From 6d9360b4b5a52cfb851931e52d248aa4969ff77e Mon Sep 17 00:00:00 2001
From: Shriram Rajagopalan <shriramr@vmware.com>
Date: Tue, 20 Nov 2018 17:02:51 -0500
Subject: [PATCH 01/11] default network scope

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>
---
 mesh/v1alpha1/config.pb.go                   | 420 +++++++++++++++----
 mesh/v1alpha1/config.proto                   |  30 +-
 mesh/v1alpha1/istio.mesh.v1alpha1.pb.html    |  81 +++-
 python/istio_api/mesh/v1alpha1/config_pb2.py | 113 ++++-
 4 files changed, 557 insertions(+), 87 deletions(-)

diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go
index 2e3ffac974..73e1a3562e 100644
--- a/mesh/v1alpha1/config.pb.go
+++ b/mesh/v1alpha1/config.pb.go
@@ -152,6 +152,36 @@ func (MeshConfig_OutboundTrafficPolicy_Mode) EnumDescriptor() ([]byte, []int) {
 	return fileDescriptorConfig, []int{0, 0, 0}
 }
 
+type MeshConfig_NetworkScope_Mode int32
+
+const (
+	// Invalid mode
+	MeshConfig_NetworkScope_INVALID MeshConfig_NetworkScope_Mode = 0
+	// Configure routes to services in all namespaces.
+	MeshConfig_NetworkScope_ALL_NAMESPACES MeshConfig_NetworkScope_Mode = 1
+	// Configure routes to services in the same namespace as the sidecar
+	// in addition to namespaces specified in sharedNamespaces.
+	MeshConfig_NetworkScope_CURRENT_NAMESPACE MeshConfig_NetworkScope_Mode = 2
+)
+
+var MeshConfig_NetworkScope_Mode_name = map[int32]string{
+	0: "INVALID",
+	1: "ALL_NAMESPACES",
+	2: "CURRENT_NAMESPACE",
+}
+var MeshConfig_NetworkScope_Mode_value = map[string]int32{
+	"INVALID":           0,
+	"ALL_NAMESPACES":    1,
+	"CURRENT_NAMESPACE": 2,
+}
+
+func (x MeshConfig_NetworkScope_Mode) String() string {
+	return proto.EnumName(MeshConfig_NetworkScope_Mode_name, int32(x))
+}
+func (MeshConfig_NetworkScope_Mode) EnumDescriptor() ([]byte, []int) {
+	return fileDescriptorConfig, []int{0, 1, 0}
+}
+
 // MeshConfig defines mesh-wide variables shared by all Envoy instances in the
 // Istio service mesh.
 //
@@ -248,6 +278,10 @@ type MeshConfig struct {
 	// Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
 	// Fallback to old identity format(without trust domain) if not set.
 	TrustDomain string `protobuf:"bytes,26,opt,name=trust_domain,json=trustDomain,proto3" json:"trust_domain,omitempty"`
+	// The default network scope associated with every sidecar in the mesh.
+	// Pilot will program the routes in the sidecars accordingly. If omitted,
+	// sidecars will be able to reach every service in the mesh.
+	NetworkScope *MeshConfig_NetworkScope `protobuf:"bytes,28,opt,name=network_scope,json=networkScope" json:"network_scope,omitempty"`
 }
 
 func (m *MeshConfig) Reset()                    { *m = MeshConfig{} }
@@ -430,6 +464,13 @@ func (m *MeshConfig) GetTrustDomain() string {
 	return ""
 }
 
+func (m *MeshConfig) GetNetworkScope() *MeshConfig_NetworkScope {
+	if m != nil {
+		return m.NetworkScope
+	}
+	return nil
+}
+
 type MeshConfig_OutboundTrafficPolicy struct {
 	Mode MeshConfig_OutboundTrafficPolicy_Mode `protobuf:"varint,1,opt,name=mode,proto3,enum=istio.mesh.v1alpha1.MeshConfig_OutboundTrafficPolicy_Mode" json:"mode,omitempty"`
 }
@@ -448,6 +489,35 @@ func (m *MeshConfig_OutboundTrafficPolicy) GetMode() MeshConfig_OutboundTrafficP
 	return MeshConfig_OutboundTrafficPolicy_REGISTRY_ONLY
 }
 
+// Network scope settings for the mesh. Network scope controls the reachability of
+// sidecars to other services in the mesh.
+type MeshConfig_NetworkScope struct {
+	// REQUIRED: The default scope associated with every sidecar in the mesh.
+	DefaultScope MeshConfig_NetworkScope_Mode `protobuf:"varint,1,opt,name=default_scope,json=defaultScope,proto3,enum=istio.mesh.v1alpha1.MeshConfig_NetworkScope_Mode" json:"default_scope,omitempty"`
+	// Specifies one or more namespaces that should be accessible to all sidecars
+	// in the mesh (such as istio-system).
+	SharedNamespaces []string `protobuf:"bytes,2,rep,name=shared_namespaces,json=sharedNamespaces" json:"shared_namespaces,omitempty"`
+}
+
+func (m *MeshConfig_NetworkScope) Reset()                    { *m = MeshConfig_NetworkScope{} }
+func (m *MeshConfig_NetworkScope) String() string            { return proto.CompactTextString(m) }
+func (*MeshConfig_NetworkScope) ProtoMessage()               {}
+func (*MeshConfig_NetworkScope) Descriptor() ([]byte, []int) { return fileDescriptorConfig, []int{0, 1} }
+
+func (m *MeshConfig_NetworkScope) GetDefaultScope() MeshConfig_NetworkScope_Mode {
+	if m != nil {
+		return m.DefaultScope
+	}
+	return MeshConfig_NetworkScope_INVALID
+}
+
+func (m *MeshConfig_NetworkScope) GetSharedNamespaces() []string {
+	if m != nil {
+		return m.SharedNamespaces
+	}
+	return nil
+}
+
 // ConfigSource describes information about a configuration store inside a
 // mesh. A single control plane instance can interact with one or more data
 // sources.
@@ -484,11 +554,13 @@ func (m *ConfigSource) GetTlsSettings() *istio_networking_v1alpha31.TLSSettings
 func init() {
 	proto.RegisterType((*MeshConfig)(nil), "istio.mesh.v1alpha1.MeshConfig")
 	proto.RegisterType((*MeshConfig_OutboundTrafficPolicy)(nil), "istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy")
+	proto.RegisterType((*MeshConfig_NetworkScope)(nil), "istio.mesh.v1alpha1.MeshConfig.NetworkScope")
 	proto.RegisterType((*ConfigSource)(nil), "istio.mesh.v1alpha1.ConfigSource")
 	proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_IngressControllerMode", MeshConfig_IngressControllerMode_name, MeshConfig_IngressControllerMode_value)
 	proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_AuthPolicy", MeshConfig_AuthPolicy_name, MeshConfig_AuthPolicy_value)
 	proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_AccessLogEncoding", MeshConfig_AccessLogEncoding_name, MeshConfig_AccessLogEncoding_value)
 	proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_OutboundTrafficPolicy_Mode", MeshConfig_OutboundTrafficPolicy_Mode_name, MeshConfig_OutboundTrafficPolicy_Mode_value)
+	proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_NetworkScope_Mode", MeshConfig_NetworkScope_Mode_name, MeshConfig_NetworkScope_Mode_value)
 }
 func (m *MeshConfig) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
@@ -718,6 +790,18 @@ func (m *MeshConfig) MarshalTo(dAtA []byte) (int, error) {
 		i++
 		i = encodeVarintConfig(dAtA, i, uint64(m.AccessLogEncoding))
 	}
+	if m.NetworkScope != nil {
+		dAtA[i] = 0xe2
+		i++
+		dAtA[i] = 0x1
+		i++
+		i = encodeVarintConfig(dAtA, i, uint64(m.NetworkScope.Size()))
+		n6, err := m.NetworkScope.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n6
+	}
 	return i, nil
 }
 
@@ -744,6 +828,44 @@ func (m *MeshConfig_OutboundTrafficPolicy) MarshalTo(dAtA []byte) (int, error) {
 	return i, nil
 }
 
+func (m *MeshConfig_NetworkScope) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MeshConfig_NetworkScope) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if m.DefaultScope != 0 {
+		dAtA[i] = 0x8
+		i++
+		i = encodeVarintConfig(dAtA, i, uint64(m.DefaultScope))
+	}
+	if len(m.SharedNamespaces) > 0 {
+		for _, s := range m.SharedNamespaces {
+			dAtA[i] = 0x12
+			i++
+			l = len(s)
+			for l >= 1<<7 {
+				dAtA[i] = uint8(uint64(l)&0x7f | 0x80)
+				l >>= 7
+				i++
+			}
+			dAtA[i] = uint8(l)
+			i++
+			i += copy(dAtA[i:], s)
+		}
+	}
+	return i, nil
+}
+
 func (m *ConfigSource) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
@@ -769,11 +891,11 @@ func (m *ConfigSource) MarshalTo(dAtA []byte) (int, error) {
 		dAtA[i] = 0x12
 		i++
 		i = encodeVarintConfig(dAtA, i, uint64(m.TlsSettings.Size()))
-		n6, err := m.TlsSettings.MarshalTo(dAtA[i:])
+		n7, err := m.TlsSettings.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
-		i += n6
+		i += n7
 	}
 	return i, nil
 }
@@ -882,6 +1004,10 @@ func (m *MeshConfig) Size() (n int) {
 	if m.AccessLogEncoding != 0 {
 		n += 2 + sovConfig(uint64(m.AccessLogEncoding))
 	}
+	if m.NetworkScope != nil {
+		l = m.NetworkScope.Size()
+		n += 2 + l + sovConfig(uint64(l))
+	}
 	return n
 }
 
@@ -894,6 +1020,21 @@ func (m *MeshConfig_OutboundTrafficPolicy) Size() (n int) {
 	return n
 }
 
+func (m *MeshConfig_NetworkScope) Size() (n int) {
+	var l int
+	_ = l
+	if m.DefaultScope != 0 {
+		n += 1 + sovConfig(uint64(m.DefaultScope))
+	}
+	if len(m.SharedNamespaces) > 0 {
+		for _, s := range m.SharedNamespaces {
+			l = len(s)
+			n += 1 + l + sovConfig(uint64(l))
+		}
+	}
+	return n
+}
+
 func (m *ConfigSource) Size() (n int) {
 	var l int
 	_ = l
@@ -1602,6 +1743,39 @@ func (m *MeshConfig) Unmarshal(dAtA []byte) error {
 					break
 				}
 			}
+		case 28:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NetworkScope", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthConfig
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.NetworkScope == nil {
+				m.NetworkScope = &MeshConfig_NetworkScope{}
+			}
+			if err := m.NetworkScope.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipConfig(dAtA[iNdEx:])
@@ -1692,6 +1866,104 @@ func (m *MeshConfig_OutboundTrafficPolicy) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *MeshConfig_NetworkScope) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowConfig
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NetworkScope: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NetworkScope: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DefaultScope", wireType)
+			}
+			m.DefaultScope = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.DefaultScope |= (MeshConfig_NetworkScope_Mode(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SharedNamespaces", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowConfig
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthConfig
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SharedNamespaces = append(m.SharedNamespaces, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipConfig(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthConfig
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *ConfigSource) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -1912,72 +2184,80 @@ var (
 func init() { proto.RegisterFile("mesh/v1alpha1/config.proto", fileDescriptorConfig) }
 
