(
http.host eq "bitbucket.company.com" or
http.host eq "ldap.company.com"
) 
and
(
ip.src ne 5.5.5.5 or
ip.src ne 3.3.3.3
)
=> BLOCK

(http.host in {"bitbucket.company.com" "ldap.company.com"})
and
(not ip.src in {5.5.5.5 3.3.3.3})

apiVersion: v1
kind: Secret
metadata:
  labels:
    app: test
  name: test
  namespace: default
type: Opaque
stringData:
  app: secret_string
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: test
  name: test
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: test
  template:
    metadata:
      labels:
        app: test
    spec:
      containers:
      - name: test
        image: busybox:latest
        imagePullPolicy: Always
        command:
         - sleep
         - "9999999"
        volumeMounts:
        - mountPath: /bin/secret_key_file
          name: test
          subPath: app
      volumes:
      - name: test
        secret:
          secretName: test