Document exportTo restrictions

networking/v1alpha3/destination_rule.proto

@@ -122,9 +122,23 @@ message DestinationRule {
   // service. Traffic policies can be overridden at subset level.
   repeated Subset subsets = 3;
 
-  // The resolution of a DestinationRule to apply to a service occurs in the
-  // context of a hierarchy of namespaces. This rule controls whether those
-  // namespaces are allowed to select this rule.
+  // A list of namespaces to which this destination rule is exported.
+  // The resolution of a destination rule to apply to a service occurs in the
+  // context of a hierarchy of namespaces. Exporting a destination rule allows
+  // it to be included in the resolution hierarchy for services in
+  // other namespaces. This feature provides a mechanism for service owners
+  // and mesh administrators to control the visibility of destination rules
+  // across namespace boundaries.
+  //
+  // If no namespaces are specified then the destination rule is exported to all
+  // namespaces by default.
+  //
+  // The value "." is reserved and defines an export to the same namespace that
+  // the destination rule is declared in. Similarly, the value "*" is reserved and
+  // defines an export to all namespaces.
+  //
+  // NOTE: in the current release, the `exportTo` value is restricted to
+  // "." or "*" (i.e., the current namespace or all namespaces).
   repeated string export_to = 4;
 }
 

networking/v1alpha3/service_entry.proto

@@ -135,7 +135,7 @@ import "networking/v1alpha3/gateway.proto";
 // The following example demonstrates the use of a dedicated egress gateway
 // through which all external service traffic is forwarded.
 // The 'exportTo' field allows for control over the visibility of a service
-// declaration to other namespaces in the mesh. By default a service is exported
+// declaration to other namespaces in the mesh. By default, a service is exported
 // to all namespaces. The following example restricts the visibility to the
 // current namespace, represented by ".", so that it cannot be used by other
 // namespaces.
@@ -196,7 +196,7 @@ import "networking/v1alpha3/gateway.proto";
 //   hosts:
 //   - httpbin.com
 //   exportTo:
-//   - *
+//   - "*"
 //   gateways:
 //   - mesh
 //   - istio-egressgateway
@@ -475,7 +475,7 @@ message ServiceEntry {
   repeated Endpoint endpoints = 6;
 
   // A list of namespaces to which this service is exported. Exporting a service
-  // allows it to used by sidecars, gateways and virtual services defined in
+  // allows it to be used by sidecars, gateways and virtual services defined in
   // other namespaces. This feature provides a mechanism for service owners
   // and mesh administrators to control the visibility of services across
   // namespace boundaries.
@@ -484,12 +484,15 @@ message ServiceEntry {
   // namespaces by default.
   //
   // The value "." is reserved and defines an export to the same namespace that
-  // the service is declared in, similarly the value "*" is reserved and
+  // the service is declared in. Similarly the value "*" is reserved and
   // defines an export to all namespaces.
   //
-  // For a Kubernetes Service the equivalent effect can be achieved by setting
+  // For a Kubernetes Service, the equivalent effect can be achieved by setting
   // the annotation "networking.istio.io/exportTo" to a comma-separated list
   // of namespace names.
+  //
+  // NOTE: in the current release, the `exportTo` value is restricted to
+  // "." or "*" (i.e., the current namespace or all namespaces).
   repeated string export_to = 7;
 
   // The list of subject alternate names allowed for workloads that

networking/v1alpha3/virtual_service.proto

@@ -176,7 +176,7 @@ message VirtualService {
   repeated TCPRoute tcp = 4;
 
   // A list of namespaces to which this virtual service is exported. Exporting a
-  // virtual service allows it to used by sidecars and gateways defined in
+  // virtual service allows it to be used by sidecars and gateways defined in
   // other namespaces. This feature provides a mechanism for service owners
   // and mesh administrators to control the visibility of virtual services
   // across namespace boundaries.
@@ -185,8 +185,11 @@ message VirtualService {
   // namespaces by default.
   //
   // The value "." is reserved and defines an export to the same namespace that
-  // the virtual service is declared in, similarly the value "*" is reserved and
+  // the virtual service is declared in. Similarly the value "*" is reserved and
   // defines an export to all namespaces.
+  //
+  // NOTE: in the current release, the `exportTo` value is restricted to
+  // "." or "*" (i.e., the current namespace or all namespaces).
   repeated string export_to = 6;
 }