 var fileDescriptorConfig = []byte{
-	// 1071 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x56, 0xdf, 0x4e, 0xe3, 0xc6,
-	0x17, 0xc6, 0x90, 0x85, 0x30, 0xf9, 0xe7, 0x4c, 0x36, 0xcb, 0x90, 0xfd, 0x89, 0x5f, 0x36, 0x55,
-	0x21, 0x42, 0x95, 0x23, 0x40, 0xbd, 0x68, 0xef, 0x42, 0x08, 0xbb, 0x41, 0x21, 0x41, 0xb6, 0xd9,
-	0x96, 0xde, 0x8c, 0x8c, 0x3d, 0x49, 0x46, 0x38, 0x1e, 0xd7, 0x33, 0xde, 0x2e, 0xaf, 0xd5, 0xdb,
-	0xbe, 0x40, 0x2f, 0xfb, 0x08, 0x15, 0x4f, 0x52, 0xcd, 0x8c, 0x03, 0x61, 0x37, 0x12, 0x55, 0xef,
-	0xe2, 0xef, 0x7c, 0xe7, 0x9c, 0x39, 0xdf, 0x39, 0x73, 0x26, 0xa0, 0x31, 0x27, 0x7c, 0xd6, 0xf9,
-	0x74, 0xe4, 0x85, 0xf1, 0xcc, 0x3b, 0xea, 0xf8, 0x2c, 0x9a, 0xd0, 0xa9, 0x15, 0x27, 0x4c, 0x30,
-	0x58, 0xa3, 0x5c, 0x50, 0x66, 0x49, 0x86, 0xb5, 0x60, 0x34, 0xf6, 0xa6, 0x8c, 0x4d, 0x43, 0xd2,
-	0x51, 0x94, 0xdb, 0x74, 0xd2, 0x09, 0xd2, 0xc4, 0x13, 0x94, 0x45, 0xda, 0xa9, 0xb1, 0xfb, 0x3c,
-	0x60, 0x9c, 0xb0, 0xcf, 0xf7, 0x99, 0xe9, 0x30, 0x22, 0xe2, 0x37, 0x96, 0xdc, 0xd1, 0x68, 0xba,
-	0x20, 0x9c, 0x74, 0x02, 0xc2, 0x05, 0x8d, 0x54, 0x04, 0x9c, 0xa4, 0x21, 0xd1, 0xdc, 0xd6, 0xef,
-	0x65, 0x00, 0x2e, 0x09, 0x9f, 0xf5, 0xd4, 0x81, 0xe0, 0x77, 0x00, 0xce, 0xe9, 0x67, 0x92, 0x60,
-	0x7f, 0x46, 0xfc, 0x3b, 0xcc, 0x49, 0xf2, 0x89, 0x24, 0xc8, 0x68, 0x1a, 0xed, 0x6d, 0xdb, 0x54,
-	0x96, 0x9e, 0x34, 0x38, 0x0a, 0x87, 0x16, 0xa8, 0x69, 0x76, 0x42, 0x62, 0x96, 0x88, 0x05, 0x7d,
-	0x5d, 0xd1, 0xab, 0xca, 0x64, 0x2b, 0x4b, 0xc6, 0x3f, 0x06, 0xf5, 0x80, 0x72, 0xef, 0x36, 0x24,
-	0x38, 0x66, 0x21, 0xf5, 0xef, 0x75, 0x1a, 0x8e, 0x36, 0x9a, 0x46, 0x3b, 0x6f, 0xd7, 0x32, 0xe3,
-	0x95, 0xb2, 0xa9, 0x44, 0x1c, 0x1e, 0x82, 0xaa, 0xaa, 0x0d, 0x87, 0x94, 0x0b, 0x12, 0x61, 0x19,
-	0x0e, 0xe5, 0x9a, 0x46, 0xfb, 0x95, 0x5d, 0x51, 0x86, 0xa1, 0xc2, 0xaf, 0x58, 0x22, 0xe0, 0x3e,
-	0xd0, 0x10, 0x9e, 0x09, 0x11, 0x6b, 0xe6, 0x2b, 0xc5, 0x2c, 0x29, 0xf8, 0x83, 0x10, 0xb1, 0xe2,
-	0x9d, 0x82, 0x8a, 0xcf, 0xa2, 0x88, 0xf8, 0x02, 0x0b, 0x3a, 0x27, 0x2c, 0x15, 0x68, 0xb3, 0x69,
-	0xb4, 0x0b, 0xc7, 0xbb, 0x96, 0x56, 0xdd, 0x5a, 0xa8, 0x6e, 0x9d, 0x65, 0xaa, 0xdb, 0xe5, 0xcc,
-	0xc3, 0xd5, 0x0e, 0xf0, 0x1b, 0x50, 0xa2, 0xd1, 0x34, 0x21, 0x9c, 0x63, 0x3f, 0xf4, 0x38, 0x47,
-	0x5b, 0xaa, 0xea, 0x62, 0x06, 0xf6, 0x24, 0x06, 0x0f, 0x40, 0x65, 0x41, 0x92, 0xda, 0x50, 0x9f,
-	0xa0, 0xbc, 0xa2, 0x95, 0x33, 0xd8, 0xd1, 0x28, 0x9c, 0x83, 0x9d, 0xc7, 0x68, 0x2c, 0x12, 0x09,
-	0x0b, 0x43, 0x92, 0xe0, 0x39, 0x0b, 0x08, 0xda, 0x6e, 0x1a, 0xed, 0xf2, 0xf1, 0xf7, 0xd6, 0x8a,
-	0x21, 0xb1, 0x9e, 0x3a, 0x67, 0x0d, 0xb2, 0xbc, 0x8f, 0xde, 0x97, 0x2c, 0x20, 0x76, 0x9d, 0xae,
-	0x82, 0xe1, 0x18, 0x14, 0xbc, 0x54, 0xcc, 0xb2, 0x2e, 0x20, 0xa0, 0x52, 0x1c, 0xbe, 0x94, 0xa2,
-	0x9b, 0x8a, 0x99, 0xee, 0xcd, 0xe9, 0x3a, 0x32, 0x6c, 0xe0, 0x3d, 0x7e, 0xc3, 0x01, 0xa8, 0x26,
-	0x01, 0xc7, 0x09, 0x99, 0x24, 0x84, 0xcf, 0x70, 0x40, 0x42, 0xef, 0x1e, 0x15, 0x5e, 0xd0, 0x54,
-	0x45, 0xa9, 0x24, 0x01, 0xb7, 0xb5, 0xdb, 0x99, 0xf4, 0x82, 0xdf, 0x82, 0x32, 0x89, 0xd4, 0x8c,
-	0x88, 0xc4, 0xf3, 0x69, 0x34, 0x45, 0x45, 0x35, 0x1d, 0x25, 0x8d, 0xba, 0x1a, 0x94, 0xbd, 0xf6,
-	0x7c, 0x5f, 0x0a, 0x16, 0xb2, 0x29, 0x9e, 0xd0, 0x90, 0xa0, 0x92, 0x92, 0xb6, 0xa4, 0xe1, 0x21,
-	0x9b, 0x9e, 0xd3, 0x90, 0xc0, 0xf7, 0xa0, 0x1c, 0x90, 0x89, 0x97, 0x86, 0x02, 0xeb, 0x4b, 0x87,
-	0xca, 0xea, 0x58, 0xcd, 0x95, 0xd5, 0x5e, 0xc9, 0x39, 0xd1, 0xe5, 0xda, 0xa5, 0xcc, 0x2f, 0xbb,
-	0x1a, 0x07, 0xa0, 0xa4, 0x87, 0xdd, 0x0b, 0x02, 0x29, 0x29, 0x32, 0x65, 0x3a, 0x55, 0x43, 0x51,
-	0x19, 0xba, 0x1a, 0x87, 0xbf, 0x82, 0x1d, 0x96, 0x8a, 0x5b, 0x96, 0x46, 0x81, 0x2c, 0x61, 0x32,
-	0xa1, 0xfe, 0x42, 0xe8, 0xaa, 0x4a, 0xfd, 0x62, 0x2f, 0xc7, 0x99, 0xbb, 0xab, 0xbd, 0x97, 0x34,
-	0xaf, 0xb3, 0x55, 0x26, 0x78, 0x06, 0xfe, 0x9f, 0x69, 0xe6, 0x87, 0x94, 0x44, 0x02, 0x73, 0x1a,
-	0x3c, 0xbf, 0x63, 0xa8, 0xa6, 0x44, 0x7c, 0xab, 0x69, 0x3d, 0xc5, 0x72, 0x68, 0xb0, 0x7c, 0xd7,
-	0x60, 0x13, 0x14, 0x79, 0xc0, 0x71, 0x1a, 0x70, 0x1c, 0x7b, 0x62, 0x86, 0x5e, 0x2b, 0x3d, 0x01,
-	0x0f, 0xf8, 0x75, 0xc0, 0xaf, 0x3c, 0x31, 0x93, 0x6d, 0xe6, 0x5f, 0xb5, 0xb9, 0xfe, 0xaf, 0xda,
-	0xcc, 0xbf, 0x68, 0xf3, 0x07, 0x50, 0xd6, 0xfd, 0xc0, 0x9c, 0xa5, 0x89, 0x4f, 0x38, 0x7a, 0xd3,
-	0xdc, 0x68, 0x17, 0x8e, 0xdf, 0xad, 0x14, 0x47, 0x0b, 0xe3, 0x28, 0xa6, 0x5d, 0xf2, 0x97, 0xbe,
-	0x38, 0x3c, 0x01, 0x6f, 0xb2, 0xe2, 0xe5, 0xd9, 0x04, 0xbb, 0x23, 0x11, 0x9e, 0xb3, 0x34, 0x12,
-	0x68, 0x47, 0xaf, 0x15, 0x6d, 0x75, 0x02, 0xee, 0x4a, 0xdb, 0xa5, 0x34, 0xc9, 0xb5, 0xb2, 0x3c,
-	0x3e, 0x2c, 0x99, 0x7b, 0x02, 0x21, 0x55, 0x70, 0xe5, 0x69, 0x80, 0x14, 0x2c, 0x13, 0x2c, 0x4b,
-	0x89, 0x27, 0x1e, 0x0d, 0x31, 0x8b, 0x49, 0x84, 0x76, 0x75, 0x82, 0xf8, 0x49, 0xc4, 0x73, 0x8f,
-	0x86, 0xe3, 0x98, 0x44, 0xf0, 0x1d, 0x28, 0x8a, 0x24, 0xe5, 0x02, 0x07, 0x6c, 0xee, 0xd1, 0x08,
-	0x35, 0x54, 0xec, 0x82, 0xc2, 0xce, 0x14, 0x04, 0x3d, 0x50, 0x5b, 0x3a, 0x03, 0x89, 0x7c, 0x16,
-	0xc8, 0x71, 0x7f, 0xab, 0x6e, 0xe3, 0xd1, 0x8b, 0xb7, 0x71, 0x71, 0xca, 0x7e, 0xe6, 0x68, 0x57,
-	0xbd, 0x2f, 0xa1, 0xc6, 0x1f, 0x06, 0xa8, 0xaf, 0x9c, 0x26, 0x68, 0x83, 0x9c, 0x5a, 0x2f, 0x86,
-	0xca, 0xf6, 0xe3, 0x7f, 0x1a, 0x49, 0x4b, 0x2e, 0x13, 0xd5, 0x5e, 0x15, 0xab, 0x35, 0x02, 0x39,
-	0xb5, 0x5e, 0xea, 0xa0, 0x64, 0xf7, 0xdf, 0x0f, 0x1c, 0xd7, 0xbe, 0xc1, 0xe3, 0xd1, 0xf0, 0xc6,
-	0x5c, 0x6b, 0xac, 0xe7, 0x0d, 0x58, 0x05, 0xdb, 0xdd, 0xe1, 0x70, 0xfc, 0x13, 0xee, 0x8e, 0x6e,
-	0x4c, 0x43, 0x41, 0xff, 0x03, 0xaf, 0x3f, 0x0e, 0x6c, 0xf7, 0xba, 0x3b, 0xc4, 0x4e, 0xdf, 0xfe,
-	0x38, 0xe8, 0xf5, 0xb5, 0xc3, 0xba, 0xb4, 0xb6, 0x7e, 0x00, 0xf5, 0x95, 0x6b, 0x0d, 0x6e, 0x81,
-	0x8d, 0xf1, 0xf9, 0xb9, 0xb9, 0x06, 0x0b, 0x60, 0xeb, 0xac, 0x7f, 0xde, 0xbd, 0x1e, 0xba, 0xa6,
-	0x01, 0x01, 0xd8, 0x74, 0x5c, 0x7b, 0xd0, 0x73, 0xcd, 0xf5, 0xd6, 0x3e, 0x00, 0x4f, 0xeb, 0x0a,
-	0xe6, 0x41, 0x6e, 0x34, 0x1e, 0xf5, 0xcd, 0x35, 0x28, 0x9f, 0xbb, 0x6b, 0x95, 0xcf, 0x1d, 0x3a,
-	0xa6, 0xd1, 0x3a, 0x00, 0xd5, 0xaf, 0x84, 0x94, 0x74, 0xb7, 0xff, 0xb3, 0x6b, 0xae, 0xc9, 0x5f,
-	0x17, 0xce, 0x78, 0x64, 0x1a, 0x17, 0xb9, 0x7c, 0xc5, 0x34, 0x2f, 0x72, 0x79, 0x68, 0xd6, 0x5a,
-	0x1c, 0x14, 0x97, 0x07, 0x12, 0x22, 0xb0, 0xb5, 0x58, 0x0a, 0xfa, 0xa9, 0x5c, 0x7c, 0xc2, 0x01,
-	0x28, 0x8a, 0x50, 0x2e, 0x7f, 0x21, 0x68, 0x34, 0xe5, 0xea, 0x69, 0x2c, 0x1c, 0xef, 0x67, 0x6a,
-	0x3f, 0xbd, 0xd3, 0x0b, 0xcd, 0x4f, 0x2c, 0x77, 0xe8, 0x38, 0x19, 0xdb, 0x2e, 0x88, 0x90, 0x2f,
-	0x3e, 0x4e, 0xdb, 0x7f, 0x3e, 0xec, 0x19, 0x7f, 0x3d, 0xec, 0x19, 0x7f, 0x3f, 0xec, 0x19, 0xbf,
-	0x34, 0x74, 0x04, 0xca, 0x3a, 0x5e, 0x4c, 0x3b, 0xcf, 0xfe, 0x0b, 0xdc, 0x6e, 0xaa, 0x2b, 0x78,
-	0xf2, 0x4f, 0x00, 0x00, 0x00, 0xff, 0xff, 0x0a, 0x38, 0x8b, 0x61, 0x74, 0x08, 0x00, 0x00,
+	// 1194 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x56, 0x5f, 0x6f, 0xdb, 0x36,
+	0x10, 0x8f, 0x9c, 0xb4, 0x49, 0xcf, 0x7f, 0x22, 0x33, 0x75, 0xab, 0xba, 0x45, 0xe6, 0x7a, 0x58,
+	0x6b, 0x74, 0x85, 0x8d, 0x26, 0xd8, 0xc3, 0xf6, 0x30, 0xc0, 0x75, 0x9c, 0xd6, 0x85, 0x63, 0x67,
+	0x92, 0x92, 0xad, 0x7b, 0x21, 0x18, 0x89, 0xb6, 0x89, 0xca, 0xa2, 0x26, 0x52, 0x5d, 0xfb, 0xd9,
+	0xf6, 0x05, 0xf6, 0x38, 0x60, 0x8f, 0x7b, 0x19, 0xfa, 0x49, 0x06, 0x92, 0x52, 0xe2, 0xb6, 0x06,
