, fmt.Errorf("peerAuthentication.Name must be provided to Apply")
-	}
-	result = &v1beta1.PeerAuthentication{}
-	err = c.client.Patch(types.ApplyPatchType).
-		Namespace(c.ns).
-		Resource("peerauthentications").
-		Name(*name).
-		VersionedParams(&patchOpts, scheme.ParameterCodec).
-		Body(data).
-		Do(ctx).
-		Into(result)
-	return
-}
diff --git a/ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/peerauthentication.go b/ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/authenticationpolicy.go
similarity index 56%
copy from ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/peerauthentication.go
copy to ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/authenticationpolicy.go
index 9154748..b31b6a6 100644
--- a/ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/peerauthentication.go
+++ b/ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/authenticationpolicy.go
@@ -31,59 +31,59 @@ import (
 	cache "k8s.io/client-go/tools/cache"
 )
 
-// PeerAuthenticationInformer provides access to a shared informer and lister for
-// PeerAuthentications.
-type PeerAuthenticationInformer interface {
+// AuthenticationPolicyInformer provides access to a shared informer and lister for
+// AuthenticationPolicies.
+type AuthenticationPolicyInformer interface {
 	Informer() cache.SharedIndexInformer
-	Lister() v1beta1.PeerAuthenticationLister
+	Lister() v1beta1.AuthenticationPolicyLister
 }
 
-type peerAuthenticationInformer struct {
+type authenticationPolicyInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
 	namespace        string
 }
 
-// NewPeerAuthenticationInformer constructs a new informer for PeerAuthentication type.
+// NewAuthenticationPolicyInformer constructs a new informer for AuthenticationPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewPeerAuthenticationInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
-	return NewFilteredPeerAuthenticationInformer(client, namespace, resyncPeriod, indexers, nil)
+func NewAuthenticationPolicyInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredAuthenticationPolicyInformer(client, namespace, resyncPeriod, indexers, nil)
 }
 
-// NewFilteredPeerAuthenticationInformer constructs a new informer for PeerAuthentication type.
+// NewFilteredAuthenticationPolicyInformer constructs a new informer for AuthenticationPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPeerAuthenticationInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+func NewFilteredAuthenticationPolicyInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
 	return cache.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.DubboV1beta1().PeerAuthentications(namespace).List(context.TODO(), options)
+				return client.DubboV1beta1().AuthenticationPolicies(namespace).List(context.TODO(), options)
 			},
 			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.DubboV1beta1().PeerAuthentications(namespace).Watch(context.TODO(), options)
+				return client.DubboV1beta1().AuthenticationPolicies(namespace).Watch(context.TODO(), options)
 			},
 		},
-		&dubboapacheorgv1beta1.PeerAuthentication{},
+		&dubboapacheorgv1beta1.AuthenticationPolicy{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *peerAuthenticationInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewFilteredPeerAuthenticationInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+func (f *authenticationPolicyInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredAuthenticationPolicyInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
 }
 
-func (f *peerAuthenticationInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&dubboapacheorgv1beta1.PeerAuthentication{}, f.defaultInformer)
+func (f *authenticationPolicyInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&dubboapacheorgv1beta1.AuthenticationPolicy{}, f.defaultInformer)
 }
 
-func (f *peerAuthenticationInformer) Lister() v1beta1.PeerAuthenticationLister {
-	return v1beta1.NewPeerAuthenticationLister(f.Informer().GetIndexer())
+func (f *authenticationPolicyInformer) Lister() v1beta1.AuthenticationPolicyLister {
+	return v1beta1.NewAuthenticationPolicyLister(f.Informer().GetIndexer())
 }
diff --git a/ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/peerauthentication.go b/ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/authorizationpolicy.go
similarity index 57%
rename from ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/peerauthentication.go
rename to ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/authorizationpolicy.go
index 9154748..a1c1215 100644
--- a/ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/peerauthentication.go
+++ b/ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/authorizationpolicy.go
@@ -31,59 +31,59 @@ import (
 	cache "k8s.io/client-go/tools/cache"
 )
 
-// PeerAuthenticationInformer provides access to a shared informer and lister for
-// PeerAuthentications.
-type PeerAuthenticationInformer interface {
+// AuthorizationPolicyInformer provides access to a shared informer and lister for
+// AuthorizationPolicies.
+type AuthorizationPolicyInformer interface {
 	Informer() cache.SharedIndexInformer
-	Lister() v1beta1.PeerAuthenticationLister
+	Lister() v1beta1.AuthorizationPolicyLister
 }
 
-type peerAuthenticationInformer struct {
+type authorizationPolicyInformer struct {
 	factory          internalinterfaces.SharedInformerFactory
 	tweakListOptions internalinterfaces.TweakListOptionsFunc
 	namespace        string
 }
 
-// NewPeerAuthenticationInformer constructs a new informer for PeerAuthentication type.
+// NewAuthorizationPolicyInformer constructs a new informer for AuthorizationPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewPeerAuthenticationInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
-	return NewFilteredPeerAuthenticationInformer(client, namespace, resyncPeriod, indexers, nil)
+func NewAuthorizationPolicyInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredAuthorizationPolicyInformer(client, namespace, resyncPeriod, indexers, nil)
 }
 
