<p>I'm having an issue where two EnvoyFilters with different workloadSelectors that are supposed to apply to different pods workloads, are instead both being applied to both workloads.</p>
<p>More specifically, I'm using Istio 1.4.9 and I have two instances of the same deployment workload in two different namespaces, and each workload has a sidecar. Each deployment has different labels applied.</p>
<pre class="lang-sh prettyprint-override"><code>kubectl get po --show-labels --all-namespaces -l app=myapp,namespace
NAMESPACE   NAME                    ...truncated...  LABELS
first       myapp-58489c8fcd-kch9f  ...truncated...  app=myapp,namespace=first ...truncated...
second      myapp-6f58dd65dd-tdjm7  ...truncated...  app=myapp,namespace=second ...truncated...
</code></pre>
<p>I want to attach a different instance of a Lua EnvoyFilter to each workload in each namespace, so each has its own filter.  So, for example, the filter for the first namespace looks like the following. The second is similar but with a different workloadSelector</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name:  first-myapp-filter
  ...truncated...
spec:
  workloadSelector:
    labels:
      app: myapp
      namespace: first
</code></pre>
<p>However, I'm seeing that a given workload is processing BOTH envoyfilters instead of only the filter that is matched by the selector. When I look at the listeners on the pod in the first namespace with istioctl, it has BOTH filters attached.</p>
<pre><code>&quot;httpFilters&quot;: [
  {&quot;name&quot;: &quot;envoy.lua&quot;, &quot;config&quot;: {&quot;inlineCode&quot;: &quot;function ...truncated... end\n&quot; }},
  {&quot;name&quot;: &quot;envoy.lua&quot;, &quot;config&quot;: {&quot;inlineCode&quot;: &quot;function ...truncated... end\n&quot; }}
</code></pre>
<p>The selector doesn't seem to be working the way I expect it. Any ideas on how to debug?</p>

<p>Only thing I can think of is that you defined your <code>EnvoyFilter</code> in the <a href="https://istio.io/latest/docs/reference/config/networking/envoy-filter/" rel="nofollow noreferrer">config root namespace</a> and it's ignoring <code>workloadSelector</code>.</p>
<p>If you see the <a href="https://istio.io/latest/docs/reference/config/networking/envoy-filter/" rel="nofollow noreferrer">docs</a>:</p>
<blockquote>
<p>NOTE 3: *_To apply an EnvoyFilter resource to all workloads (sidecars and gateways) in the system, define the resource in the config root namespace, without a workloadSelector.</p>
</blockquote>
<p>Try creating 2 EnvoyFilters, each in each namespace were your workloads exist and delete the original EnvoyFilter. So like this:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name:  first-myapp-filter
  namespace: first
spec:
  workloadSelector:
    labels:
      app: myapp
      namespace: first
...
</code></pre>
<p>and</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name:  second-myapp-filter
  namespace: second
spec:
  workloadSelector:
    labels:
      app: myapp
      namespace: second
...
</code></pre>
<p>Note: you might also want to try different labels. For example, <code>app: myapp1</code>, <code>app: myapp2</code>.</p>
