`foo=bar,istio=ingressgateway`:

```yaml
name: my-custom-gateway # Override the name to match existing resources
labels:
  app: "" # Unset default app selector label
  istio: ingressgateway # override default istio selector label
  foo: bar # Add the existing custom selector label
```

#### Migrating an existing Helm release

		nsMatchedLabels := make([]string, 0)
		podMatchedLabels := make([]string, 0)
		extractMatchLabels := func(selector *metav1.LabelSelector) []string {
			if selector == nil {
				return nil
			}
			labels := make([]string, 0)
			for _, me := range selector.MatchExpressions {
				if me.Operator != metav1.LabelSelectorOpIn {
					continue
				}
				for _, v := range me.Values {

			cmd.HelpFunc()(cmd, args)
			return nil
		},
	}

	istiodLog := istiodLogCmd(ctx)
	adminCmd.AddCommand(istiodLog)
	adminCmd.PersistentFlags().StringVarP(&istiodLabelSelector, "selector", "l", "app=istiod", "label selector")

	return adminCmd

# proto-file: devtools/build_cleaner/proto/actions.proto
# proto-message: ActionSpecs

# Python rules should not have more than one source file.
action_spec {
  action: CHECK_FILE_COUNT
  file_count_params {
    rule_selector {
      rule_kind_regex: "^.*py(type)?(_strict)?_(binary|library|test).*$"
      generator_function_regex: "^(?!boq_header)$"
    }
    max_source_count: 1
  }

        return when (val firExpression = possibleFunctionCall.getOrBuildFir(analysisSession.firResolveSession)) {
            is FirSmartCastExpression -> firExpression
            is FirSafeCallExpression -> firExpression.selector as? FirSmartCastExpression
            is FirImplicitInvokeCall -> firExpression.explicitReceiver as? FirSmartCastExpression
            else -> null
        }
    }

    name: istio-operator
  name: istio-operator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
spec:
  ports:
  - name: http-metrics
    port: 8383
    targetPort: 8383
    protocol: TCP
  selector:
    name: istio-operator

```yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: strict-and-permissive-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: STRICT
  portLevelMtls:
    9090:
      mode: PERMISSIVE
```

will be translated into this `Authorization`:

```yaml
action: DENY
groups:

 * connection the client has many options:
 *
 *  * **HTTP proxy:** a proxy server may be explicitly configured for the client. Otherwise, the
 *    [proxy selector][java.net.ProxySelector] is used. It may return multiple proxies to attempt.
 *  * **IP address:** whether connecting directly to an origin server or a proxy, opening a socket

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello
spec:
  replicas: 7
  selector:
    matchLabels:
      app: hello
      tier: backend
      track: stable
  template:
    metadata:
      annotations:
        proxy.istio.io/config: '{ "holdApplicationUntilProxyStarts": true }'
      labels:
        app: hello
        tier: backend
        track: stable
    spec:
      containers:
        - name: hello

   * Returns this address's explicitly-specified HTTP proxy, or null to delegate to the
   * [proxy selector][proxySelector].
   */
  @get:JvmName("proxy") val proxy: Proxy?,
  protocols: List<Protocol>,
  connectionSpecs: List<ConnectionSpec>,
  /**
   * Returns this address's proxy selector. Only used if the proxy is null. If none of this
   * selector's proxies are reachable, a direct connection will be attempted.
   */