-// NewFilteredPeerAuthenticationInformer constructs a new informer for PeerAuthentication type.
+// NewFilteredAuthorizationPolicyInformer constructs a new informer for AuthorizationPolicy type.
 // Always prefer using an informer factory to get a shared informer instead of getting an independent
 // one. This reduces memory footprint and number of connections to the server.
-func NewFilteredPeerAuthenticationInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+func NewFilteredAuthorizationPolicyInformer(client versioned.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
 	return cache.NewSharedIndexInformer(
 		&cache.ListWatch{
 			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.DubboV1beta1().PeerAuthentications(namespace).List(context.TODO(), options)
+				return client.DubboV1beta1().AuthorizationPolicies(namespace).List(context.TODO(), options)
 			},
 			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
 				if tweakListOptions != nil {
 					tweakListOptions(&options)
 				}
-				return client.DubboV1beta1().PeerAuthentications(namespace).Watch(context.TODO(), options)
+				return client.DubboV1beta1().AuthorizationPolicies(namespace).Watch(context.TODO(), options)
 			},
 		},
-		&dubboapacheorgv1beta1.PeerAuthentication{},
+		&dubboapacheorgv1beta1.AuthorizationPolicy{},
 		resyncPeriod,
 		indexers,
 	)
 }
 
-func (f *peerAuthenticationInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
-	return NewFilteredPeerAuthenticationInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+func (f *authorizationPolicyInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredAuthorizationPolicyInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
 }
 
-func (f *peerAuthenticationInformer) Informer() cache.SharedIndexInformer {
-	return f.factory.InformerFor(&dubboapacheorgv1beta1.PeerAuthentication{}, f.defaultInformer)
+func (f *authorizationPolicyInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&dubboapacheorgv1beta1.AuthorizationPolicy{}, f.defaultInformer)
 }
 
-func (f *peerAuthenticationInformer) Lister() v1beta1.PeerAuthenticationLister {
-	return v1beta1.NewPeerAuthenticationLister(f.Informer().GetIndexer())
+func (f *authorizationPolicyInformer) Lister() v1beta1.AuthorizationPolicyLister {
+	return v1beta1.NewAuthorizationPolicyLister(f.Informer().GetIndexer())
 }
diff --git a/ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/interface.go b/ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/interface.go
index d792da6..5b2c656 100644
--- a/ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/interface.go
+++ b/ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1/interface.go
@@ -23,8 +23,10 @@ import (
 
 // Interface provides access to all the informers in this group version.
 type Interface interface {
-	// PeerAuthentications returns a PeerAuthenticationInformer.
-	PeerAuthentications() PeerAuthenticationInformer
+	// AuthenticationPolicies returns a AuthenticationPolicyInformer.
+	AuthenticationPolicies() AuthenticationPolicyInformer
+	// AuthorizationPolicies returns a AuthorizationPolicyInformer.
+	AuthorizationPolicies() AuthorizationPolicyInformer
 }
 
 type version struct {
@@ -38,7 +40,12 @@ func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakList
 	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
 }
 
-// PeerAuthentications returns a PeerAuthenticationInformer.
-func (v *version) PeerAuthentications() PeerAuthenticationInformer {
-	return &peerAuthenticationInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+// AuthenticationPolicies returns a AuthenticationPolicyInformer.
+func (v *version) AuthenticationPolicies() AuthenticationPolicyInformer {
+	return &authenticationPolicyInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
+// AuthorizationPolicies returns a AuthorizationPolicyInformer.
+func (v *version) AuthorizationPolicies() AuthorizationPolicyInformer {
+	return &authorizationPolicyInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
diff --git a/ca/pkg/generated/informers/externalversions/generic.go b/ca/pkg/generated/informers/externalversions/generic.go
index 42abcc2..0536bc5 100644
--- a/ca/pkg/generated/informers/externalversions/generic.go
+++ b/ca/pkg/generated/informers/externalversions/generic.go
@@ -52,8 +52,10 @@ func (f *genericInformer) Lister() cache.GenericLister {
 func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource) (GenericInformer, error) {
 	switch resource {
 	// Group=dubbo.apache.org, Version=v1beta1
-	case v1beta1.SchemeGroupVersion.WithResource("peerauthentications"):
-		return &genericInformer{resource: resource.GroupResource(), informer: f.Dubbo().V1beta1().PeerAuthentications().Informer()}, nil
+	case v1beta1.SchemeGroupVersion.WithResource("authenticationpolicies"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Dubbo().V1beta1().AuthenticationPolicies().Informer()}, nil
+	case v1beta1.SchemeGroupVersion.WithResource("authorizationpolicies"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Dubbo().V1beta1().AuthorizationPolicies().Informer()}, nil
 