+	0x52, 0xec, 0xcd, 0xfc, 0xdd, 0xef, 0xee, 0x78, 0xbf, 0x3b, 0x9e, 0x05, 0xcd, 0x25, 0x15, 0x8b,
+	0xde, 0xdb, 0x67, 0x24, 0x4a, 0x16, 0xe4, 0x59, 0x2f, 0xe0, 0xf1, 0x8c, 0xcd, 0xbb, 0x49, 0xca,
+	0x25, 0x47, 0x7b, 0x4c, 0x48, 0xc6, 0xbb, 0x8a, 0xd1, 0x2d, 0x18, 0xcd, 0xfd, 0x39, 0xe7, 0xf3,
+	0x88, 0xf6, 0x34, 0xe5, 0x22, 0x9b, 0xf5, 0xc2, 0x2c, 0x25, 0x92, 0xf1, 0xd8, 0x38, 0x35, 0xef,
+	0x7d, 0x1c, 0x30, 0x49, 0xf9, 0xbb, 0xf7, 0xb9, 0xe9, 0x49, 0x4c, 0xe5, 0xef, 0x3c, 0x7d, 0xc3,
+	0xe2, 0x79, 0x41, 0x38, 0xec, 0x85, 0x54, 0x48, 0x16, 0xeb, 0x08, 0x38, 0xcd, 0x22, 0x6a, 0xb8,
+	0xed, 0x7f, 0x6c, 0x80, 0x13, 0x2a, 0x16, 0x03, 0x7d, 0x21, 0xf4, 0x14, 0xd0, 0x92, 0xbd, 0xa3,
+	0x29, 0x0e, 0x16, 0x34, 0x78, 0x83, 0x05, 0x4d, 0xdf, 0xd2, 0xd4, 0xb1, 0x5a, 0x56, 0xe7, 0x96,
+	0x6b, 0x6b, 0xcb, 0x40, 0x19, 0x3c, 0x8d, 0xa3, 0x2e, 0xec, 0x19, 0x76, 0x4a, 0x13, 0x9e, 0xca,
+	0x82, 0x5e, 0xd2, 0xf4, 0xba, 0x36, 0xb9, 0xda, 0x92, 0xf3, 0x0f, 0xa0, 0x11, 0x32, 0x41, 0x2e,
+	0x22, 0x8a, 0x13, 0x1e, 0xb1, 0xe0, 0xbd, 0x49, 0x23, 0x9c, 0xcd, 0x96, 0xd5, 0xd9, 0x71, 0xf7,
+	0x72, 0xe3, 0xa9, 0xb6, 0xe9, 0x44, 0x02, 0x3d, 0x81, 0xba, 0xae, 0x0d, 0x47, 0x4c, 0x48, 0x1a,
+	0x63, 0x15, 0xce, 0xd9, 0x6a, 0x59, 0x9d, 0x1b, 0xee, 0xae, 0x36, 0x8c, 0x35, 0x7e, 0xca, 0x53,
+	0x89, 0x1e, 0x81, 0x81, 0xf0, 0x42, 0xca, 0xc4, 0x30, 0x6f, 0x68, 0x66, 0x55, 0xc3, 0x2f, 0xa5,
+	0x4c, 0x34, 0xef, 0x39, 0xec, 0x06, 0x3c, 0x8e, 0x69, 0x20, 0xb1, 0x64, 0x4b, 0xca, 0x33, 0xe9,
+	0xdc, 0x6c, 0x59, 0x9d, 0xf2, 0xc1, 0xbd, 0xae, 0x51, 0xbd, 0x5b, 0xa8, 0xde, 0x3d, 0xca, 0x55,
+	0x77, 0x6b, 0xb9, 0x87, 0x6f, 0x1c, 0xd0, 0xd7, 0x50, 0x65, 0xf1, 0x3c, 0xa5, 0x42, 0xe0, 0x20,
+	0x22, 0x42, 0x38, 0xdb, 0xba, 0xea, 0x4a, 0x0e, 0x0e, 0x14, 0x86, 0x1e, 0xc3, 0x6e, 0x41, 0x52,
+	0xda, 0xb0, 0x80, 0x3a, 0x3b, 0x9a, 0x56, 0xcb, 0x61, 0xcf, 0xa0, 0x68, 0x09, 0x77, 0x2f, 0xa3,
+	0xf1, 0x58, 0xa6, 0x3c, 0x8a, 0x68, 0x8a, 0x97, 0x3c, 0xa4, 0xce, 0xad, 0x96, 0xd5, 0xa9, 0x1d,
+	0x7c, 0xd7, 0x5d, 0x33, 0x24, 0xdd, 0xab, 0xce, 0x75, 0x47, 0x79, 0xde, 0x4b, 0xef, 0x13, 0x1e,
+	0x52, 0xb7, 0xc1, 0xd6, 0xc1, 0x68, 0x0a, 0x65, 0x92, 0xc9, 0x45, 0xde, 0x05, 0x07, 0x74, 0x8a,
+	0x27, 0xd7, 0xa5, 0xe8, 0x67, 0x72, 0x61, 0x7a, 0xf3, 0xbc, 0xe4, 0x58, 0x2e, 0x90, 0xcb, 0x33,
+	0x1a, 0x41, 0x3d, 0x0d, 0x05, 0x4e, 0xe9, 0x2c, 0xa5, 0x62, 0x81, 0x43, 0x1a, 0x91, 0xf7, 0x4e,
+	0xf9, 0x1a, 0x4d, 0x75, 0x94, 0xdd, 0x34, 0x14, 0xae, 0x71, 0x3b, 0x52, 0x5e, 0xe8, 0x1b, 0xa8,
+	0xd1, 0x58, 0xcf, 0x88, 0x4c, 0x49, 0xc0, 0xe2, 0xb9, 0x53, 0xd1, 0xd3, 0x51, 0x35, 0xa8, 0x6f,
+	0x40, 0xd5, 0x6b, 0x12, 0x04, 0x4a, 0xb0, 0x88, 0xcf, 0xf1, 0x8c, 0x45, 0xd4, 0xa9, 0x6a, 0x69,
+	0xab, 0x06, 0x1e, 0xf3, 0xf9, 0x31, 0x8b, 0x28, 0x7a, 0x01, 0xb5, 0x90, 0xce, 0x48, 0x16, 0x49,
+	0x6c, 0x1e, 0x9d, 0x53, 0xd3, 0xd7, 0x6a, 0xad, 0xad, 0xf6, 0x54, 0xcd, 0x89, 0x29, 0xd7, 0xad,
+	0xe6, 0x7e, 0xf9, 0xd3, 0x78, 0x0c, 0x55, 0x33, 0xec, 0x24, 0x0c, 0x95, 0xa4, 0x8e, 0xad, 0xd2,
+	0xe9, 0x1a, 0x2a, 0xda, 0xd0, 0x37, 0x38, 0xfa, 0x0d, 0xee, 0xf2, 0x4c, 0x5e, 0xf0, 0x2c, 0x0e,
+	0x55, 0x09, 0xb3, 0x19, 0x0b, 0x0a, 0xa1, 0xeb, 0x3a, 0xf5, 0xb5, 0xbd, 0x9c, 0xe6, 0xee, 0xbe,
+	0xf1, 0x5e, 0xd1, 0xbc, 0xc1, 0xd7, 0x99, 0xd0, 0x11, 0x7c, 0x95, 0x6b, 0x16, 0x44, 0x8c, 0xc6,
+	0x12, 0x0b, 0x16, 0x7e, 0xfc, 0xc6, 0x9c, 0x3d, 0x2d, 0xe2, 0x7d, 0x43, 0x1b, 0x68, 0x96, 0xc7,
+	0xc2, 0xd5, 0xb7, 0x86, 0x5a, 0x50, 0x11, 0xa1, 0xc0, 0x59, 0x28, 0x70, 0x42, 0xe4, 0xc2, 0xb9,
+	0xad, 0xf5, 0x04, 0x11, 0x8a, 0xb3, 0x50, 0x9c, 0x12, 0xb9, 0x50, 0x6d, 0x16, 0x9f, 0xb5, 0xb9,
+	0xf1, 0x45, 0x6d, 0x16, 0x9f, 0xb4, 0xf9, 0x25, 0xd4, 0x4c, 0x3f, 0xb0, 0xe0, 0x59, 0x1a, 0x50,
+	0xe1, 0xdc, 0x69, 0x6d, 0x76, 0xca, 0x07, 0x0f, 0xd7, 0x8a, 0x63, 0x84, 0xf1, 0x34, 0xd3, 0xad,
+	0x06, 0x2b, 0x27, 0x81, 0x0e, 0xe1, 0x4e, 0x5e, 0xbc, 0xba, 0x9b, 0xe4, 0x6f, 0x68, 0x8c, 0x97,
+	0x3c, 0x8b, 0xa5, 0x73, 0xd7, 0xac, 0x15, 0x63, 0xf5, 0x42, 0xe1, 0x2b, 0xdb, 0x89, 0x32, 0xa9,
+	0xb5, 0xb2, 0x3a, 0x3e, 0x3c, 0x5d, 0x12, 0xe9, 0x38, 0xba, 0xe0, 0xdd, 0xab, 0x01, 0xd2, 0xb0,
+	0x4a, 0xb0, 0x2a, 0x25, 0x9e, 0x11, 0x16, 0x61, 0x9e, 0xd0, 0xd8, 0xb9, 0x67, 0x12, 0x24, 0x57,
+	0x22, 0x1e, 0x13, 0x16, 0x4d, 0x13, 0x1a, 0xa3, 0x87, 0x50, 0x91, 0x69, 0x26, 0x24, 0x0e, 0xf9,
+	0x92, 0xb0, 0xd8, 0x69, 0xea, 0xd8, 0x65, 0x8d, 0x1d, 0x69, 0x08, 0x11, 0xd8, 0x5b, 0xb9, 0x03,
+	0x8d, 0x03, 0x1e, 0xaa, 0x71, 0xbf, 0xaf, 0x5f, 0xe3, 0xb3, 0x6b, 0x5f, 0x63, 0x71, 0xcb, 0x61,
+	0xee, 0xe8, 0xd6, 0xc9, 0xa7, 0x10, 0xfa, 0x09, 0xaa, 0xf9, 0x9f, 0x01, 0x16, 0x01, 0x4f, 0xa8,
+	0xf3, 0x40, 0x37, 0xeb, 0xe9, 0x75, 0xc1, 0x27, 0xc6, 0xc9, 0x53, 0x3e, 0x6e, 0x25, 0x5e, 0x39,
+	0x35, 0xff, 0xb0, 0xa0, 0xb1, 0x76, 0x40, 0x91, 0x0b, 0x5b, 0x7a, 0x63, 0x59, 0xba, 0x80, 0x1f,
+	0xfe, 0xd7, 0x94, 0x77, 0xd5, 0x7e, 0xd2, 0x13, 0xa3, 0x63, 0xb5, 0x27, 0xb0, 0xa5, 0x37, 0x56,
+	0x03, 0xaa, 0xee, 0xf0, 0xc5, 0xc8, 0xf3, 0xdd, 0xd7, 0x78, 0x3a, 0x19, 0xbf, 0xb6, 0x37, 0x9a,
+	0xa5, 0x1d, 0x0b, 0xd5, 0xe1, 0x56, 0x7f, 0x3c, 0x9e, 0xfe, 0x8c, 0xfb, 0x93, 0xd7, 0xb6, 0xa5,
+	0xa1, 0x07, 0x70, 0xfb, 0x7c, 0xe4, 0xfa, 0x67, 0xfd, 0x31, 0xf6, 0x86, 0xee, 0xf9, 0x68, 0x30,
+	0x34, 0x0e, 0x25, 0x65, 0x6d, 0xfe, 0x6d, 0x41, 0x65, 0xb5, 0x38, 0x74, 0x0e, 0xc5, 0x3b, 0xcf,
+	0x15, 0xb2, 0xbe, 0x4c, 0xfe, 0xd5, 0x20, 0xfa, 0xd2, 0x6e, 0x25, 0x8f, 0x63, 0xe2, 0x7e, 0x0b,
+	0x75, 0xb1, 0x20, 0x29, 0x0d, 0x71, 0x4c, 0x96, 0x54, 0x24, 0x44, 0x8d, 0x78, 0xa9, 0xb5, 0xa9,
+	0xfe, 0x48, 0x8d, 0x61, 0x72, 0x89, 0xb7, 0x7f, 0xcc, 0xab, 0x2c, 0xc3, 0xf6, 0x68, 0x72, 0xde,
+	0x1f, 0x8f, 0x8e, 0xec, 0x0d, 0x84, 0xa0, 0xd6, 0x1f, 0x8f, 0xf1, 0xa4, 0x7f, 0x32, 0xf4, 0x4e,
+	0xfb, 0x83, 0xa1, 0x67, 0x5b, 0xa8, 0x01, 0xf5, 0xc1, 0x99, 0xeb, 0x0e, 0x27, 0xfe, 0x15, 0x6e,
+	0x97, 0xda, 0xdf, 0x43, 0x63, 0xed, 0xfe, 0x47, 0xdb, 0xb0, 0x39, 0x3d, 0x3e, 0xb6, 0x37, 0x54,
+	0xe4, 0xa3, 0xe1, 0x71, 0xff, 0x6c, 0xec, 0xdb, 0x16, 0x02, 0xb8, 0xe9, 0xf9, 0xee, 0x68, 0xe0,
+	0xdb, 0xa5, 0xf6, 0x23, 0x80, 0xab, 0xbd, 0x8e, 0x76, 0x60, 0x6b, 0x32, 0x9d, 0x0c, 0xed, 0x0d,
+	0x54, 0x03, 0x38, 0x39, 0xd3, 0x2a, 0xfa, 0x63, 0xcf, 0xb6, 0xda, 0x8f, 0xa1, 0xfe, 0xd9, 0xc4,
+	0x29, 0xba, 0x3f, 0xfc, 0xc5, 0xb7, 0x37, 0xd4, 0xaf, 0x57, 0xde, 0x74, 0x62, 0x5b, 0xaf, 0xb6,
+	0x76, 0x76, 0x6d, 0xfb, 0xd5, 0xd6, 0x0e, 0xb2, 0xf7, 0xda, 0x02, 0x2a, 0xab, 0x2f, 0x17, 0x39,
+	0xb0, 0x5d, 0x6c, 0x4f, 0xf3, 0x4d, 0x51, 0x1c, 0xd1, 0x08, 0x2a, 0x32, 0x52, 0xff, 0x92, 0x52,
+	0xb2, 0x78, 0x2e, 0xf4, 0x37, 0x44, 0xf9, 0xe0, 0x51, 0xde, 0x85, 0xab, 0x0f, 0x9a, 0xa2, 0x17,
+	0x87, 0x5d, 0x7f, 0xec, 0x79, 0x39, 0xdb, 0x2d, 0xcb, 0x48, 0x14, 0x87, 0xe7, 0x9d, 0x3f, 0x3f,
+	0xec, 0x5b, 0x7f, 0x7d, 0xd8, 0xb7, 0xfe, 0xfd, 0xb0, 0x6f, 0xfd, 0xda, 0x34, 0x11, 0x18, 0xef,
+	0x91, 0x84, 0xf5, 0x3e, 0xfa, 0x68, 0xba, 0xb8, 0xa9, 0x77, 0xd5, 0xe1, 0x7f, 0x01, 0x00, 0x00,
+	0xff, 0xff, 0x8d, 0x45, 0xf6, 0xc6, 0x9d, 0x09, 0x00, 0x00,
 }
diff --git a/mesh/v1alpha1/config.proto b/mesh/v1alpha1/config.proto
index 952501f6d5..bbea123e7f 100644
--- a/mesh/v1alpha1/config.proto
+++ b/mesh/v1alpha1/config.proto
@@ -196,8 +196,36 @@ message MeshConfig {
   // Fallback to old identity format(without trust domain) if not set.
   string trust_domain = 26;
 
