selector.proto

// Copyright 2019 Istio Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";

import "google/api/field_behavior.proto";

// $title: Workload Selector
// $description: Definition of a workload selector.
// $location: https://istio.io/latest/docs/reference/config/networking/sidecar/#WorkloadSelector
// $aliases: [https://istio.io/docs/reference/config/type/v1beta1/workload-selector.html]

package istio.type.v1beta1;

option go_package="istio.io/api/type/v1beta1";

// WorkloadSelector specifies the criteria used to determine if a policy can be applied
// to a proxy. The matching criteria includes the metadata associated with a proxy,
// workload instance info such as labels attached to the pod/VM, or any other info
// that the proxy provides to Istio during the initial handshake. If multiple conditions are
// specified, all conditions need to match in order for the workload instance to be
// selected. Currently, only label based selection mechanism is supported.
message WorkloadSelector {
  // One or more labels that indicate a specific set of pods/VMs
  // on which a policy should be applied. The scope of label search is restricted to
  // the configuration namespace in which the resource is present.
  map<string, string> match_labels = 1 [(google.api.field_behavior) = REQUIRED];
}