 	}
 
diff --git a/ca/pkg/generated/listers/dubbo.apache.org/v1beta1/authenticationpolicy.go b/ca/pkg/generated/listers/dubbo.apache.org/v1beta1/authenticationpolicy.go
new file mode 100644
index 0000000..a2f41dc
--- /dev/null
+++ b/ca/pkg/generated/listers/dubbo.apache.org/v1beta1/authenticationpolicy.go
@@ -0,0 +1,98 @@
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	v1beta1 "github.com/apache/dubbo-admin/ca/pkg/apis/dubbo.apache.org/v1beta1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// AuthenticationPolicyLister helps list AuthenticationPolicies.
+// All objects returned here must be treated as read-only.
+type AuthenticationPolicyLister interface {
+	// List lists all AuthenticationPolicies in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1beta1.AuthenticationPolicy, err error)
+	// AuthenticationPolicies returns an object that can list and get AuthenticationPolicies.
+	AuthenticationPolicies(namespace string) AuthenticationPolicyNamespaceLister
+	AuthenticationPolicyListerExpansion
+}
+
+// authenticationPolicyLister implements the AuthenticationPolicyLister interface.
+type authenticationPolicyLister struct {
+	indexer cache.Indexer
+}
+
+// NewAuthenticationPolicyLister returns a new AuthenticationPolicyLister.
+func NewAuthenticationPolicyLister(indexer cache.Indexer) AuthenticationPolicyLister {
+	return &authenticationPolicyLister{indexer: indexer}
+}
+
+// List lists all AuthenticationPolicies in the indexer.
+func (s *authenticationPolicyLister) List(selector labels.Selector) (ret []*v1beta1.AuthenticationPolicy, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1beta1.AuthenticationPolicy))
+	})
+	return ret, err
+}
+
+// AuthenticationPolicies returns an object that can list and get AuthenticationPolicies.
+func (s *authenticationPolicyLister) AuthenticationPolicies(namespace string) AuthenticationPolicyNamespaceLister {
+	return authenticationPolicyNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// AuthenticationPolicyNamespaceLister helps list and get AuthenticationPolicies.
+// All objects returned here must be treated as read-only.
+type AuthenticationPolicyNamespaceLister interface {
+	// List lists all AuthenticationPolicies in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1beta1.AuthenticationPolicy, err error)
+	// Get retrieves the AuthenticationPolicy from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*v1beta1.AuthenticationPolicy, error)
+	AuthenticationPolicyNamespaceListerExpansion
+}
+
+// authenticationPolicyNamespaceLister implements the AuthenticationPolicyNamespaceLister
+// interface.
+type authenticationPolicyNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all AuthenticationPolicies in the indexer for a given namespace.
+func (s authenticationPolicyNamespaceLister) List(selector labels.Selector) (ret []*v1beta1.AuthenticationPolicy, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1beta1.AuthenticationPolicy))
+	})
+	return ret, err
+}
+
+// Get retrieves the AuthenticationPolicy from the indexer for a given namespace and name.
+func (s authenticationPolicyNamespaceLister) Get(name string) (*v1beta1.AuthenticationPolicy, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1beta1.Resource("authenticationpolicy"), name)
+	}
+	return obj.(*v1beta1.AuthenticationPolicy), nil
+}
diff --git a/ca/pkg/generated/listers/dubbo.apache.org/v1beta1/authorizationpolicy.go b/ca/pkg/generated/listers/dubbo.apache.org/v1beta1/authorizationpolicy.go
new file mode 100644
index 0000000..0ac92ca
--- /dev/null
+++ b/ca/pkg/generated/listers/dubbo.apache.org/v1beta1/authorizationpolicy.go
@@ -0,0 +1,98 @@
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	v1beta1 "github.com/apache/dubbo-admin/ca/pkg/apis/dubbo.apache.org/v1beta1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// AuthorizationPolicyLister helps list AuthorizationPolicies.
+// All objects returned here must be treated as read-only.
+type AuthorizationPolicyLister interface {
+	// List lists all AuthorizationPolicies in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1beta1.AuthorizationPolicy, err error)
+	// AuthorizationPolicies returns an object that can list and get AuthorizationPolicies.
+	AuthorizationPolicies(namespace string) AuthorizationPolicyNamespaceLister
+	AuthorizationPolicyListerExpansion
+}
+
+// authorizationPolicyLister implements the AuthorizationPolicyLister interface.
+type authorizationPolicyLister struct {
+	indexer cache.Indexer
+}
+
+// NewAuthorizationPolicyLister returns a new AuthorizationPolicyLister.
+func NewAuthorizationPolicyLister(indexer cache.Indexer) AuthorizationPolicyLister {
+	return &authorizationPolicyLister{indexer: indexer}
+}
+
+// List lists all AuthorizationPolicies in the indexer.
+func (s *authorizationPolicyLister) List(selector labels.Selector) (ret []*v1beta1.AuthorizationPolicy, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1beta1.AuthorizationPolicy))
+	})
+	return ret, err
+}
+
+// AuthorizationPolicies returns an object that can list and get AuthorizationPolicies.
+func (s *authorizationPolicyLister) AuthorizationPolicies(namespace string) AuthorizationPolicyNamespaceLister {
+	return authorizationPolicyNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// AuthorizationPolicyNamespaceLister helps list and get AuthorizationPolicies.
+// All objects returned here must be treated as read-only.
+type AuthorizationPolicyNamespaceLister interface {
+	// List lists all AuthorizationPolicies in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1beta1.AuthorizationPolicy, err error)
+	// Get retrieves the AuthorizationPolicy from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*v1beta1.AuthorizationPolicy, error)
+	AuthorizationPolicyNamespaceListerExpansion
+}
+
+// authorizationPolicyNamespaceLister implements the AuthorizationPolicyNamespaceLister
+// interface.
+type authorizationPolicyNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all AuthorizationPolicies in the indexer for a given namespace.
+func (s authorizationPolicyNamespaceLister) List(selector labels.Selector) (ret []*v1beta1.AuthorizationPolicy, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1beta1.AuthorizationPolicy))
+	})
+	return ret, err
+}
+
+// Get retrieves the AuthorizationPolicy from the indexer for a given namespace and name.
+func (s authorizationPolicyNamespaceLister) Get(name string) (*v1beta1.AuthorizationPolicy, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1beta1.Resource("authorizationpolicy"), name)
+	}
+	return obj.(*v1beta1.AuthorizationPolicy), nil
+}
diff --git a/ca/pkg/generated/listers/dubbo.apache.org/v1beta1/expansion_generated.go b/ca/pkg/generated/listers/dubbo.apache.org/v1beta1/expansion_generated.go
index 54aeb97..afd41a8 100644
--- a/ca/pkg/generated/listers/dubbo.apache.org/v1beta1/expansion_generated.go
+++ b/ca/pkg/generated/listers/dubbo.apache.org/v1beta1/expansion_generated.go
@@ -17,10 +17,18 @@
 