+  // Network scope settings for the mesh. Network scope controls the reachability of
+  // sidecars to other services in the mesh.
+  message NetworkScope {
+    enum Mode {
+      // Invalid mode
+      INVALID = 0;
+
+      // Configure routes to services in all namespaces.
+      ALL_NAMESPACES = 1;
+
+      // Configure routes to services in the same namespace as the sidecar
+      // in addition to namespaces specified in sharedNamespaces.
+      CURRENT_NAMESPACE = 2;
+    }
+
+    // REQUIRED: The default scope associated with every sidecar in the mesh.
+    Mode default_scope = 1;
+
+    // Specifies one or more namespaces that should be accessible to all sidecars
+    // in the mesh (such as istio-system).
+    repeated string shared_namespaces = 2;
+  }
+
+  // The default network scope associated with every sidecar in the mesh.
+  // Pilot will program the routes in the sidecars accordingly. If omitted,
+  // sidecars will be able to reach every service in the mesh.
+  NetworkScope network_scope = 28;
+
   // $hide_from_docs
-  // Next available field number: 28
+  // Next available field number: 29
 }
 
 // ConfigSource describes information about a configuration store inside a
diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
index 2e6b034417..1bcf4f8483 100644
--- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
+++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
@@ -4,7 +4,7 @@
 generator: protoc-gen-docs
 aliases:
   - /docs/reference/config/service-mesh.html
-number_of_entries: 16
+number_of_entries: 18
 ---
 <h2 id="AuthenticationPolicy">AuthenticationPolicy</h2>
 <section>
@@ -295,6 +295,16 @@ <h2 id="MeshConfig">MeshConfig</h2>
 Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
 Fallback to old identity format(without trust domain) if not set.</p>
 
+</td>
+</tr>
+<tr id="MeshConfig-network_scope">
+<td><code>networkScope</code></td>
+<td><code><a href="#MeshConfig-NetworkScope">MeshConfig.NetworkScope</a></code></td>
+<td>
+<p>The default network scope associated with every sidecar in the mesh.
+Pilot will program the routes in the sidecars accordingly. If omitted,
+sidecars will be able to reach every service in the mesh.</p>
+
 </td>
 </tr>
 </tbody>
@@ -360,6 +370,75 @@ <h2 id="MeshConfig-IngressControllerMode">MeshConfig.IngressControllerMode</h2>
 a secondary ingress controller (e.g., in addition to a
 cloud-provided ingress controller).</p>
 
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="MeshConfig-NetworkScope">MeshConfig.NetworkScope</h2>
+<section>
+<p>Network scope settings for the mesh. Network scope controls the reachability of
+sidecars to other services in the mesh.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr id="MeshConfig-NetworkScope-default_scope">
+<td><code>defaultScope</code></td>
+<td><code><a href="#MeshConfig-NetworkScope-Mode">MeshConfig.NetworkScope.Mode</a></code></td>
+<td>
+<p>REQUIRED: The default scope associated with every sidecar in the mesh.</p>
+
+</td>
+</tr>
+<tr id="MeshConfig-NetworkScope-shared_namespaces">
+<td><code>sharedNamespaces</code></td>
+<td><code>string[]</code></td>
+<td>
+<p>Specifies one or more namespaces that should be accessible to all sidecars
+in the mesh (such as istio-system).</p>
+
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="MeshConfig-NetworkScope-Mode">MeshConfig.NetworkScope.Mode</h2>
+<section>
+<table class="enum-values">
+<thead>
+<tr>
+<th>Name</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr id="MeshConfig-NetworkScope-Mode-INVALID">
+<td><code>INVALID</code></td>
+<td>
+<p>Invalid mode</p>
+
+</td>
+</tr>
+<tr id="MeshConfig-NetworkScope-Mode-ALL_NAMESPACES">
+<td><code>ALL_NAMESPACES</code></td>
+<td>
+<p>Configure routes to services in all namespaces.</p>
+
+</td>
+</tr>
+<tr id="MeshConfig-NetworkScope-Mode-CURRENT_NAMESPACE">
+<td><code>CURRENT_NAMESPACE</code></td>
+<td>
+<p>Configure routes to services in the same namespace as the sidecar
+in addition to namespaces specified in sharedNamespaces.</p>
+
 </td>
 </tr>
 </tbody>
diff --git a/python/istio_api/mesh/v1alpha1/config_pb2.py b/python/istio_api/mesh/v1alpha1/config_pb2.py
index 28143969be..42e8b0409c 100644
--- a/python/istio_api/mesh/v1alpha1/config_pb2.py
+++ b/python/istio_api/mesh/v1alpha1/config_pb2.py
@@ -22,7 +22,7 @@
   name='mesh/v1alpha1/config.proto',
   package='istio.mesh.v1alpha1',
   syntax='proto3',
-  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xfa\n\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x1e\n\x16policy_check_fail_open\x18\x19 \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x38\n\x11rds_refresh_delay\x18\x0b \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12N\n\x13\x61\x63\x63\x65ss_log_encoding\x18\x1b \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.AccessLogEncoding\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\x19\n\rmixer_address\x18\x10 \x01(\tB\x02\x18\x01\x12Z\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicyB\x02\x18\x01\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x38\n\x11sds_refresh_delay\x18\x15 \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\x12\x14\n\x0ctrust_domain\x18\x1a \x01(\t\x1a\xb5\x01\n\x15OutboundTrafficPolicy\x12L\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.ModeB\x02\x18\x01\"N\n\x04Mode\x12\x15\n\rREGISTRY_ONLY\x10\x00\x1a\x02\x08\x01\x12\x11\n\tALLOW_ANY\x10\x01\x1a\x02\x08\x01\x12\x1c\n\x14VIRTUAL_SERVICE_ONLY\x10\x02\x1a\x02\x08\x01\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\"\'\n\x11\x41\x63\x63\x65ssLogEncoding\x12\x08\n\x04TEXT\x10\x00\x12\x08\n\x04JSON\x10\x01J\x04\x08\x0f\x10\x10J\x04\x08\x12\x10\x13\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettingsB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
+  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xf5\x0c\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x1e\n\x16policy_check_fail_open\x18\x19 \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x38\n\x11rds_refresh_delay\x18\x0b \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12N\n\x13\x61\x63\x63\x65ss_log_encoding\x18\x1b \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.AccessLogEncoding\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\x19\n\rmixer_address\x18\x10 \x01(\tB\x02\x18\x01\x12Z\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicyB\x02\x18\x01\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x38\n\x11sds_refresh_delay\x18\x15 \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\x12\x14\n\x0ctrust_domain\x18\x1a \x01(\t\x12\x43\n\rnetwork_scope\x18\x1c \x01(\x0b\x32,.istio.mesh.v1alpha1.MeshConfig.NetworkScope\x1a\xb5\x01\n\x15OutboundTrafficPolicy\x12L\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.ModeB\x02\x18\x01\"N\n\x04Mode\x12\x15\n\rREGISTRY_ONLY\x10\x00\x1a\x02\x08\x01\x12\x11\n\tALLOW_ANY\x10\x01\x1a\x02\x08\x01\x12\x1c\n\x14VIRTUAL_SERVICE_ONLY\x10\x02\x1a\x02\x08\x01\x1a\xb3\x01\n\x0cNetworkScope\x12H\n\rdefault_scope\x18\x01 \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.NetworkScope.Mode\x12\x19\n\x11shared_namespaces\x18\x02 \x03(\t\">\n\x04Mode\x12\x0b\n\x07INVALID\x10\x00\x12\x12\n\x0e\x41LL_NAMESPACES\x10\x01\x12\x15\n\x11\x43URRENT_NAMESPACE\x10\x02\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\"\'\n\x11\x41\x63\x63\x65ssLogEncoding\x12\x08\n\x04TEXT\x10\x00\x12\x08\n\x04JSON\x10\x01J\x04\x08\x0f\x10\x10J\x04\x08\x12\x10\x13\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettingsB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
   ,
   dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,mesh_dot_v1alpha1_dot_proxy__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_destination__rule__pb2.DESCRIPTOR,])
 
@@ -49,11 +49,37 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1327,
-  serialized_end=1405,
+  serialized_start=1396,
+  serialized_end=1474,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE)
 
+_MESHCONFIG_NETWORKSCOPE_MODE = _descriptor.EnumDescriptor(
+  name='Mode',
+  full_name='istio.mesh.v1alpha1.MeshConfig.NetworkScope.Mode',
+  filename=None,
+  file=DESCRIPTOR,
+  values=[
+    _descriptor.EnumValueDescriptor(
+      name='INVALID', index=0, number=0,
+      options=None,
+      type=None),
+    _descriptor.EnumValueDescriptor(
+      name='ALL_NAMESPACES', index=1, number=1,
+      options=None,
+      type=None),
+    _descriptor.EnumValueDescriptor(
+      name='CURRENT_NAMESPACE', index=2, number=2,
+      options=None,
+      type=None),
+  ],
+  containing_type=None,
+  options=None,
+  serialized_start=1594,
+  serialized_end=1656,
+)
+_sym_db.RegisterEnumDescriptor(_MESHCONFIG_NETWORKSCOPE_MODE)
+
 _MESHCONFIG_INGRESSCONTROLLERMODE = _descriptor.EnumDescriptor(
   name='IngressControllerMode',
   full_name='istio.mesh.v1alpha1.MeshConfig.IngressControllerMode',
@@ -75,8 +101,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1407,
-  serialized_end=1464,
+  serialized_start=1658,
+  serialized_end=1715,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_INGRESSCONTROLLERMODE)
 
@@ -97,8 +123,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1466,
-  serialized_end=1504,
+  serialized_start=1717,
+  serialized_end=1755,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_AUTHPOLICY)
 
@@ -119,8 +145,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1506,
-  serialized_end=1545,
+  serialized_start=1757,
+  serialized_end=1796,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_ACCESSLOGENCODING)
 
@@ -152,8 +178,46 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1224,
-  serialized_end=1405,
+  serialized_start=1293,
+  serialized_end=1474,
+)
+
+_MESHCONFIG_NETWORKSCOPE = _descriptor.Descriptor(
+  name='NetworkScope',
+  full_name='istio.mesh.v1alpha1.MeshConfig.NetworkScope',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='default_scope', full_name='istio.mesh.v1alpha1.MeshConfig.NetworkScope.default_scope', index=0,
+      number=1, type=14, cpp_type=8, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='shared_namespaces', full_name='istio.mesh.v1alpha1.MeshConfig.NetworkScope.shared_namespaces', index=1,
+      number=2, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+    _MESHCONFIG_NETWORKSCOPE_MODE,
+  ],
+  options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=1477,
+  serialized_end=1656,
 )
 
 _MESHCONFIG = _descriptor.Descriptor(
@@ -338,10 +402,17 @@
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='network_scope', full_name='istio.mesh.v1alpha1.MeshConfig.network_scope', index=25,
+      number=28, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
   ],
   extensions=[
   ],
-  nested_types=[_MESHCONFIG_OUTBOUNDTRAFFICPOLICY, ],
+  nested_types=[_MESHCONFIG_OUTBOUNDTRAFFICPOLICY, _MESHCONFIG_NETWORKSCOPE, ],
   enum_types=[
     _MESHCONFIG_INGRESSCONTROLLERMODE,
     _MESHCONFIG_AUTHPOLICY,
@@ -354,7 +425,7 @@
   oneofs=[
   ],
   serialized_start=155,
-  serialized_end=1557,
+  serialized_end=1808,
 )
 
 
@@ -391,13 +462,16 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1559,
-  serialized_end=1652,
+  serialized_start=1810,
+  serialized_end=1903,
 )
 
 _MESHCONFIG_OUTBOUNDTRAFFICPOLICY.fields_by_name['mode'].enum_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE
 _MESHCONFIG_OUTBOUNDTRAFFICPOLICY.containing_type = _MESHCONFIG
 _MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE.containing_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY
+_MESHCONFIG_NETWORKSCOPE.fields_by_name['default_scope'].enum_type = _MESHCONFIG_NETWORKSCOPE_MODE
+_MESHCONFIG_NETWORKSCOPE.containing_type = _MESHCONFIG
+_MESHCONFIG_NETWORKSCOPE_MODE.containing_type = _MESHCONFIG_NETWORKSCOPE
 _MESHCONFIG.fields_by_name['connect_timeout'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION
 _MESHCONFIG.fields_by_name['ingress_controller_mode'].enum_type = _MESHCONFIG_INGRESSCONTROLLERMODE
 _MESHCONFIG.fields_by_name['auth_policy'].enum_type = _MESHCONFIG_AUTHPOLICY
@@ -407,6 +481,7 @@
 _MESHCONFIG.fields_by_name['outbound_traffic_policy'].message_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY
 _MESHCONFIG.fields_by_name['sds_refresh_delay'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION
 _MESHCONFIG.fields_by_name['config_sources'].message_type = _CONFIGSOURCE
+_MESHCONFIG.fields_by_name['network_scope'].message_type = _MESHCONFIG_NETWORKSCOPE
 _MESHCONFIG_INGRESSCONTROLLERMODE.containing_type = _MESHCONFIG
 _MESHCONFIG_AUTHPOLICY.containing_type = _MESHCONFIG
 _MESHCONFIG_ACCESSLOGENCODING.containing_type = _MESHCONFIG
@@ -423,12 +498,20 @@
     # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy)
     ))
   ,
+
+  NetworkScope = _reflection.GeneratedProtocolMessageType('NetworkScope', (_message.Message,), dict(
+    DESCRIPTOR = _MESHCONFIG_NETWORKSCOPE,
+    __module__ = 'mesh.v1alpha1.config_pb2'
+    # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.MeshConfig.NetworkScope)
+    ))
+  ,
   DESCRIPTOR = _MESHCONFIG,
   __module__ = 'mesh.v1alpha1.config_pb2'
   # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.MeshConfig)
   ))
 _sym_db.RegisterMessage(MeshConfig)
 _sym_db.RegisterMessage(MeshConfig.OutboundTrafficPolicy)
+_sym_db.RegisterMessage(MeshConfig.NetworkScope)
 
 ConfigSource = _reflection.GeneratedProtocolMessageType('ConfigSource', (_message.Message,), dict(
   DESCRIPTOR = _CONFIGSOURCE,

From 8d75b6ad6d228a1af55c01ec0e32046dd6023901 Mon Sep 17 00:00:00 2001
From: Shriram Rajagopalan <shriramr@vmware.com>
Date: Tue, 20 Nov 2018 17:04:22 -0500
Subject: [PATCH 02/11] protolock

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>
---
 proto.lock | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/proto.lock b/proto.lock
index 3e8c8b2154..872fecef03 100644
--- a/proto.lock
+++ b/proto.lock
@@ -690,6 +690,23 @@
                 "integer": 2
               }
             ]
+          },
+          {
+            "name": "NetworkScope.Mode",
+            "enum_fields": [
+              {
+                "name": "INVALID",
+                "integer": 0
+              },
+              {
+                "name": "ALL_NAMESPACES",
+                "integer": 1
+              },
+              {
+                "name": "CURRENT_NAMESPACE",
+                "integer": 2
+              }
+            ]
           }
         ],
         "messages": [
@@ -821,6 +838,11 @@
                 "id": 26,
                 "name": "trust_domain",
                 "type": "string"
+              },
+              {
+                "id": 28,
+                "name": "network_scope",
+                "type": "NetworkScope"
               }
             ],
             "reserved_ids": [
@@ -837,6 +859,22 @@
                     "type": "Mode"
                   }
                 ]
+              },
+              {
+                "name": "NetworkScope",
+                "fields": [
+                  {
+                    "id": 1,
+                    "name": "default_scope",
+                    "type": "Mode"
+                  },
+                  {
+                    "id": 2,
+                    "name": "shared_namespaces",
+                    "type": "string",
+                    "is_repeated": true
+                  }
+                ]
               }
             ]
           },

