<p>I am going through the <a href="https://istio.io/docs/concepts/traffic-management/" rel="nofollow noreferrer">traffic management section</a> of <code>istio</code> 's documentation.</p>

<p>In a <code>DestinationRule</code> example, it configures several service subsets.</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: my-destination-rule
spec:
  host: my-svc
  trafficPolicy:
    loadBalancer:
      simple: RANDOM
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
    trafficPolicy:
      loadBalancer:
        simple: ROUND_ROBIN
  - name: v3
    labels:
      version: v3
</code></pre>

<p>My question (since it is not clear on the documentation) is about the role of <code>spec.subsets.name.labels</code></p>

<p>Do these <code>labels</code> refer to:</p>

<ul>
<li>labels in the corresponding <code>k8s</code> <code>Deployment</code> ?</li>
</ul>

<p>or</p>

<ul>
<li>labels in the pods of the <code>Deployment</code>?</li>
</ul>

<p>Where exactly (in terms of <code>k8s</code> manifests) do the above <code>labels</code> reside?</p>

<p>Istio sticks to the <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/" rel="nofollow noreferrer">labeling paradigm on Kubernetes</a> used to identify resources within the cluster.</p>

<p>Since this particular <code>DestinationRule</code> is intended to determine, at network level, which backends are to serve requests, is targeting pods in the Deployment instead of the Deployment itself (as that is an abstract resource without any network features).</p>

<p>A good example of this is in the <a href="https://github.com/istio/istio/blob/master/samples/tcp-echo/" rel="nofollow noreferrer">Istio sample application repository</a>:</p>

<p>The <a href="https://github.com/istio/istio/blob/master/samples/tcp-echo/tcp-echo.yaml" rel="nofollow noreferrer"><code>Deployment</code></a> doesn't have any <code>version: v1</code> labels. However, the pods grouped in it does:</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: tcp-echo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tcp-echo
      version: v1
  template:
    metadata:
      labels:
        app: tcp-echo
        version: v1
    spec:
      containers:
      - name: tcp-echo
        image: docker.io/istio/tcp-echo-server:1.1
        imagePullPolicy: IfNotPresent
        args: [ "9000", "hello" ]
        ports:
        - containerPort: 9000
</code></pre>

<p>And the <a href="https://github.com/istio/istio/blob/master/samples/tcp-echo/tcp-echo-all-v1.yaml" rel="nofollow noreferrer"><code>DestinationRule</code></a> picks these objects by their version label:</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: tcp-echo-destination
spec:
  host: tcp-echo
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
</code></pre>