 package v1beta1
 
-// PeerAuthenticationListerExpansion allows custom methods to be added to
-// PeerAuthenticationLister.
-type PeerAuthenticationListerExpansion interface{}
+// AuthenticationPolicyListerExpansion allows custom methods to be added to
+// AuthenticationPolicyLister.
+type AuthenticationPolicyListerExpansion interface{}
 
-// PeerAuthenticationNamespaceListerExpansion allows custom methods to be added to
-// PeerAuthenticationNamespaceLister.
-type PeerAuthenticationNamespaceListerExpansion interface{}
+// AuthenticationPolicyNamespaceListerExpansion allows custom methods to be added to
+// AuthenticationPolicyNamespaceLister.
+type AuthenticationPolicyNamespaceListerExpansion interface{}
+
+// AuthorizationPolicyListerExpansion allows custom methods to be added to
+// AuthorizationPolicyLister.
+type AuthorizationPolicyListerExpansion interface{}
+
+// AuthorizationPolicyNamespaceListerExpansion allows custom methods to be added to
+// AuthorizationPolicyNamespaceLister.
+type AuthorizationPolicyNamespaceListerExpansion interface{}
diff --git a/ca/pkg/generated/listers/dubbo.apache.org/v1beta1/peerauthentication.go b/ca/pkg/generated/listers/dubbo.apache.org/v1beta1/peerauthentication.go
deleted file mode 100644
index c2f39d1..0000000
--- a/ca/pkg/generated/listers/dubbo.apache.org/v1beta1/peerauthentication.go
+++ /dev/null
@@ -1,98 +0,0 @@
-// Licensed to the Apache Software Foundation (ASF) under one or more
-// contributor license agreements.  See the NOTICE file distributed with
-// this work for additional information regarding copyright ownership.
-// The ASF licenses this file to You under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance with
-// the License.  You may obtain a copy of the License at
-//
-//	http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by lister-gen. DO NOT EDIT.
-
-package v1beta1
-
-import (
-	v1beta1 "github.com/apache/dubbo-admin/ca/pkg/apis/dubbo.apache.org/v1beta1"
-	"k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/client-go/tools/cache"
-)
-
-// PeerAuthenticationLister helps list PeerAuthentications.
-// All objects returned here must be treated as read-only.
-type PeerAuthenticationLister interface {
-	// List lists all PeerAuthentications in the indexer.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1beta1.PeerAuthentication, err error)
-	// PeerAuthentications returns an object that can list and get PeerAuthentications.
-	PeerAuthentications(namespace string) PeerAuthenticationNamespaceLister
-	PeerAuthenticationListerExpansion
-}
-
-// peerAuthenticationLister implements the PeerAuthenticationLister interface.
-type peerAuthenticationLister struct {
-	indexer cache.Indexer
-}
-
-// NewPeerAuthenticationLister returns a new PeerAuthenticationLister.
-func NewPeerAuthenticationLister(indexer cache.Indexer) PeerAuthenticationLister {
-	return &peerAuthenticationLister{indexer: indexer}
-}
-
-// List lists all PeerAuthentications in the indexer.
-func (s *peerAuthenticationLister) List(selector labels.Selector) (ret []*v1beta1.PeerAuthentication, err error) {
-	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1beta1.PeerAuthentication))
-	})
-	return ret, err
-}
-
-// PeerAuthentications returns an object that can list and get PeerAuthentications.
-func (s *peerAuthenticationLister) PeerAuthentications(namespace string) PeerAuthenticationNamespaceLister {
-	return peerAuthenticationNamespaceLister{indexer: s.indexer, namespace: namespace}
-}
-
-// PeerAuthenticationNamespaceLister helps list and get PeerAuthentications.
-// All objects returned here must be treated as read-only.
-type PeerAuthenticationNamespaceLister interface {
-	// List lists all PeerAuthentications in the indexer for a given namespace.
-	// Objects returned here must be treated as read-only.
-	List(selector labels.Selector) (ret []*v1beta1.PeerAuthentication, err error)
-	// Get retrieves the PeerAuthentication from the indexer for a given namespace and name.
-	// Objects returned here must be treated as read-only.
-	Get(name string) (*v1beta1.PeerAuthentication, error)
-	PeerAuthenticationNamespaceListerExpansion
-}
-
-// peerAuthenticationNamespaceLister implements the PeerAuthenticationNamespaceLister
-// interface.
-type peerAuthenticationNamespaceLister struct {
-	indexer   cache.Indexer
-	namespace string
-}
-
-// List lists all PeerAuthentications in the indexer for a given namespace.
-func (s peerAuthenticationNamespaceLister) List(selector labels.Selector) (ret []*v1beta1.PeerAuthentication, err error) {
-	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
-		ret = append(ret, m.(*v1beta1.PeerAuthentication))
-	})
-	return ret, err
-}
-
-// Get retrieves the PeerAuthentication from the indexer for a given namespace and name.
-func (s peerAuthenticationNamespaceLister) Get(name string) (*v1beta1.PeerAuthentication, error) {
-	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
-	if err != nil {
-		return nil, err
-	}
-	if !exists {
-		return nil, errors.NewNotFound(v1beta1.Resource("peerauthentication"), name)
-	}
-	return obj.(*v1beta1.PeerAuthentication), nil
-}
diff --git a/ca/pkg/k8s/client.go b/ca/pkg/k8s/client.go
index b03e945..e264478 100644
--- a/ca/pkg/k8s/client.go
+++ b/ca/pkg/k8s/client.go
@@ -22,6 +22,7 @@ import (
 	"github.com/apache/dubbo-admin/ca/pkg/config"
 	"github.com/apache/dubbo-admin/ca/pkg/logger"
 	"github.com/apache/dubbo-admin/ca/pkg/rule/authentication"
+	"github.com/apache/dubbo-admin/ca/pkg/rule/authorization"
 	admissionregistrationV1 "k8s.io/api/admissionregistration/v1"
 	k8sauth "k8s.io/api/authentication/v1"
 	v1 "k8s.io/api/core/v1"
@@ -46,7 +47,7 @@ type Client interface {
 	VerifyServiceAccount(token string) bool
 	UpdateWebhookConfig(options *config.Options, storage cert.Storage)
 	GetNamespaceLabels(namespace string) map[string]string
-	InitController(paHandler authentication.Handler)
+	InitController(paHandler authentication.Handler, apHandler authorization.Handler)
 }
 
