Workload Selector

3 minute read

WorkloadSelector

WorkloadSelector specifies the criteria used to determine if a policy can be applied to a proxy. The matching criteria includes the metadata associated with a proxy, workload instance info such as labels attached to the pod/VM, or any other info that the proxy provides to Istio during the initial handshake. If multiple conditions are specified, all conditions need to match in order for the workload instance to be selected. Currently, only label based selection mechanism is supported.

Field	Type	Description	Required
`matchLabels`	`map<string, string>`	One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. The scope of label search is restricted to the configuration namespace in which the resource is present.	No

PortSelector

PortSelector is the criteria for specifying if a policy can be applied to a listener having a specific port.

Field	Type	Description	Required
`number`	`uint32`	Port number	Yes

PolicyTargetReference

PolicyTargetReference format as defined by GEP-2648.

PolicyTargetReference specifies the targeted resource which the policy should be applied to. It must only target a single resource at a time, but it can be used to target larger resources such as Gateways that may apply to multiple child resources. The PolicyTargetReference will be used instead of a WorkloadSelector in the RequestAuthentication, AuthorizationPolicy, Telemetry, and WasmPlugin CRDs to target a Kubernetes Gateway.

The following is an example of an AuthorizationPolicy bound to a waypoint proxy using a PolicyTargetReference. The example sets action to DENY to create a deny policy. It denies all the requests with POST method on port 8080 directed through the waypoint Gateway in the foo namespace.

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: httpbin
  namespace: foo
spec:
  targetRefs:
  - name: waypoint
    kind: Gateway
    group: gateway.networking.k8s.io
  action: DENY
  rules:
  - to:
    - operation:
        methods: ["POST"]
        ports: ["8080"]

Field	Type	Description	Required
`group`	`string`	group is the group of the target resource.	No
`kind`	`string`	kind is kind of the target resource.	Yes
`name`	`string`	name is the name of the target resource.	Yes
`namespace`	`string`	namespace is the namespace of the referent. When unspecified, the local namespace is inferred.	No

WorkloadMode

WorkloadMode allows selection of the role of the underlying workload in network traffic. A workload is considered as acting as a SERVER if it is the destination of the traffic (that is, traffic direction, from the perspective of the workload is inbound). If the workload is the source of the network traffic, it is considered to be in CLIENT mode (traffic is outbound from the workload).

Name	Description
`UNDEFINED`	Default value, which will be interpreted by its own usage.
`CLIENT`	Selects for scenarios when the workload is the source of the network traffic. In addition, if the workload is a gateway, selects this.
`SERVER`	Selects for scenarios when the workload is the destination of the network traffic.
`CLIENT_AND_SERVER`	Selects for scenarios when the workload is either the source or destination of the network traffic.