//
  // If podSelector is also set, then the NetworkPolicyPeer as a whole selects
  // the pods matching podSelector in the namespaces selected by namespaceSelector.
  // Otherwise it selects all pods in the namespaces selected by namespaceSelector.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 2;

  repeated PodDisruptionBudget items = 2;
}

// PodDisruptionBudgetSpec is a description of a PodDisruptionBudget.
message PodDisruptionBudgetSpec {
  // An eviction is allowed if at least "minAvailable" pods selected by
  // "selector" will still be available after the eviction, i.e. even in the
  // absence of the evicted pod.  So for example you can prevent all voluntary
  // evictions by specifying "100%".
  // +optional

      name: Node Selectors
      priority: 10
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: BGPAdvertisement allows to advertise the IPs coming from the
          selected IPAddressPools via BGP, setting the parameters of the BGP Advertisement.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation

```

The user-defined overlay uses a path spec that includes the ability to select list items by key. In the example above,
the container with the key-value "name: discovery" is selected from the list of containers, and the command line
parameter with value "30m" is selected to be modified. The advanced overlay capability is described in more detail in
the spec.

## Interaction with controller

	Data        string `json:"cert"`
	Source      string `json:"source"`
	Destination string `json:"destination"`
	State       string `json:"state"`
	SecretMeta
}

// SecretMeta holds selected fields which can be extracted from parsed x509 cert
type SecretMeta struct {
	Valid        bool   `json:"cert_valid"`
	SerialNumber string `json:"serial_number"`
	NotAfter     string `json:"not_after"`

        "multi": true,
        "name": "qrep",
        "options": [
          {
            "selected": false,
            "text": "source",
            "value": "source"
          },
          {
            "selected": true,
            "text": "destination",
            "value": "destination"
          }
        ],
        "query": "source,destination",

  // +optional
  optional string appProtocol = 4;
}

// EndpointSlice represents a subset of the endpoints that implement a service.
// For a given service there may be multiple EndpointSlice objects, selected by
// labels, which must be joined to produce the full set of endpoints.
message EndpointSlice {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // +optional
  optional string appProtocol = 4;
}

// EndpointSlice represents a subset of the endpoints that implement a service.
// For a given service there may be multiple EndpointSlice objects, selected by
// labels, which must be joined to produce the full set of endpoints.
message EndpointSlice {
  // Standard object's metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  //
  // If PodSelector is also set, then the NetworkPolicyPeer as a whole selects
  // the Pods matching PodSelector in the Namespaces selected by NamespaceSelector.
  // Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 2;

Istio's AuthorizationPolicy has label selectors.
However, we intentionally do not send those as part of the Workload API, in order to keep the size low.

The obvious solution to this is to put the list of selected workloads into the policy itself.
However, this means anytime a workload changes (often), we need to update the policy.

Instead, the opposite was chosen: each workload will list the policies that select it.