 type ClientImpl struct {
@@ -288,12 +289,14 @@ func (c *ClientImpl) UpdateWebhookConfig(options *config.Options, storage cert.S
 	}
 }
 
-func (c *ClientImpl) InitController(paHandler authentication.Handler) {
+func (c *ClientImpl) InitController(paHandler authentication.Handler, apHandler authorization.Handler) {
 	informerFactory := informers.NewSharedInformerFactory(c.informerClient, time.Second*30)
 
 	stopCh := make(chan struct{})
 	NewController(c.informerClient,
 		paHandler,
-		informerFactory.Dubbo().V1beta1().PeerAuthentications())
+		apHandler,
+		informerFactory.Dubbo().V1beta1().AuthenticationPolicies(),
+		informerFactory.Dubbo().V1beta1().AuthorizationPolicies())
 	informerFactory.Start(stopCh)
 }
diff --git a/ca/pkg/k8s/controller.go b/ca/pkg/k8s/controller.go
index 113786e..0d26540 100644
--- a/ca/pkg/k8s/controller.go
+++ b/ca/pkg/k8s/controller.go
@@ -19,9 +19,9 @@ import (
 	"github.com/apache/dubbo-admin/ca/pkg/apis/dubbo.apache.org/v1beta1"
 	clientset "github.com/apache/dubbo-admin/ca/pkg/generated/clientset/versioned"
 	informers "github.com/apache/dubbo-admin/ca/pkg/generated/informers/externalversions/dubbo.apache.org/v1beta1"
-	listers "github.com/apache/dubbo-admin/ca/pkg/generated/listers/dubbo.apache.org/v1beta1"
 	"github.com/apache/dubbo-admin/ca/pkg/logger"
 	"github.com/apache/dubbo-admin/ca/pkg/rule/authentication"
+	"github.com/apache/dubbo-admin/ca/pkg/rule/authorization"
 	"k8s.io/client-go/tools/cache"
 )
 
@@ -41,30 +41,47 @@ type Controller struct {
 	// dubboClientSet is a clientset for our own API group
 	dubboClientSet clientset.Interface
 
-	paListener listers.PeerAuthenticationLister
-	paSynced   cache.InformerSynced
+	acSynced cache.InformerSynced
+	apSynced cache.InformerSynced
 
-	paHandler authentication.Handler
+	acHandler authentication.Handler
+	apHandler authorization.Handler
 }
 
 // NewController returns a new sample controller
 func NewController(
 	clientSet clientset.Interface,
-	paHandler authentication.Handler,
-	paInformer informers.PeerAuthenticationInformer) *Controller {
+	acHandler authentication.Handler,
+	apHandler authorization.Handler,
+	acInformer informers.AuthenticationPolicyInformer,
+	apInformer informers.AuthorizationPolicyInformer) *Controller {
 
 	controller := &Controller{
 		dubboClientSet: clientSet,
-		paListener:     paInformer.Lister(),
-		paSynced:       paInformer.Informer().HasSynced,
+		acSynced:       acInformer.Informer().HasSynced,
+		apSynced:       apInformer.Informer().HasSynced,
 