From 0dfada6dd9117e96881b5599bb3468388d55f46e Mon Sep 17 00:00:00 2001
From: Shriram Rajagopalan <shriramr@vmware.com>
Date: Mon, 26 Nov 2018 20:25:09 -0500
Subject: [PATCH 03/11] doc update

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>
---
 mesh/v1alpha1/config.pb.go                | 15 ++++++++++++---
 mesh/v1alpha1/config.proto                | 15 ++++++++++++---
 mesh/v1alpha1/istio.mesh.v1alpha1.pb.html | 15 ++++++++++++---
 3 files changed, 36 insertions(+), 9 deletions(-)

diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go
index 1d9c3b2bc5..9592b2427c 100644
--- a/mesh/v1alpha1/config.pb.go
+++ b/mesh/v1alpha1/config.pb.go
@@ -282,7 +282,9 @@ type MeshConfig struct {
 	TrustDomain string `protobuf:"bytes,26,opt,name=trust_domain,json=trustDomain,proto3" json:"trust_domain,omitempty"`
 	// The default network scope associated with every sidecar in the mesh.
 	// Pilot will program the routes in the sidecars accordingly. If omitted,
-	// sidecars will be able to reach every service in the mesh.
+	// sidecars will be able to reach every service in the mesh. The default
+	// scope can be overriden by supplying a NetworkScope resource per
+	// namespace.
 	NetworkScope *MeshConfig_NetworkScope `protobuf:"bytes,29,opt,name=network_scope,json=networkScope" json:"network_scope,omitempty"`
 }
 
@@ -503,8 +505,15 @@ func (m *MeshConfig_OutboundTrafficPolicy) GetMode() MeshConfig_OutboundTrafficP
 type MeshConfig_NetworkScope struct {
 	// REQUIRED: The default scope associated with every sidecar in the mesh.
 	DefaultScope MeshConfig_NetworkScope_Mode `protobuf:"varint,1,opt,name=default_scope,json=defaultScope,proto3,enum=istio.mesh.v1alpha1.MeshConfig_NetworkScope_Mode" json:"default_scope,omitempty"`
-	// Specifies one or more namespaces that should be accessible to all sidecars
-	// in the mesh (such as istio-system).
+	// Specifies one or more namespaces that should be accessible to all
+	// sidecars in the mesh (such as istio-system). This field has no
+	// effect when the default scope is set to ALL_NAMESPACES and a sidecar
+	// has no explicit NetworkScope resource attached to it. However when
+	// the sidecar has a NetworkScope resource attached to it (and the
+	// default scope is set to ALL_NAMESPACES or CURRENT_NAMESPACE),
+	// sidecar's network scope will include services/config objects
+	// specified in the NetworkScope object as well as services/config
+	// objects specified in the sharedNamespaces.
 	SharedNamespaces []string `protobuf:"bytes,2,rep,name=shared_namespaces,json=sharedNamespaces" json:"shared_namespaces,omitempty"`
 }
 
diff --git a/mesh/v1alpha1/config.proto b/mesh/v1alpha1/config.proto
index e511a97eb1..7154f513b8 100644
--- a/mesh/v1alpha1/config.proto
+++ b/mesh/v1alpha1/config.proto
@@ -217,14 +217,23 @@ message MeshConfig {
     // REQUIRED: The default scope associated with every sidecar in the mesh.
     Mode default_scope = 1;
 
-    // Specifies one or more namespaces that should be accessible to all sidecars
-    // in the mesh (such as istio-system).
+    // Specifies one or more namespaces that should be accessible to all
+    // sidecars in the mesh (such as istio-system). This field has no
+    // effect when the default scope is set to ALL_NAMESPACES and a sidecar
+    // has no explicit NetworkScope resource attached to it. However when
+    // the sidecar has a NetworkScope resource attached to it (and the
+    // default scope is set to ALL_NAMESPACES or CURRENT_NAMESPACE),
+    // sidecar's network scope will include services/config objects
+    // specified in the NetworkScope object as well as services/config
+    // objects specified in the sharedNamespaces.
     repeated string shared_namespaces = 2;
   }
 
   // The default network scope associated with every sidecar in the mesh.
   // Pilot will program the routes in the sidecars accordingly. If omitted,
-  // sidecars will be able to reach every service in the mesh.
+  // sidecars will be able to reach every service in the mesh. The default
+  // scope can be overriden by supplying a NetworkScope resource per
+  // namespace.
   NetworkScope network_scope = 29;
 
   // $hide_from_docs
diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
index 137f2fdcbc..af0a9d9459 100644
--- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
+++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
@@ -311,7 +311,9 @@ <h2 id="MeshConfig">MeshConfig</h2>
 <td>
 <p>The default network scope associated with every sidecar in the mesh.
 Pilot will program the routes in the sidecars accordingly. If omitted,
-sidecars will be able to reach every service in the mesh.</p>
+sidecars will be able to reach every service in the mesh. The default
+scope can be overriden by supplying a NetworkScope resource per
+namespace.</p>
 
 </td>
 </tr>
@@ -409,8 +411,15 @@ <h2 id="MeshConfig-NetworkScope">MeshConfig.NetworkScope</h2>
 <td><code>sharedNamespaces</code></td>
 <td><code>string[]</code></td>
 <td>
-<p>Specifies one or more namespaces that should be accessible to all sidecars
-in the mesh (such as istio-system).</p>
+<p>Specifies one or more namespaces that should be accessible to all
+sidecars in the mesh (such as istio-system). This field has no
+effect when the default scope is set to ALL<em>NAMESPACES and a sidecar
+has no explicit NetworkScope resource attached to it. However when
+the sidecar has a NetworkScope resource attached to it (and the
+default scope is set to ALL</em>NAMESPACES or CURRENT_NAMESPACE),
+sidecar&rsquo;s network scope will include services/config objects
+specified in the NetworkScope object as well as services/config
+objects specified in the sharedNamespaces.</p>
 
 </td>
 </tr>

From 3a76d6b9a676387212981e2e0a5092d8c5b717a4 Mon Sep 17 00:00:00 2001
From: Shriram Rajagopalan <shriramr@vmware.com>
Date: Tue, 27 Nov 2018 13:16:04 -0500
Subject: [PATCH 04/11] NetworkScopes

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>
---
 networking/v1alpha3/destination_rule.pb.go    |   4 +
 .../istio.networking.v1alpha3.pb.html         | 202 +++-
 networking/v1alpha3/network_scope.pb.go       | 905 ++++++++++++++++++
 networking/v1alpha3/network_scope.proto       | 160 ++++
 .../networking/v1alpha3/network_Scope_pb2.py  | 214 +++++
 5 files changed, 1484 insertions(+), 1 deletion(-)
 create mode 100644 networking/v1alpha3/network_scope.pb.go
 create mode 100644 networking/v1alpha3/network_scope.proto
 create mode 100644 python/istio_api/networking/v1alpha3/network_Scope_pb2.py

diff --git a/networking/v1alpha3/destination_rule.pb.go b/networking/v1alpha3/destination_rule.pb.go
index 0eb5af0c0b..7dd9b065e4 100644
--- a/networking/v1alpha3/destination_rule.pb.go
+++ b/networking/v1alpha3/destination_rule.pb.go
@@ -8,6 +8,7 @@
 		networking/v1alpha3/destination_rule.proto
 		networking/v1alpha3/envoy_filter.proto
 		networking/v1alpha3/gateway.proto
+		networking/v1alpha3/network_Scope.proto
 		networking/v1alpha3/service_entry.proto
 		networking/v1alpha3/virtual_service.proto
 
@@ -23,6 +24,9 @@
 		Gateway
 		Server
 		Port
+		NetworkScope
+		Dependency
+		Import
 		ServiceEntry
 		VirtualService
 		Destination
diff --git a/networking/v1alpha3/istio.networking.v1alpha3.pb.html b/networking/v1alpha3/istio.networking.v1alpha3.pb.html
index c6cc9e88ae..dcc4129ac1 100644
--- a/networking/v1alpha3/istio.networking.v1alpha3.pb.html
+++ b/networking/v1alpha3/istio.networking.v1alpha3.pb.html
@@ -6,7 +6,7 @@
 generator: protoc-gen-docs
 aliases:
   - /docs/reference/config/istio.routing.v1alpha1/
-number_of_entries: 55
+number_of_entries: 58
 ---
 <p>Configuration affecting traffic routing. Here are a few terms useful to define
 in the context of traffic routing.</p>
@@ -326,6 +326,49 @@ <h2 id="CorsPolicy">CorsPolicy</h2>
 (not the preflight) using credentials. Translates to
 Access-Control-Allow-Credentials header.</p>
 
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="Dependency">Dependency</h2>
+<section>
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr id="Dependency-source_workload_labels">
+<td><code>sourceWorkloadLabels</code></td>
+<td><code>map&lt;string,&nbsp;string&gt;</code></td>
+<td>
+<p>One or more labels that indicate a specific set of pods/VMs on which
+this dependency configuration should be applied.  The scope of label
+search is platform dependent.  On Kubernetes, for example, the scope
+includes pods running in the namespace in which the NetworkScope
+resource is present.  If the sourceWorkloadLabels are omitted, the
+imports specified will be applicable to all workloads in the current
+configuration namespace.</p>
+
+</td>
+</tr>
+<tr id="Dependency-imports">
+<td><code>imports</code></td>
+<td><code><a href="#Import">Import[]</a></code></td>
+<td>
+<p>REQUIRED: Import describes the set of namespaces whose exported
+services will be accessed by the workloads selected by the
+sourceWorkloadLabels. The sidecars attached to the workloads will be
+configured with information required to reach other services in the
+same namespace and the imported services. In addition to the
+explicitly specified namespaces, namespaces specified in the global
+mesh config (through NetworkScope.sharedNamespaces) will also be
+imported.</p>
+
 </td>
 </tr>
 </tbody>
@@ -2083,6 +2126,58 @@ <h2 id="Headers-HeaderOperations">Headers.HeaderOperations</h2>
 <td>
 <p>Remove a the specified headers</p>
 
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="Import">Import</h2>
+<section>
+<p>Import describes the set of namespaces whose exported services
+(real/virtual) will be accessed by workloads in a given namespace. The
+sidecars attached to the workloads will be configured with information
+required to reach the imported services only. The gateways in the
+current namespace will only honor imported VirtualServices instead of
+every VirtualService that binds itself to the gateway.</p>
+
+<p>Importing a service from a namespace will automatically import the
+exported configuration artifacts associated with the service, such as
+VirtualService, DestinationRule, etc. The service in a namespace can be
+a service in the service registry (e.g., a kubernetes or cloud foundry
+service) or a service specified via ServiceEntry configuration.</p>
+
+<p>NOTE: Only exported services and configuration artifacts from a
+namespace can be imported. Private services/configuration will not be
+imported. See the scope setting associated with VirtualService,
+DestinationRule, ServiceEntry, etc.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr id="Import-namespace">
+<td><code>namespace</code></td>
+<td><code>string</code></td>
+<td>
+<p>The configuration namespace whose services need to be imported.
+Specify * to import all namespaces. The import can be scoped further
+by specifying individual hosts.</p>
+
+</td>
+</tr>
+<tr id="Import-host">
+<td><code>host</code></td>
+<td><code>string</code></td>
+<td>
+<p>A FQDN or wildcard prefixed DNS name of the host to import from the
+specified namespace. The hostnames include names of services from the
+service registry as well as those specified in a VirtualService.</p>
+
 </td>
 </tr>
 </tbody>
@@ -2353,6 +2448,111 @@ <h2 id="LoadBalancerSettings-SimpleLB">LoadBalancerSettings.SimpleLB</h2>
 advanced use cases. Refer to Original Destination load balancer in
 Envoy for further details.</p>
 
