Define targetRef proto

extensions/v1alpha1/wasm.proto

@@ -240,8 +240,21 @@ message WasmPlugin {
   // namespace. If the `WasmPlugin` is present in the config root
   // namespace, it will be applied to all applicable workloads in any
   // namespace.
+  //
+  // At most one of the selector and targetRef can be set.
   istio.type.v1beta1.WorkloadSelector selector = 1;
 
+  // $hide_from_docs
+  // Optional. The targetRef specifies the gateway the policy should be 
+  // applied to. The targeted resource specified will determine which 
+  // workloads the WasmPlugin applies to. The targeted resource must be 
+  // a k8s gateway. The gateway must be in the same namespace as the policy.
+  //
+  // If the targetRef is not set, the policy is applied as defined by the selector.
+  // At most one of the selector and targetRef can be set.
+  // Waypoint proxies will not respect selectors even if they match.
+  istio.type.v1beta1.PolicyTargetReference targetRef = 15;
+
   // URL of a Wasm module or OCI container. If no scheme is present,
   // defaults to `oci://`, referencing an OCI image. Other valid schemes
   // are `file://` for referencing .wasm module files present locally

proto.lock

@@ -36539,6 +36539,11 @@
                 "name": "selector",
                 "type": "istio.type.v1beta1.WorkloadSelector"
               },
+              {
+                "id": 15,
+                "name": "targetRef",
+                "type": "istio.type.v1beta1.PolicyTargetReference"
+              },
               {
                 "id": 2,
                 "name": "url",
@@ -46818,6 +46823,11 @@
                 "name": "selector",
                 "type": "istio.type.v1beta1.WorkloadSelector"
               },
+              {
+                "id": 5,
+                "name": "targetRef",
+                "type": "istio.type.v1beta1.PolicyTargetReference"
+              },
               {
                 "id": 2,
                 "name": "rules",
@@ -47188,6 +47198,11 @@
                 "name": "selector",
                 "type": "istio.type.v1beta1.WorkloadSelector"
               },
+              {
+                "id": 3,
+                "name": "targetRef",
+                "type": "istio.type.v1beta1.PolicyTargetReference"
+              },
               {
                 "id": 2,
                 "name": "jwt_rules",
@@ -47314,6 +47329,11 @@
                 "name": "selector",
                 "type": "istio.type.v1beta1.WorkloadSelector"
               },
+              {
+                "id": 5,
+                "name": "targetRef",
+                "type": "istio.type.v1beta1.PolicyTargetReference"
+              },
               {
                 "id": 2,
                 "name": "rules",
@@ -47764,6 +47784,11 @@
                 "name": "selector",
                 "type": "istio.type.v1beta1.WorkloadSelector"
               },
+              {
+                "id": 3,
+                "name": "targetRef",
+                "type": "istio.type.v1beta1.PolicyTargetReference"
+              },
               {
                 "id": 2,
                 "name": "jwt_rules",
@@ -47918,6 +47943,11 @@
                 "name": "selector",
                 "type": "istio.type.v1beta1.WorkloadSelector"
               },
+              {
+                "id": 5,
+                "name": "targetRef",
+                "type": "istio.type.v1beta1.PolicyTargetReference"
+              },
               {
                 "id": 2,
                 "name": "tracing",
@@ -48279,6 +48309,32 @@
                 "type": "uint32"
               }
             ]
+          },
+          {
+            "name": "PolicyTargetReference",
+            "fields": [
+              {
+                "id": 1,
+                "name": "group",
+                "type": "string"
+              },
+              {
+                "id": 2,
+                "name": "kind",
+                "type": "string"
+              },
+              {
+                "id": 3,
+                "name": "name",
+                "type": "string"
+              },
+              {
+                "id": 4,
+                "name": "namespace",
+                "type": "string",
+                "optional": true
+              }
+            ]
           }
         ],
         "imports": [

releasenotes/notes/target-ref.yaml

@@ -0,0 +1,12 @@
+apiVersion: release-notes/v2
+kind: feature
+area: traffic-management
+issue:
+  - https://github.com/istio/api/issues/2885
+
+releaseNotes:
+  - |
+    **Added** PolicyTargetReference definition to be used in the RequestAuthentication, AuthorizationPolicy, Telemetry, and WasmPlugin CRDs to target k8s gateways.
+
+docs:
+  - https://docs.google.com/document/d/1MaMdyIQdOwq7mGCVMYW56FED9HrkJa93Nd0S0zBwws4/edit?usp=sharing