-		//workQueue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "Dubbo-Authority"),
-		paHandler: paHandler,
+		acHandler: acHandler,
+		apHandler: apHandler,
 	}
 
 	logger.Sugar.Info("Setting up event handlers")
 	// Set up an event handler for when Foo resources change
-	_, err := paInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+	_, err := acInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc: func(obj interface{}) {
+			controller.handleEvent(obj, AddNotification)
+		},
+		UpdateFunc: func(oldObj, newObj interface{}) {
+			controller.handleEvent(newObj, UpdateNotification)
+		},
+		DeleteFunc: func(obj interface{}) {
+			controller.handleEvent(obj, DeleteNotification)
+		},
+	})
+	if err != nil {
+		return nil
+	}
+	_, err = apInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
 		AddFunc: func(obj interface{}) {
 			controller.handleEvent(obj, AddNotification)
 		},
@@ -89,28 +106,41 @@ func (c *Controller) handleEvent(obj interface{}, eventType NotificationType) {
 		return
 	}
 
-	pa, ok := obj.(*v1beta1.PeerAuthentication)
-	if !ok {
+	switch o := obj.(type) {
+	case *v1beta1.AuthenticationPolicy:
+		a := CopyToAuthentication(key, o)
+
+		switch eventType {
+		case AddNotification:
+			c.acHandler.Add(key, a)
+		case UpdateNotification:
+			c.acHandler.Update(key, a)
+		case DeleteNotification:
+			c.acHandler.Delete(key)
+		}
+		return
+	case *v1beta1.AuthorizationPolicy:
+		a := CopyToAuthorization(key, o)
+
+		switch eventType {
+		case AddNotification:
+			c.apHandler.Add(key, a)
+		case UpdateNotification:
+			c.apHandler.Update(key, a)
+		case DeleteNotification:
+			c.apHandler.Delete(key)
+		}
+	default:
 		logger.Sugar.Errorf("unexpected object type: %v", obj)
 		return
 	}
 
-	a := CopyToAuthentication(key, pa)
-
-	switch eventType {
-	case AddNotification:
-		c.paHandler.Add(key, a)
-	case UpdateNotification:
-		c.paHandler.Update(key, a)
-	case DeleteNotification:
-		c.paHandler.Delete(key)
-	}
 }
 
