// This type is beta-level in 1.8
message NetworkPolicyEgressRule {
  // ports is a list of destination ports for outgoing traffic.
  // Each item in this list is combined using a logical OR. If this field is
  // empty or missing, this rule matches all ports (traffic not restricted by port).
  // If this field is present and contains at least one item, then this rule allows

// This type is beta-level in 1.8
message NetworkPolicyEgressRule {
  // List of destination ports for outgoing traffic.
  // Each item in this list is combined using a logical OR. If this field is
  // empty or missing, this rule matches all ports (traffic not restricted by port).
  // If this field is present and contains at least one item, then this rule allows

  // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.
  // Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"),  but not both.
  // +optional
  repeated string nonResourceURLs = 5;
}

  // +optional
  map<string, string> annotations = 12;

  // List of objects depended by this object. If ALL objects in the list have
  // been deleted, this object will be garbage collected. If this object is managed by a controller,
  // then an entry in this list will point to this controller, with the controller field set to true.
  // There cannot be more than one managing controller.
  // +optional

The obvious solution to this is to put the list of selected workloads into the policy itself.
However, this means anytime a workload changes (often), we need to update the policy.

Instead, the opposite was chosen: each workload will list the policies that select it.
This works out to be more efficient in common cases where policies change much less often than workloads.

```plain
unable to locate an Envoy binary
```

This is documented in this [PR](https://github.com/istio/istio/issues/13677). Once the Envoy binary is available for the Mac,
these tests will hopefully succeed.

* If one uses Docker for Mac for the kubernetes environment be sure to specify the `-istio.test.kube.loadbalancer=false` parameter. This solves an error like:

```plain
service ingress is not available yet

            paths: [ "/allow" ]
            methods: [ "GET" ]
      from:
        - source:
            namespaces: [ "{{ .Allowed.NamespaceName }}" ]
    - to:
        - operation: # GRPC
            ports: [ "{{ (.To.PortForName `grpc`).WorkloadPort }}" ]
            paths: [ "/proto.EchoTestService/Echo" ]
            methods: [ "POST" ]
      from:

            paths: [ "/deny*" ]
            notPaths: ["/deny/allow"]
            methods: [ "GET" ]
      from:
        - source:
            namespaces: [ "{{ .Denied.NamespaceName }}" ]
    - to:
        - operation: # GRPC
            ports: [ "{{ (.To.PortForName `grpc`).WorkloadPort }}" ]
            paths: [ "/proto.EchoTestService/Echo" ]
            methods: [ "POST" ]

   Contributor) assume the cost of any necessary servicing, repair, or
   correction. This disclaimer of warranty constitutes an essential part of this
   License. No use of  any Covered Software is authorized under this License
   except under this disclaimer.

7. Limitation of Liability

   Under no circumstances and under no legal theory, whether tort (including
   negligence), contract, or otherwise, shall any Contributor, or anyone who

   repair, or correction. This disclaimer of warranty constitutes an essential
   part of this License. No use of  any Covered Software is authorized under
   this License except under this disclaimer.

7. Limitation of Liability

   Under no circumstances and under no legal theory, whether tort (including
   negligence), contract, or otherwise, shall any Contributor, or anyone who