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="NetworkScope">NetworkScope</h2>
+<section>
+<p><code>NetworkScope</code> describes the set of services that a workload depends on
+for its operation. In other words, it describes the properties of egress
+traffic from a given workload. By default, the service mesh established
+by Istio will have a full mesh connectivity - i.e. every workload will
+have proxy configuration required to reach every other workload in the
+mesh. However most connectivity graphs are sparse in practice. The
+NetworkScope provides a way to prune the connectivity graph
+(i.e. dependencies) associated with each workload.</p>
+
+<p>Services and configuration in a mesh are organized into one or more
+namespaces (e.g., a Kubernetes namespace or a CF org/space).  Workloads
+in a namespace will be able to reach other workloads in the same
+namespace. To declare dependencies on workloads in other namespaces, a
+NetworkScope resource has to be specified in the current
+namespace. <em><em>Each namespace can have only one NetworkScope
+resource</em></em>. The behavior of the system is undefined if more than one
+NetworkScope resource exists in a given namespace. The set of
+dependencies specified in a NetworkScope resource will be used to
+compute the [outbound] connectivity graph for every workload in the
+namespace.</p>
+
+<p>NOTE: If workloads in the mesh depend only on other workloads in the
+same namespace, use the mesh global setting to specify the default
+network scope as CURRENT<em>NAMESPACE. To facilitate incremental pruning of
+the connectivity graph, the default network scope for the mesh is set to
+ALL</em>NAMESPACES. In otherwords, every workload will be able to reach
+every other workload. Specifying a NetworkScope resource in a namespace
+will automatically prune the configuration for the workloads in that
+namespace.</p>
+
+<p>The following examples illustrate a few specific use cases of NetworkScope.</p>
+
+<p>The example below delcares a NetworkScope resource in the prod-us1
+namespace. The workload with the <code>version: newlandingpage</code> label will be
+able to reach all services declared in the egress namespace as well as
+the landing.qa.foo.com service in the qa namespace. All other workloads
+in the prod-us1 namespace will be able to reach the services in the
+egress namespace only.</p>
+
+<pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3
+kind: NetworkScope
+metadata:
+  name: default
+  namespace: prod-us1
+spec:
+  dependencies:
+  - sourceWorkloadLabels:
+      version: newlandingpage
+    imports:
+    - namespace: qa
+      host: landing.qa.foo.com
+    - namespace: egress
+  - imports:
+    - namespace: egress
+</code></pre>
+
+<p>In a mesh where the default network scope is set to CURRENT_NAMESPACE
+only, if one or more workloads need to be able to reach every other
+service in the mesh (e.g., metrics collection server), the following
+NetworkScope resource can be used to specify such a dependency:</p>
+
+<pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3
+kind: NetworkScope
+metadata:
+  name: default
+  namespace: metrics-collection
+spec:
+  dependencies:
+  - sourceWorkloadLabels:
+       app: metricsScraper
+    imports:
+    - namespace: '*'
+</code></pre>
+
+<p>The configuration above will allow workloads in the metrics-collection
+namespace with the labels <code>app: metricsScraper</code> to access service in any
+namespace while other workloads in the same namespace will be configured
+for namespace local access as per the global default network scope
+(CURRENT_NAMESPACE).</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr id="NetworkScope-dependencies">
+<td><code>dependencies</code></td>
+<td><code><a href="#Dependency">Dependency[]</a></code></td>
+<td>
+<p>REQUIRED. The set of services that workloads in this namespace are
+expected to talk to, in addition to other workloads in the same
+namespace. Dependencies describe the properties of egress traffic from
+a given workload.</p>
+
 </td>
 </tr>
 </tbody>
diff --git a/networking/v1alpha3/network_scope.pb.go b/networking/v1alpha3/network_scope.pb.go
new file mode 100644
index 0000000000..917f9ed91d
--- /dev/null
+++ b/networking/v1alpha3/network_scope.pb.go
@@ -0,0 +1,905 @@
+// Code generated by protoc-gen-gogo. DO NOT EDIT.
+// source: networking/v1alpha3/network_Scope.proto
+
+package v1alpha3
+
+import proto "github.com/gogo/protobuf/proto"
+import fmt "fmt"
+import math "math"
+
+import io "io"
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// `NetworkScope` describes the set of services that a workload depends on
+// for its operation. In other words, it describes the properties of egress
+// traffic from a given workload. By default, the service mesh established
+// by Istio will have a full mesh connectivity - i.e. every workload will
+// have proxy configuration required to reach every other workload in the
+// mesh. However most connectivity graphs are sparse in practice. The
+// NetworkScope provides a way to prune the connectivity graph
+// (i.e. dependencies) associated with each workload.
+//
+// Services and configuration in a mesh are organized into one or more
+// namespaces (e.g., a Kubernetes namespace or a CF org/space).  Workloads
+// in a namespace will be able to reach other workloads in the same
+// namespace. To declare dependencies on workloads in other namespaces, a
+// NetworkScope resource has to be specified in the current
+// namespace. *_Each namespace can have only one NetworkScope
+// resource_*. The behavior of the system is undefined if more than one
+// NetworkScope resource exists in a given namespace. The set of
+// dependencies specified in a NetworkScope resource will be used to
+// compute the [outbound] connectivity graph for every workload in the
+// namespace.
+//
+// NOTE: If workloads in the mesh depend only on other workloads in the
+// same namespace, use the mesh global setting to specify the default
+// network scope as CURRENT_NAMESPACE. To facilitate incremental pruning of
+// the connectivity graph, the default network scope for the mesh is set to
+// ALL_NAMESPACES. In otherwords, every workload will be able to reach
+// every other workload. Specifying a NetworkScope resource in a namespace
+// will automatically prune the configuration for the workloads in that
+// namespace.
+//
+// The following examples illustrate a few specific use cases of NetworkScope.
+//
+// The example below delcares a NetworkScope resource in the prod-us1
+// namespace. The workload with the `version: newlandingpage` label will be
+// able to reach all services declared in the egress namespace as well as
+// the landing.qa.foo.com service in the qa namespace. All other workloads
+// in the prod-us1 namespace will be able to reach the services in the
+// egress namespace only.
+//
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: NetworkScope
+// metadata:
+//   name: default
+//   namespace: prod-us1
+// spec:
+//   dependencies:
+//   - sourceWorkloadLabels:
+//       version: newlandingpage
+//     imports:
+//     - namespace: qa
+//       host: landing.qa.foo.com
+//     - namespace: egress
+//   - imports:
+//     - namespace: egress
+// ```
+//
+// In a mesh where the default network scope is set to CURRENT_NAMESPACE
+// only, if one or more workloads need to be able to reach every other
+// service in the mesh (e.g., metrics collection server), the following
+// NetworkScope resource can be used to specify such a dependency:
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: NetworkScope
+// metadata:
+//   name: default
+//   namespace: metrics-collection
+// spec:
+//   dependencies:
+//   - sourceWorkloadLabels:
+//        app: metricsScraper
+//     imports:
+//     - namespace: '*'
+// ```
+//
+// The configuration above will allow workloads in the metrics-collection
+// namespace with the labels `app: metricsScraper` to access service in any
+// namespace while other workloads in the same namespace will be configured
+// for namespace local access as per the global default network scope
+// (CURRENT_NAMESPACE).
+//
+type NetworkScope struct {
+	// REQUIRED. The set of services that workloads in this namespace are
+	// expected to talk to, in addition to other workloads in the same
+	// namespace. Dependencies describe the properties of egress traffic from
+	// a given workload.
+	Dependencies []*Dependency `protobuf:"bytes,1,rep,name=dependencies" json:"dependencies,omitempty"`
+}
+
+func (m *NetworkScope) Reset()                    { *m = NetworkScope{} }
+func (m *NetworkScope) String() string            { return proto.CompactTextString(m) }
+func (*NetworkScope) ProtoMessage()               {}
+func (*NetworkScope) Descriptor() ([]byte, []int) { return fileDescriptorNetwork_Scope, []int{0} }
+
+func (m *NetworkScope) GetDependencies() []*Dependency {
+	if m != nil {
+		return m.Dependencies
+	}
+	return nil
+}
+
+type Dependency struct {
+	// One or more labels that indicate a specific set of pods/VMs on which
+	// this dependency configuration should be applied.  The scope of label
+	// search is platform dependent.  On Kubernetes, for example, the scope
+	// includes pods running in the namespace in which the NetworkScope
+	// resource is present.  If the sourceWorkloadLabels are omitted, the
+	// imports specified will be applicable to all workloads in the current
+	// configuration namespace.
+	SourceWorkloadLabels map[string]string `protobuf:"bytes,1,rep,name=source_workload_labels,json=sourceWorkloadLabels" json:"source_workload_labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// REQUIRED: Import describes the set of namespaces whose exported
+	// services will be accessed by the workloads selected by the
+	// sourceWorkloadLabels. The sidecars attached to the workloads will be
+	// configured with information required to reach other services in the
+	// same namespace and the imported services. In addition to the
+	// explicitly specified namespaces, namespaces specified in the global
+	// mesh config (through NetworkScope.sharedNamespaces) will also be
+	// imported.
+	Imports []*Import `protobuf:"bytes,2,rep,name=imports" json:"imports,omitempty"`
+}
+
+func (m *Dependency) Reset()                    { *m = Dependency{} }
+func (m *Dependency) String() string            { return proto.CompactTextString(m) }
+func (*Dependency) ProtoMessage()               {}
+func (*Dependency) Descriptor() ([]byte, []int) { return fileDescriptorNetwork_Scope, []int{1} }
+
+func (m *Dependency) GetSourceWorkloadLabels() map[string]string {
+	if m != nil {
+		return m.SourceWorkloadLabels
+	}
+	return nil
+}
+
+func (m *Dependency) GetImports() []*Import {
+	if m != nil {
+		return m.Imports
+	}
+	return nil
+}
+
+// Import describes the set of namespaces whose exported services
+// (real/virtual) will be accessed by workloads in a given namespace. The
+// sidecars attached to the workloads will be configured with information
+// required to reach the imported services only. The gateways in the
+// current namespace will only honor imported VirtualServices instead of
+// every VirtualService that binds itself to the gateway.
+//
+// Importing a service from a namespace will automatically import the
+// exported configuration artifacts associated with the service, such as
+// VirtualService, DestinationRule, etc. The service in a namespace can be
+// a service in the service registry (e.g., a kubernetes or cloud foundry
+// service) or a service specified via ServiceEntry configuration.
+//
+// NOTE: Only exported services and configuration artifacts from a
+// namespace can be imported. Private services/configuration will not be
+// imported. See the scope setting associated with VirtualService,
+// DestinationRule, ServiceEntry, etc.
+type Import struct {
+	// The configuration namespace whose services need to be imported.
+	// Specify * to import all namespaces. The import can be scoped further
+	// by specifying individual hosts.
+	Namespace string `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	// A FQDN or wildcard prefixed DNS name of the host to import from the
+	// specified namespace. The hostnames include names of services from the
+	// service registry as well as those specified in a VirtualService.
+	Host string `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"`
+}
+
+func (m *Import) Reset()                    { *m = Import{} }
+func (m *Import) String() string            { return proto.CompactTextString(m) }
+func (*Import) ProtoMessage()               {}
+func (*Import) Descriptor() ([]byte, []int) { return fileDescriptorNetwork_Scope, []int{2} }
+
+func (m *Import) GetNamespace() string {
+	if m != nil {
+		return m.Namespace
+	}
+	return ""
+}
+
+func (m *Import) GetHost() string {
+	if m != nil {
+		return m.Host
+	}
+	return ""
+}
+
+func init() {
+	proto.RegisterType((*NetworkScope)(nil), "istio.networking.v1alpha3.NetworkScope")
+	proto.RegisterType((*Dependency)(nil), "istio.networking.v1alpha3.Dependency")
+	proto.RegisterType((*Import)(nil), "istio.networking.v1alpha3.Import")
+}
+func (m *NetworkScope) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *NetworkScope) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.Dependencies) > 0 {
+		for _, msg := range m.Dependencies {
+			dAtA[i] = 0xa
+			i++
+			i = encodeVarintNetwork_Scope(dAtA, i, uint64(msg.Size()))
+			n, err := msg.MarshalTo(dAtA[i:])
+			if err != nil {
+				return 0, err
+			}
+			i += n
+		}
+	}
+	return i, nil
+}
+
+func (m *Dependency) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Dependency) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.SourceWorkloadLabels) > 0 {
+		for k, _ := range m.SourceWorkloadLabels {
+			dAtA[i] = 0xa
+			i++
+			v := m.SourceWorkloadLabels[k]
+			mapSize := 1 + len(k) + sovNetwork_Scope(uint64(len(k))) + 1 + len(v) + sovNetwork_Scope(uint64(len(v)))
+			i = encodeVarintNetwork_Scope(dAtA, i, uint64(mapSize))
+			dAtA[i] = 0xa
+			i++
+			i = encodeVarintNetwork_Scope(dAtA, i, uint64(len(k)))
+			i += copy(dAtA[i:], k)
+			dAtA[i] = 0x12
+			i++
+			i = encodeVarintNetwork_Scope(dAtA, i, uint64(len(v)))
+			i += copy(dAtA[i:], v)
+		}
+	}
+	if len(m.Imports) > 0 {
+		for _, msg := range m.Imports {
+			dAtA[i] = 0x12
+			i++
+			i = encodeVarintNetwork_Scope(dAtA, i, uint64(msg.Size()))
+			n, err := msg.MarshalTo(dAtA[i:])
+			if err != nil {
+				return 0, err
+			}
+			i += n
+		}
+	}
+	return i, nil
+}
+
+func (m *Import) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Import) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.Namespace) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintNetwork_Scope(dAtA, i, uint64(len(m.Namespace)))
+		i += copy(dAtA[i:], m.Namespace)
+	}
+	if len(m.Host) > 0 {
+		dAtA[i] = 0x12
+		i++
+		i = encodeVarintNetwork_Scope(dAtA, i, uint64(len(m.Host)))
+		i += copy(dAtA[i:], m.Host)
+	}
+	return i, nil
+}
+
+func encodeVarintNetwork_Scope(dAtA []byte, offset int, v uint64) int {
+	for v >= 1<<7 {
+		dAtA[offset] = uint8(v&0x7f | 0x80)
+		v >>= 7
+		offset++
+	}
+	dAtA[offset] = uint8(v)
+	return offset + 1
+}
+func (m *NetworkScope) Size() (n int) {
+	var l int
+	_ = l
+	if len(m.Dependencies) > 0 {
+		for _, e := range m.Dependencies {
+			l = e.Size()
+			n += 1 + l + sovNetwork_Scope(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *Dependency) Size() (n int) {
+	var l int
+	_ = l
+	if len(m.SourceWorkloadLabels) > 0 {
+		for k, v := range m.SourceWorkloadLabels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovNetwork_Scope(uint64(len(k))) + 1 + len(v) + sovNetwork_Scope(uint64(len(v)))
+			n += mapEntrySize + 1 + sovNetwork_Scope(uint64(mapEntrySize))
+		}
+	}
+	if len(m.Imports) > 0 {
+		for _, e := range m.Imports {
+			l = e.Size()
+			n += 1 + l + sovNetwork_Scope(uint64(l))
+		}
+	}
+	return n
+}
+
+func (m *Import) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.Namespace)
+	if l > 0 {
+		n += 1 + l + sovNetwork_Scope(uint64(l))
+	}
+	l = len(m.Host)
+	if l > 0 {
+		n += 1 + l + sovNetwork_Scope(uint64(l))
+	}
+	return n
+}
+
+func sovNetwork_Scope(x uint64) (n int) {
+	for {
+		n++
+		x >>= 7
+		if x == 0 {
+			break
+		}
+	}
+	return n
+}
+func sozNetwork_Scope(x uint64) (n int) {
+	return sovNetwork_Scope(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+}
+func (m *NetworkScope) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowNetwork_Scope
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: NetworkScope: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: NetworkScope: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Dependencies", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNetwork_Scope
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthNetwork_Scope
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Dependencies = append(m.Dependencies, &Dependency{})
+			if err := m.Dependencies[len(m.Dependencies)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipNetwork_Scope(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthNetwork_Scope
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Dependency) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowNetwork_Scope
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Dependency: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Dependency: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SourceWorkloadLabels", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNetwork_Scope
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthNetwork_Scope
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SourceWorkloadLabels == nil {
+				m.SourceWorkloadLabels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowNetwork_Scope
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowNetwork_Scope
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= (uint64(b) & 0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthNetwork_Scope
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowNetwork_Scope
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= (uint64(b) & 0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthNetwork_Scope
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipNetwork_Scope(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if skippy < 0 {
+						return ErrInvalidLengthNetwork_Scope
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.SourceWorkloadLabels[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Imports", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNetwork_Scope