-func CopyToAuthentication(key string, pa *v1beta1.PeerAuthentication) *authentication.PeerAuthentication {
-	a := &authentication.PeerAuthentication{}
+func CopyToAuthentication(key string, pa *v1beta1.AuthenticationPolicy) *authentication.Policy {
+	a := &authentication.Policy{}
 	a.Name = key
-	a.Spec = &authentication.PeerAuthenticationSpec{}
+	a.Spec = &authentication.PolicySpec{}
 	a.Spec.Action = pa.Spec.Action
 	if pa.Spec.Rules != nil {
 		for _, rule := range pa.Spec.Rules {
@@ -132,7 +162,7 @@ func CopyToAuthentication(key string, pa *v1beta1.PeerAuthentication) *authentic
 			}
 			if rule.From.Extends != nil {
 				for _, extends := range rule.From.Extends {
-					r.From.Extends = append(r.From.Extends, &authentication.ExtendConfig{
+					r.From.Extends = append(r.From.Extends, &authentication.Extend{
 						Key:   extends.Key,
 						Value: extends.Value,
 					})
@@ -140,7 +170,7 @@ func CopyToAuthentication(key string, pa *v1beta1.PeerAuthentication) *authentic
 			}
 			if rule.From.NotExtends != nil {
 				for _, notExtend := range rule.From.NotExtends {
-					r.From.NotExtends = append(r.From.NotExtends, &authentication.ExtendConfig{
+					r.From.NotExtends = append(r.From.NotExtends, &authentication.Extend{
 						Key:   notExtend.Key,
 						Value: notExtend.Value,
 					})
@@ -148,7 +178,7 @@ func CopyToAuthentication(key string, pa *v1beta1.PeerAuthentication) *authentic
 			}
 			if rule.To.Extends != nil {
 				for _, extends := range rule.To.Extends {
-					r.To.Extends = append(r.To.Extends, &authentication.ExtendConfig{
+					r.To.Extends = append(r.To.Extends, &authentication.Extend{
 						Key:   extends.Key,
 						Value: extends.Value,
 					})
@@ -156,7 +186,7 @@ func CopyToAuthentication(key string, pa *v1beta1.PeerAuthentication) *authentic
 			}
 			if rule.To.NotExtends != nil {
 				for _, notExtend := range rule.To.NotExtends {
-					r.To.NotExtends = append(r.To.NotExtends, &authentication.ExtendConfig{
+					r.To.NotExtends = append(r.To.NotExtends, &authentication.Extend{
 						Key:   notExtend.Key,
 						Value: notExtend.Value,
 					})
@@ -169,3 +199,86 @@ func CopyToAuthentication(key string, pa *v1beta1.PeerAuthentication) *authentic
 	a.Spec.MatchType = pa.Spec.MatchType
 	return a
 }
+
+func CopyToAuthorization(key string, pa *v1beta1.AuthorizationPolicy) *authorization.Policy {
+	a := &authorization.Policy{}
+	a.Name = key
+	a.Spec = &authorization.PolicySpec{}
+	a.Spec.Action = pa.Spec.Action
+	if pa.Spec.Rules != nil {
+		for _, rule := range pa.Spec.Rules {
+			r := &authorization.Rule{
+				From: &authorization.Source{
+					Namespaces:    rule.From.Namespaces,
+					NotNamespaces: rule.From.NotNamespaces,
+					IpBlocks:      rule.From.IpBlocks,
+					NotIpBlocks:   rule.From.NotIpBlocks,
+					Principals:    rule.From.Principals,
+					NotPrincipals: rule.From.NotPrincipals,
+				},
+				To: &authorization.Target{
+					IpBlocks:      rule.To.IpBlocks,
+					NotIpBlocks:   rule.To.NotIpBlocks,
+					Principals:    rule.To.Principals,
+					NotPrincipals: rule.To.NotPrincipals,
+				},
+				When: &authorization.Condition{
+					Key: rule.When.Key,
+				},
+			}
+			if rule.From.Extends != nil {
+				for _, extends := range rule.From.Extends {
+					r.From.Extends = append(r.From.Extends, &authorization.Extend{
+						Key:   extends.Key,
+						Value: extends.Value,
+					})
+				}
+			}
+			if rule.From.NotExtends != nil {
+				for _, notExtend := range rule.From.NotExtends {
+					r.From.NotExtends = append(r.From.NotExtends, &authorization.Extend{
+						Key:   notExtend.Key,
+						Value: notExtend.Value,
+					})
+				}
+			}
+			if rule.To.Extends != nil {
+				for _, extends := range rule.To.Extends {
+					r.To.Extends = append(r.To.Extends, &authorization.Extend{
+						Key:   extends.Key,
+						Value: extends.Value,
+					})
+				}
+			}
+			if rule.To.NotExtends != nil {
+				for _, notExtend := range rule.To.NotExtends {
+					r.To.NotExtends = append(r.To.NotExtends, &authorization.Extend{
+						Key:   notExtend.Key,
+						Value: notExtend.Value,
+					})
+				}
+			}
+			if rule.When.Values != nil {
+				for _, value := range rule.When.Values {
+					r.When.Values = append(r.When.Values, &authorization.Match{
+						Type:  value.Type,
+						Value: value.Value,
+					})
+				}
+			}
+			if rule.When.NotValues != nil {
+				for _, notValue := range rule.When.NotValues {
+					r.When.Values = append(r.When.Values, &authorization.Match{
+						Type:  notValue.Type,
+						Value: notValue.Value,
+					})
+				}
+			}
+
+			a.Spec.Rules = append(a.Spec.Rules, r)
+		}
+	}
+	a.Spec.Samples = pa.Spec.Samples
+	a.Spec.MatchType = pa.Spec.MatchType
+	return a
+}
diff --git a/ca/pkg/k8s/controller_test.go b/ca/pkg/k8s/controller_test.go
index 4fd770b..780178d 100644
--- a/ca/pkg/k8s/controller_test.go
+++ b/ca/pkg/k8s/controller_test.go
@@ -19,6 +19,7 @@ import (
 	"github.com/apache/dubbo-admin/ca/pkg/config"
 	"github.com/apache/dubbo-admin/ca/pkg/logger"
 	"github.com/apache/dubbo-admin/ca/pkg/rule/authentication"
+	"github.com/apache/dubbo-admin/ca/pkg/rule/authorization"
 	"testing"
 )
 
@@ -26,7 +27,7 @@ func TestName(t *testing.T) {
 	logger.Init()
 	client := NewClient()
 	client.Init(&config.Options{})
-	client.InitController(authentication.NewHandler())
+	client.InitController(authentication.NewHandler(), authorization.NewHandler())
 
 	ch := make(chan struct{})
 	<-ch
diff --git a/ca/pkg/rule/authentication/definition.go b/ca/pkg/rule/authentication/definition.go
index 914c20a..5ea0835 100644
--- a/ca/pkg/rule/authentication/definition.go
+++ b/ca/pkg/rule/authentication/definition.go
@@ -1,12 +1,27 @@
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package authentication
 
-type PeerAuthentication struct {
+type Policy struct {
 	Name string `json:"name,omitempty"`
 
-	Spec *PeerAuthenticationSpec `json:"spec"`
+	Spec *PolicySpec `json:"spec"`
 }
 
-type PeerAuthenticationSpec struct {
+type PolicySpec struct {
 	Action    string  `json:"action,omitempty"`
 	Rules     []*Rule `json:"rules,omitempty"`
 	Order     int     `json:"order,omitempty"`
@@ -19,26 +34,26 @@ type Rule struct {
 }
 
 type Source struct {
-	Namespaces    []string        `json:"namespaces,omitempty"`
-	NotNamespaces []string        `json:"notNamespaces,omitempty"`
-	IpBlocks      []string        `json:"ipBlocks,omitempty"`
-	NotIpBlocks   []string        `json:"notIpBlocks,omitempty"`
-	Principals    []string        `json:"principals,omitempty"`
-	NotPrincipals []string        `json:"notPrincipals,omitempty"`
-	Extends       []*ExtendConfig `json:"extends,omitempty"`
-	NotExtends    []*ExtendConfig `json:"notExtends,omitempty"`
+	Namespaces    []string  `json:"namespaces,omitempty"`
+	NotNamespaces []string  `json:"notNamespaces,omitempty"`
+	IpBlocks      []string  `json:"ipBlocks,omitempty"`
+	NotIpBlocks   []string  `json:"notIpBlocks,omitempty"`
+	Principals    []string  `json:"principals,omitempty"`
+	NotPrincipals []string  `json:"notPrincipals,omitempty"`
+	Extends       []*Extend `json:"extends,omitempty"`
+	NotExtends    []*Extend `json:"notExtends,omitempty"`
 }
 
