Add subject_alt_names field in ServiceEntry

networking/v1alpha3/service_entry.proto

@@ -461,4 +461,38 @@ message ServiceEntry {
   // the annotation "networking.istio.io/export_to" to a comma-separated list
   // of namespace names.
   repeated string export_to = 7;
+
+  // $hide_from_docs
+  // The list of subject alternate names allowed for workloads that
+  // implement this service. This information is used to enforce
+  // secure-naming <https://istio.io/docs/concepts/security/#secure-naming>.
+  // If specified, the proxy will verify that the server
+  // certificate's subject alternate name matches one of the specified values.
+  //
+  // The following example illustrates the usage of a subject alternate name
+  // whose format conforms to the SPIFEE standard
+  // <https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md>:
+  //
+  // ```yaml
+  // apiVersion: networking.istio.io/v1alpha3
+  // kind: ServiceEntry
+  // metadata:
+  //   name: httpbin
+  //   namespace : httpbin-ns
+  // spec:
+  //   hosts:
+  //   - httpbin.com
+  //   location: MESH_INTERNAL
+  //   ports:
+  //   - number: 80
+  //     name: http
+  //     protocol: HTTP
+  //   resolution: STATIC
+  //   endpoints:
+  //   - address: 2.2.2.2
+  //   - address: 3.3.3.3
+  //   subjectAltNames:
+  //   - "spiffe://cluster.local/ns/httpbin-ns/sa/httpbin-service-account"
+  // ```
+  repeated string subject_alt_names = 8;
 }

proto.lock

@@ -3455,6 +3455,12 @@
                 "name": "export_to",
                 "type": "string",
                 "is_repeated": true
+              },
+              {
+                "id": 8,
+                "name": "subject_alt_names",
+                "type": "string",
+                "is_repeated": true
               }
             ],
             "messages": [