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthNetwork_Scope
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Imports = append(m.Imports, &Import{})
+			if err := m.Imports[len(m.Imports)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipNetwork_Scope(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthNetwork_Scope
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Import) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowNetwork_Scope
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Import: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Import: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNetwork_Scope
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthNetwork_Scope
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Namespace = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Host", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNetwork_Scope
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthNetwork_Scope
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Host = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipNetwork_Scope(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthNetwork_Scope
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func skipNetwork_Scope(dAtA []byte) (n int, err error) {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return 0, ErrIntOverflowNetwork_Scope
+			}
+			if iNdEx >= l {
+				return 0, io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		wireType := int(wire & 0x7)
+		switch wireType {
+		case 0:
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowNetwork_Scope
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				iNdEx++
+				if dAtA[iNdEx-1] < 0x80 {
+					break
+				}
+			}
+			return iNdEx, nil
+		case 1:
+			iNdEx += 8
+			return iNdEx, nil
+		case 2:
+			var length int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return 0, ErrIntOverflowNetwork_Scope
+				}
+				if iNdEx >= l {
+					return 0, io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				length |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			iNdEx += length
+			if length < 0 {
+				return 0, ErrInvalidLengthNetwork_Scope
+			}
+			return iNdEx, nil
+		case 3:
+			for {
+				var innerWire uint64
+				var start int = iNdEx
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return 0, ErrIntOverflowNetwork_Scope
+					}
+					if iNdEx >= l {
+						return 0, io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					innerWire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				innerWireType := int(innerWire & 0x7)
+				if innerWireType == 4 {
+					break
+				}
+				next, err := skipNetwork_Scope(dAtA[start:])
+				if err != nil {
+					return 0, err
+				}
+				iNdEx = start + next
+			}
+			return iNdEx, nil
+		case 4:
+			return iNdEx, nil
+		case 5:
+			iNdEx += 4
+			return iNdEx, nil
+		default:
+			return 0, fmt.Errorf("proto: illegal wireType %d", wireType)
+		}
+	}
+	panic("unreachable")
+}
+
+var (
+	ErrInvalidLengthNetwork_Scope = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowNetwork_Scope   = fmt.Errorf("proto: integer overflow")
+)
+
+func init() {
+	proto.RegisterFile("networking/v1alpha3/network_Scope.proto", fileDescriptorNetwork_Scope)
+}
+
+var fileDescriptorNetwork_Scope = []byte{
+	// 308 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x52, 0xcf, 0x4b, 0x2d, 0x29,
+	0xcf, 0x2f, 0xca, 0xce, 0xcc, 0x4b, 0xd7, 0x2f, 0x33, 0x4c, 0xcc, 0x29, 0xc8, 0x48, 0x34, 0xd6,
+	0x87, 0x8a, 0xc5, 0x07, 0x27, 0xe7, 0x17, 0xa4, 0xea, 0x15, 0x14, 0xe5, 0x97, 0xe4, 0x0b, 0x49,
+	0x66, 0x16, 0x97, 0x64, 0xe6, 0xeb, 0x21, 0x94, 0xeb, 0xc1, 0x94, 0x2b, 0x45, 0x72, 0xf1, 0xf8,
+	0x41, 0x84, 0xc1, 0x1a, 0x84, 0x3c, 0xb9, 0x78, 0x52, 0x52, 0x0b, 0x52, 0xf3, 0x52, 0x52, 0xf3,
+	0x92, 0x33, 0x53, 0x8b, 0x25, 0x18, 0x15, 0x98, 0x35, 0xb8, 0x8d, 0x54, 0xf5, 0x70, 0x9a, 0xa0,
+	0xe7, 0x02, 0x53, 0x5e, 0x19, 0x84, 0xa2, 0x55, 0xa9, 0x93, 0x89, 0x8b, 0x0b, 0x21, 0x29, 0x54,
+	0xca, 0x25, 0x56, 0x9c, 0x5f, 0x5a, 0x94, 0x9c, 0x1a, 0x0f, 0x32, 0x22, 0x27, 0x3f, 0x31, 0x25,
+	0x3e, 0x27, 0x31, 0x29, 0x35, 0x07, 0x66, 0x87, 0x3d, 0x51, 0x76, 0xe8, 0x05, 0x83, 0xcd, 0x08,
+	0x87, 0x1a, 0xe1, 0x03, 0x36, 0xc1, 0x35, 0xaf, 0xa4, 0xa8, 0x32, 0x48, 0xa4, 0x18, 0x8b, 0x94,
+	0x90, 0x35, 0x17, 0x7b, 0x66, 0x6e, 0x41, 0x7e, 0x51, 0x49, 0xb1, 0x04, 0x13, 0xd8, 0x1e, 0x45,
+	0x3c, 0xf6, 0x78, 0x82, 0x55, 0x06, 0xc1, 0x74, 0x48, 0xb9, 0x73, 0x49, 0xe2, 0xb4, 0x4f, 0x48,
+	0x80, 0x8b, 0x39, 0x3b, 0xb5, 0x52, 0x82, 0x51, 0x81, 0x51, 0x83, 0x33, 0x08, 0xc4, 0x14, 0x12,
+	0xe1, 0x62, 0x2d, 0x4b, 0xcc, 0x29, 0x4d, 0x95, 0x60, 0x02, 0x8b, 0x41, 0x38, 0x56, 0x4c, 0x16,
+	0x8c, 0x4a, 0x56, 0x5c, 0x6c, 0x10, 0xb3, 0x85, 0x64, 0xb8, 0x38, 0xf3, 0x12, 0x73, 0x53, 0x8b,
+	0x0b, 0x12, 0x93, 0x53, 0xa1, 0x7a, 0x11, 0x02, 0x42, 0x42, 0x5c, 0x2c, 0x19, 0xf9, 0xc5, 0x25,
+	0x50, 0x03, 0xc0, 0x6c, 0x27, 0xbd, 0x13, 0x8f, 0xe4, 0x18, 0x2f, 0x3c, 0x92, 0x63, 0x7c, 0xf0,
+	0x48, 0x8e, 0x31, 0x4a, 0x01, 0xe2, 0xfa, 0xcc, 0x7c, 0xfd, 0xc4, 0x82, 0x4c, 0x7d, 0x2c, 0x29,
+	0x20, 0x89, 0x0d, 0x1c, 0xe9, 0xc6, 0x80, 0x00, 0x00, 0x00, 0xff, 0xff, 0xe6, 0x7a, 0x07, 0xad,
+	0x1f, 0x02, 0x00, 0x00,
+}
diff --git a/networking/v1alpha3/network_scope.proto b/networking/v1alpha3/network_scope.proto
new file mode 100644
index 0000000000..ec7a27e64f
--- /dev/null
+++ b/networking/v1alpha3/network_scope.proto
@@ -0,0 +1,160 @@
+// Copyright 2018 Istio Authors
+//
+//   Licensed under the Apache License, Version 2.0 (the "License");
+//   you may not use this file except in compliance with the License.
+//   You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+//   Unless required by applicable law or agreed to in writing, software
+//   distributed under the License is distributed on an "AS IS" BASIS,
+//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//   See the License for the specific language governing permissions and
+//   limitations under the License.
+
+syntax = "proto3";
+
+package istio.networking.v1alpha3;
+
+option go_package = "istio.io/api/networking/v1alpha3";
+
+// `NetworkScope` describes the set of services that a workload depends on
+// for its operation. In other words, it describes the properties of egress
+// traffic from a given workload. By default, the service mesh established
+// by Istio will have a full mesh connectivity - i.e. every workload will
+// have proxy configuration required to reach every other workload in the
+// mesh. However most connectivity graphs are sparse in practice. The
+// NetworkScope provides a way to prune the connectivity graph
+// (i.e. dependencies) associated with each workload.
+//
+// Services and configuration in a mesh are organized into one or more
+// namespaces (e.g., a Kubernetes namespace or a CF org/space).  Workloads
+// in a namespace will be able to reach other workloads in the same
+// namespace. To declare dependencies on workloads in other namespaces, a
+// NetworkScope resource has to be specified in the current
+// namespace. *_Each namespace can have only one NetworkScope
+// resource_*. The behavior of the system is undefined if more than one
+// NetworkScope resource exists in a given namespace. The set of
+// dependencies specified in a NetworkScope resource will be used to
+// compute the [outbound] connectivity graph for every workload in the
+// namespace.
+//
+// NOTE: If workloads in the mesh depend only on other workloads in the
+// same namespace, use the mesh global setting to specify the default
+// network scope as CURRENT_NAMESPACE. To facilitate incremental pruning of
+// the connectivity graph, the default network scope for the mesh is set to
+// ALL_NAMESPACES. In otherwords, every workload will be able to reach
+// every other workload. Specifying a NetworkScope resource in a namespace
+// will automatically prune the configuration for the workloads in that
+// namespace.
+//
+// The following examples illustrate a few specific use cases of NetworkScope.
+//
+// The example below delcares a NetworkScope resource in the prod-us1
+// namespace. The workload with the `version: newlandingpage` label will be
+// able to reach all services declared in the egress namespace as well as
+// the landing.qa.foo.com service in the qa namespace. All other workloads
+// in the prod-us1 namespace will be able to reach the services in the
+// egress namespace only.
+//
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: NetworkScope
+// metadata:
+//   name: default
+//   namespace: prod-us1
+// spec:
+//   dependencies:
+//   - sourceWorkloadLabels:
+//       version: newlandingpage
+//     imports:
+//     - namespace: qa
+//       host: landing.qa.foo.com
+//     - namespace: egress
+//   - imports:
+//     - namespace: egress
+// ```
+//
+// In a mesh where the default network scope is set to CURRENT_NAMESPACE
+// only, if one or more workloads need to be able to reach every other
+// service in the mesh (e.g., metrics collection server), the following
+// NetworkScope resource can be used to specify such a dependency:
+//
+// ```yaml
+// apiVersion: networking.istio.io/v1alpha3
+// kind: NetworkScope
+// metadata:
+//   name: default
+//   namespace: metrics-collection
+// spec:
+//   dependencies:
+//   - sourceWorkloadLabels:
+//        app: metricsScraper
+//     imports:
+//     - namespace: '*'
+// ```
+//
+// The configuration above will allow workloads in the metrics-collection
+// namespace with the labels `app: metricsScraper` to access service in any
+// namespace while other workloads in the same namespace will be configured
+// for namespace local access as per the global default network scope
+// (CURRENT_NAMESPACE).
+//
+message NetworkScope {
+  // REQUIRED. The set of services that workloads in this namespace are
+  // expected to talk to, in addition to other workloads in the same
+  // namespace. Dependencies describe the properties of egress traffic from
+  // a given workload.
+  repeated Dependency dependencies = 1;
+}
+
+message Dependency {
+  // One or more labels that indicate a specific set of pods/VMs on which
+  // this dependency configuration should be applied.  The scope of label
+  // search is platform dependent.  On Kubernetes, for example, the scope
+  // includes pods running in the namespace in which the NetworkScope
+  // resource is present.  If the sourceWorkloadLabels are omitted, the
+  // imports specified will be applicable to all workloads in the current
+  // configuration namespace.
+  map<string, string> source_workload_labels = 1;
+
+  // REQUIRED: Import describes the set of namespaces whose exported
+  // services will be accessed by the workloads selected by the
+  // sourceWorkloadLabels. The sidecars attached to the workloads will be
+  // configured with information required to reach other services in the
+  // same namespace and the imported services. In addition to the
+  // explicitly specified namespaces, namespaces specified in the global
+  // mesh config (through NetworkScope.sharedNamespaces) will also be
+  // imported.
+  repeated Import imports = 2;
+}
+
+// Import describes the set of namespaces whose exported services
+// (real/virtual) will be accessed by workloads in a given namespace. The
+// sidecars attached to the workloads will be configured with information
+// required to reach the imported services only. The gateways in the
+// current namespace will only honor imported VirtualServices instead of
+// every VirtualService that binds itself to the gateway.
+//
+// Importing a service from a namespace will automatically import the
+// exported configuration artifacts associated with the service, such as
+// VirtualService, DestinationRule, etc. The service in a namespace can be
+// a service in the service registry (e.g., a kubernetes or cloud foundry
+// service) or a service specified via ServiceEntry configuration.
+//
+// NOTE: Only exported services and configuration artifacts from a
+// namespace can be imported. Private services/configuration will not be
+// imported. See the scope setting associated with VirtualService,
+// DestinationRule, ServiceEntry, etc.
+message Import {
+  // The configuration namespace whose services need to be imported.
+  // Specify * to import all namespaces. The import can be scoped further
+  // by specifying individual hosts.
+  string namespace = 1;
+
+  // A FQDN or wildcard prefixed DNS name of the host to import from the
+  // specified namespace. The hostnames include names of services from the
+  // service registry as well as those specified in a VirtualService.
+  string host = 2;
+}
diff --git a/python/istio_api/networking/v1alpha3/network_Scope_pb2.py b/python/istio_api/networking/v1alpha3/network_Scope_pb2.py
new file mode 100644
index 0000000000..b2ec5be392
--- /dev/null
+++ b/python/istio_api/networking/v1alpha3/network_Scope_pb2.py
@@ -0,0 +1,214 @@
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: networking/v1alpha3/network_Scope.proto
+
+import sys
+_b=sys.version_info[0]<3 and (lambda x:x) or (lambda x:x.encode('latin1'))
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import message as _message
+from google.protobuf import reflection as _reflection
+from google.protobuf import symbol_database as _symbol_database
+from google.protobuf import descriptor_pb2
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+
+
+DESCRIPTOR = _descriptor.FileDescriptor(
+  name='networking/v1alpha3/network_Scope.proto',
+  package='istio.networking.v1alpha3',
+  syntax='proto3',
+  serialized_pb=_b('\n\'networking/v1alpha3/network_Scope.proto\x12\x19istio.networking.v1alpha3\"K\n\x0cNetworkScope\x12;\n\x0c\x64\x65pendencies\x18\x01 \x03(\x0b\x32%.istio.networking.v1alpha3.Dependency\"\xde\x01\n\nDependency\x12_\n\x16source_workload_labels\x18\x01 \x03(\x0b\x32?.istio.networking.v1alpha3.Dependency.SourceWorkloadLabelsEntry\x12\x32\n\x07imports\x18\x02 \x03(\x0b\x32!.istio.networking.v1alpha3.Import\x1a;\n\x19SourceWorkloadLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\")\n\x06Import\x12\x11\n\tnamespace\x18\x01 \x01(\t\x12\x0c\n\x04host\x18\x02 \x01(\tB\"Z istio.io/api/networking/v1alpha3b\x06proto3')
+)
+
+
+
+
+_NETWORKSCOPE = _descriptor.Descriptor(
+  name='NetworkScope',
+  full_name='istio.networking.v1alpha3.NetworkScope',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='dependencies', full_name='istio.networking.v1alpha3.NetworkScope.dependencies', index=0,
+      number=1, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=70,
+  serialized_end=145,
+)
+
+
+_DEPENDENCY_SOURCEWORKLOADLABELSENTRY = _descriptor.Descriptor(
+  name='SourceWorkloadLabelsEntry',
+  full_name='istio.networking.v1alpha3.Dependency.SourceWorkloadLabelsEntry',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='key', full_name='istio.networking.v1alpha3.Dependency.SourceWorkloadLabelsEntry.key', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='value', full_name='istio.networking.v1alpha3.Dependency.SourceWorkloadLabelsEntry.value', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  options=_descriptor._ParseOptions(descriptor_pb2.MessageOptions(), _b('8\001')),
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=311,
+  serialized_end=370,
+)
+
+_DEPENDENCY = _descriptor.Descriptor(
+  name='Dependency',
+  full_name='istio.networking.v1alpha3.Dependency',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='source_workload_labels', full_name='istio.networking.v1alpha3.Dependency.source_workload_labels', index=0,
+      number=1, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='imports', full_name='istio.networking.v1alpha3.Dependency.imports', index=1,
+      number=2, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[_DEPENDENCY_SOURCEWORKLOADLABELSENTRY, ],
+  enum_types=[
+  ],
+  options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=148,
+  serialized_end=370,
+)
+
+
+_IMPORT = _descriptor.Descriptor(
+  name='Import',
+  full_name='istio.networking.v1alpha3.Import',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='namespace', full_name='istio.networking.v1alpha3.Import.namespace', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='host', full_name='istio.networking.v1alpha3.Import.host', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  options=None,
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=372,
+  serialized_end=413,
+)
+
+_NETWORKSCOPE.fields_by_name['dependencies'].message_type = _DEPENDENCY
+_DEPENDENCY_SOURCEWORKLOADLABELSENTRY.containing_type = _DEPENDENCY
+_DEPENDENCY.fields_by_name['source_workload_labels'].message_type = _DEPENDENCY_SOURCEWORKLOADLABELSENTRY
+_DEPENDENCY.fields_by_name['imports'].message_type = _IMPORT
+DESCRIPTOR.message_types_by_name['NetworkScope'] = _NETWORKSCOPE
+DESCRIPTOR.message_types_by_name['Dependency'] = _DEPENDENCY
+DESCRIPTOR.message_types_by_name['Import'] = _IMPORT
+_sym_db.RegisterFileDescriptor(DESCRIPTOR)
+
+NetworkScope = _reflection.GeneratedProtocolMessageType('NetworkScope', (_message.Message,), dict(
+  DESCRIPTOR = _NETWORKSCOPE,
+  __module__ = 'networking.v1alpha3.network_Scope_pb2'
+  # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.NetworkScope)
+  ))
+_sym_db.RegisterMessage(NetworkScope)
+
+Dependency = _reflection.GeneratedProtocolMessageType('Dependency', (_message.Message,), dict(
+
+  SourceWorkloadLabelsEntry = _reflection.GeneratedProtocolMessageType('SourceWorkloadLabelsEntry', (_message.Message,), dict(
+    DESCRIPTOR = _DEPENDENCY_SOURCEWORKLOADLABELSENTRY,
+    __module__ = 'networking.v1alpha3.network_Scope_pb2'
+    # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.Dependency.SourceWorkloadLabelsEntry)
+    ))
+  ,
+  DESCRIPTOR = _DEPENDENCY,
+  __module__ = 'networking.v1alpha3.network_Scope_pb2'
+  # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.Dependency)
+  ))
+_sym_db.RegisterMessage(Dependency)
+_sym_db.RegisterMessage(Dependency.SourceWorkloadLabelsEntry)
+
+Import = _reflection.GeneratedProtocolMessageType('Import', (_message.Message,), dict(
+  DESCRIPTOR = _IMPORT,
+  __module__ = 'networking.v1alpha3.network_Scope_pb2'
+  # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.Import)
+  ))
+_sym_db.RegisterMessage(Import)
+
+
+DESCRIPTOR.has_options = True
+DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z istio.io/api/networking/v1alpha3'))
+_DEPENDENCY_SOURCEWORKLOADLABELSENTRY.has_options = True
+_DEPENDENCY_SOURCEWORKLOADLABELSENTRY._options = _descriptor._ParseOptions(descriptor_pb2.MessageOptions(), _b('8\001'))
+# @@protoc_insertion_point(module_scope)