 type Target struct {
-	IpBlocks      []string        `json:"ipBlocks,omitempty"`
-	NotIpBlocks   []string        `json:"notIpBlocks,omitempty"`
-	Principals    []string        `json:"principals,omitempty"`
-	NotPrincipals []string        `json:"notPrincipals,omitempty"`
-	Extends       []*ExtendConfig `json:"extends,omitempty"`
-	NotExtends    []*ExtendConfig `json:"notExtends,omitempty"`
+	IpBlocks      []string  `json:"ipBlocks,omitempty"`
+	NotIpBlocks   []string  `json:"notIpBlocks,omitempty"`
+	Principals    []string  `json:"principals,omitempty"`
+	NotPrincipals []string  `json:"notPrincipals,omitempty"`
+	Extends       []*Extend `json:"extends,omitempty"`
+	NotExtends    []*Extend `json:"notExtends,omitempty"`
 }
 
-type ExtendConfig struct {
+type Extend struct {
 	Key   string `json:"key,omitempty"`
 	Value string `json:"value,omitempty"`
 }
diff --git a/ca/pkg/rule/authentication/handler.go b/ca/pkg/rule/authentication/handler.go
index ee57539..cfb36e5 100644
--- a/ca/pkg/rule/authentication/handler.go
+++ b/ca/pkg/rule/authentication/handler.go
@@ -1,28 +1,43 @@
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
 package authentication
 
 type Handler interface {
-	Add(key string, obj *PeerAuthentication)
-	Update(key string, newObj *PeerAuthentication)
+	Add(key string, obj *Policy)
+	Update(key string, newObj *Policy)
 	Delete(key string)
 }
 
 type Impl struct {
 	Handler
 
-	cache map[string]*PeerAuthentication
+	cache map[string]*Policy
 }
 
 func NewHandler() Handler {
 	return &Impl{
-		cache: map[string]*PeerAuthentication{},
+		cache: map[string]*Policy{},
 	}
 }
 
-func (i *Impl) Add(key string, obj *PeerAuthentication) {
+func (i *Impl) Add(key string, obj *Policy) {
 	i.cache[key] = obj
 }
 
-func (i *Impl) Update(key string, newObj *PeerAuthentication) {
+func (i *Impl) Update(key string, newObj *Policy) {
 	i.cache[key] = newObj
 }
 
diff --git a/ca/pkg/rule/authorization/definition.go b/ca/pkg/rule/authorization/definition.go
new file mode 100644
index 0000000..ee95891
--- /dev/null
+++ b/ca/pkg/rule/authorization/definition.go
@@ -0,0 +1,71 @@
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package authorization
+
+type Policy struct {
+	Name string `json:"name,omitempty"`
+
+	Spec *PolicySpec `json:"spec"`
+}
+
+type PolicySpec struct {
+	Action    string  `json:"action,omitempty"`
+	Rules     []*Rule `json:"rules,omitempty"`
+	Samples   float32 `json:"samples,omitempty"`
+	MatchType string  `json:"matchType,omitempty"`
+}
+
+type Rule struct {
+	From *Source    `json:"from,omitempty"`
+	To   *Target    `json:"to,omitempty"`
+	When *Condition `json:"when,omitempty"`
+}
+
+type Source struct {
+	Namespaces    []string  `json:"namespaces,omitempty"`
+	NotNamespaces []string  `json:"notNamespaces,omitempty"`
+	IpBlocks      []string  `json:"ipBlocks,omitempty"`
+	NotIpBlocks   []string  `json:"notIpBlocks,omitempty"`
+	Principals    []string  `json:"principals,omitempty"`
+	NotPrincipals []string  `json:"notPrincipals,omitempty"`
+	Extends       []*Extend `json:"extends,omitempty"`
+	NotExtends    []*Extend `json:"notExtends,omitempty"`
+}
+
+type Target struct {
+	IpBlocks      []string  `json:"ipBlocks,omitempty"`
+	NotIpBlocks   []string  `json:"notIpBlocks,omitempty"`
+	Principals    []string  `json:"principals,omitempty"`
+	NotPrincipals []string  `json:"notPrincipals,omitempty"`
+	Extends       []*Extend `json:"extends,omitempty"`
+	NotExtends    []*Extend `json:"notExtends,omitempty"`
+}
+
+type Condition struct {
+	Key       string   `json:"key,omitempty"`
+	Values    []*Match `json:"values,omitempty"`
+	NotValues []*Match `json:"notValues,omitempty"`
+}
+
+type Match struct {
+	Type  string `json:"type,omitempty"`
+	Value string `json:"value,omitempty"`
+}
+
+type Extend struct {
+	Key   string `json:"key,omitempty"`
+	Value string `json:"value,omitempty"`
+}