If specified, a match requires all labels to exist on a Kubernetes Service. When used in a networking policy, omission matches any labels. When used in a Gloo Mesh Role, a wildcard ("*") must be specified to match any label key and/or value.
namespaces
[]string
repeated
If specified, match Kubernetes Services if they exist in one of the specified namespaces. When used in a networking policy, omission matches any namespace. When used in a Gloo Mesh Role, a wildcard ("*") must be specified to match any namespace.
clusters
[]string
repeated
If specified, match Kubernetes Services if they exist in one of the specified clusters. When used in a networking policy, omission matches any cluster. When used in a Gloo Mesh Role, a wildcard ("*") must be specified to match any cluster.
Match Kubernetes Services by direct reference. When used in a networking policy, omission of any field (name, namespace, or clusterName) allows matching any value for that field. When used in a Gloo Mesh Role, a wildcard ("*") must be specified to match any value for the given field.
IdentitySelector
Select Destination identities using one or more platform-specific selectors.
Match request identities based on the Kubernetes service account of the request.
IdentitySelector.KubeIdentityMatcher
Field
Type
Label
Description
namespaces
[]string
repeated
If specified, match a Kubernetes identity if it exists in one of the specified namespaces. When used in a networking policy, omission matches any namespace. When used in a Gloo Mesh Role, a wildcard ("*") must be specified to match any namespace.
clusters
[]string
repeated
If specified, match a Kubernetes identity if it exists in one of the specified clusters. When used in a networking policy, omission matches any cluster. When used in a Gloo Mesh Role, a wildcard ("*") must be specified to match any cluster.
Match Kubernetes service accounts by direct reference. When used in a networking policy, omission of any field (name, namespace, or clusterName) allows matching any value for that field. When used in a Gloo Mesh Role, a wildcard ("*") must be specified to match any value for the given field.
WorkloadSelector
Select Workloads using one or more platform-specific selectors.
If specified, all labels must exist on Kubernetes workload. When used in a networking policy, omission matches any labels. When used in a Gloo Mesh Role, a wildcard ("*") must be specified to match any label key and/or value.
namespaces
[]string
repeated
If specified, match Kubernetes workloads if they exist in one of the specified namespaces. When used in a networking policy, omission matches any namespace. When used in a Gloo Mesh Role, a wildcard ("*") must be specified to match any namespace.
clusters
[]string
repeated
If specified, match Kubernetes workloads if they exist in one of the specified clusters. When used in a networking policy, omission matches any cluster. When used in a Gloo Mesh Role, a wildcard ("*") must be specified to match any cluster.