From c2dee79b25b6f3b598e53559a6cec3631ce70e65 Mon Sep 17 00:00:00 2001
From: Shriram Rajagopalan <shriramr@vmware.com>
Date: Tue, 27 Nov 2018 15:34:25 -0500
Subject: [PATCH 05/11] proto lock

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>
---
 proto.lock | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/proto.lock b/proto.lock
index 9002723a2f..854cce856e 100644
--- a/proto.lock
+++ b/proto.lock
@@ -3110,6 +3110,60 @@
         ]
       }
     },
+    {
+      "protopath": "networking:/:v1alpha3:/:network_scope.proto",
+      "def": {
+        "messages": [
+          {
+            "name": "NetworkScope",
+            "fields": [
+              {
+                "id": 1,
+                "name": "dependencies",
+                "type": "Dependency",
+                "is_repeated": true
+              }
+            ]
+          },
+          {
+            "name": "Dependency",
+            "fields": [
+              {
+                "id": 2,
+                "name": "imports",
+                "type": "Import",
+                "is_repeated": true
+              }
+            ],
+            "maps": [
+              {
+                "key_type": "string",
+                "field": {
+                  "id": 1,
+                  "name": "source_workload_labels",
+                  "type": "string"
+                }
+              }
+            ]
+          },
+          {
+            "name": "Import",
+            "fields": [
+              {
+                "id": 1,
+                "name": "namespace",
+                "type": "string"
+              },
+              {
+                "id": 2,
+                "name": "host",
+                "type": "string"
+              }
+            ]
+          }
+        ]
+      }
+    },
     {
       "protopath": "networking:/:v1alpha3:/:service_entry.proto",
       "def": {

From 2b9b1cc822d95d2b7deb1946ce1358fda69b7416 Mon Sep 17 00:00:00 2001
From: Shriram Rajagopalan <shriramr@vmware.com>
Date: Tue, 27 Nov 2018 16:25:19 -0500
Subject: [PATCH 06/11] updates

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>
---
 Makefile                                      |   3 +
 networking/v1alpha3/destination_rule.pb.go    |   4 +-
 networking/v1alpha3/gateway.pb.go             |   8 +-
 networking/v1alpha3/gateway.proto             |   8 +-
 .../istio.networking.v1alpha3.pb.html         | 257 +++++---
 networking/v1alpha3/network_scope.pb.go       | 583 +++++++++---------
 networking/v1alpha3/network_scope.proto       | 109 ++--
 networking/v1alpha3/service_entry.pb.go       | 106 +++-
 networking/v1alpha3/service_entry.proto       |   8 +
 networking/v1alpha3/virtual_service.pb.go     | 265 ++++----
 networking/v1alpha3/virtual_service.proto     |   8 +
 proto.lock                                    |  89 ++-
 .../networking/v1alpha3/network_Scope_pb2.py  | 171 ++---
 .../networking/v1alpha3/service_entry_pb2.py  |  37 +-
 .../v1alpha3/virtual_service_pb2.py           | 145 +++--
 15 files changed, 1043 insertions(+), 758 deletions(-)

diff --git a/Makefile b/Makefile
index a74a1d6faa..5d804e31ac 100644
--- a/Makefile
+++ b/Makefile
@@ -351,6 +351,9 @@ clean-envoy:
 proto-commit:
 	@$(docker_lock) commit
 
+proto-commit-force:
+	@$(docker_lock) commit --force
+
 #####################
 # Lint
 #####################
diff --git a/networking/v1alpha3/destination_rule.pb.go b/networking/v1alpha3/destination_rule.pb.go
index 7dd9b065e4..e6e08ba92d 100644
--- a/networking/v1alpha3/destination_rule.pb.go
+++ b/networking/v1alpha3/destination_rule.pb.go
@@ -8,7 +8,7 @@
 		networking/v1alpha3/destination_rule.proto
 		networking/v1alpha3/envoy_filter.proto
 		networking/v1alpha3/gateway.proto
-		networking/v1alpha3/network_Scope.proto
+		networking/v1alpha3/network_scope.proto
 		networking/v1alpha3/service_entry.proto
 		networking/v1alpha3/virtual_service.proto
 
@@ -25,8 +25,6 @@
 		Server
 		Port
 		NetworkScope
-		Dependency
-		Import
 		ServiceEntry
 		VirtualService
 		Destination
diff --git a/networking/v1alpha3/gateway.pb.go b/networking/v1alpha3/gateway.pb.go
index cbab67e68e..2ae532566e 100644
--- a/networking/v1alpha3/gateway.pb.go
+++ b/networking/v1alpha3/gateway.pb.go
@@ -116,6 +116,7 @@ func (Server_TLSOptions_TLSProtocol) EnumDescriptor() ([]byte, []int) {
 // kind: Gateway
 // metadata:
 //   name: my-gateway
+//   namespace: some-config-namespace
 // spec:
 //   selector:
 //     app: my-gateway-controller
@@ -173,13 +174,14 @@ func (Server_TLSOptions_TLSProtocol) EnumDescriptor() ([]byte, []int) {
 // kind: VirtualService
 // metadata:
 //   name: bookinfo-rule
+//   namespace: bookinfo-namespace
 // spec:
 //   hosts:
 //   - reviews.prod.svc.cluster.local
 //   - uk.bookinfo.com
 //   - eu.bookinfo.com
 //   gateways:
-//   - my-gateway
+//   - some-config-namespace/my-gateway
 //   - mesh # applies to all the sidecars in the mesh
 //   http:
 //   - match:
@@ -215,11 +217,13 @@ func (Server_TLSOptions_TLSProtocol) EnumDescriptor() ([]byte, []int) {
 // kind: VirtualService
 // metadata:
 //   name: bookinfo-Mongo
+//   namespace: bookinfo-namespace
 // spec:
 //   hosts:
 //   - mongosvr.prod.svc.cluster.local #name of internal Mongo service
 //   gateways:
-//   - my-gateway
+//   - some-config-namespace/my-gateway # can omit the namespace if gateway is in same
+//                                        namespace as virtual service.
 //   tcp:
 //   - match:
 //     - port: 27017
diff --git a/networking/v1alpha3/gateway.proto b/networking/v1alpha3/gateway.proto
index e7a54a41af..4f857dd8d2 100644
--- a/networking/v1alpha3/gateway.proto
+++ b/networking/v1alpha3/gateway.proto
@@ -36,6 +36,7 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // kind: Gateway
 // metadata:
 //   name: my-gateway
+//   namespace: some-config-namespace
 // spec:
 //   selector:
 //     app: my-gateway-controller
@@ -93,13 +94,14 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // kind: VirtualService
 // metadata:
 //   name: bookinfo-rule
+//   namespace: bookinfo-namespace
 // spec:
 //   hosts:
 //   - reviews.prod.svc.cluster.local
 //   - uk.bookinfo.com
 //   - eu.bookinfo.com
 //   gateways:
-//   - my-gateway
+//   - some-config-namespace/my-gateway
 //   - mesh # applies to all the sidecars in the mesh
 //   http:
 //   - match:
@@ -135,11 +137,13 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // kind: VirtualService
 // metadata:
 //   name: bookinfo-Mongo
+//   namespace: bookinfo-namespace
 // spec:
 //   hosts:
 //   - mongosvr.prod.svc.cluster.local #name of internal Mongo service
 //   gateways:
-//   - my-gateway
+//   - some-config-namespace/my-gateway # can omit the namespace if gateway is in same
+//                                        namespace as virtual service.
 //   tcp:
 //   - match:
 //     - port: 27017
diff --git a/networking/v1alpha3/istio.networking.v1alpha3.pb.html b/networking/v1alpha3/istio.networking.v1alpha3.pb.html
index dcc4129ac1..91b8ba78f1 100644
--- a/networking/v1alpha3/istio.networking.v1alpha3.pb.html
+++ b/networking/v1alpha3/istio.networking.v1alpha3.pb.html
@@ -6,7 +6,7 @@
 generator: protoc-gen-docs
 aliases:
   - /docs/reference/config/istio.routing.v1alpha1/
-number_of_entries: 58
+number_of_entries: 59
 ---
 <p>Configuration affecting traffic routing. Here are a few terms useful to define
 in the context of traffic routing.</p>
@@ -37,6 +37,35 @@
 application code to decouple itself from the evolution of dependent
 services.</p>
 
+<h2 id="ConfigScope">ConfigScope</h2>
+<section>
+<p>ConfigScope defines the visibility of an Istio configuration artifact in
+a namespace when the namespace is imported.  By default all
+configuration artifacts are public. Configurations with private scope
+will not be imported when the namespace containing the configuration is
+imported in a NetworkScope.</p>
+
+<table class="enum-values">
+<thead>
+<tr>
+<th>Name</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr id="ConfigScope-PUBLIC">
+<td><code>PUBLIC</code></td>
+<td>
+</td>
+</tr>
+<tr id="ConfigScope-PRIVATE">
+<td><code>PRIVATE</code></td>
+<td>
+</td>
+</tr>
+</tbody>
+</table>
+</section>
 <h2 id="ConnectionPoolSettings">ConnectionPoolSettings</h2>
 <section>
 <p>Connection pool settings for an upstream host. The settings apply to
@@ -326,49 +355,6 @@ <h2 id="CorsPolicy">CorsPolicy</h2>
 (not the preflight) using credentials. Translates to
 Access-Control-Allow-Credentials header.</p>
 
-</td>
-</tr>
-</tbody>
-</table>
-</section>
-<h2 id="Dependency">Dependency</h2>
-<section>
-<table class="message-fields">
-<thead>
-<tr>
-<th>Field</th>
-<th>Type</th>
-<th>Description</th>
-</tr>
-</thead>
-<tbody>
-<tr id="Dependency-source_workload_labels">
-<td><code>sourceWorkloadLabels</code></td>
-<td><code>map&lt;string,&nbsp;string&gt;</code></td>
-<td>
-<p>One or more labels that indicate a specific set of pods/VMs on which
-this dependency configuration should be applied.  The scope of label
-search is platform dependent.  On Kubernetes, for example, the scope
-includes pods running in the namespace in which the NetworkScope
-resource is present.  If the sourceWorkloadLabels are omitted, the
-imports specified will be applicable to all workloads in the current
-configuration namespace.</p>
-
-</td>
-</tr>
-<tr id="Dependency-imports">
-<td><code>imports</code></td>
-<td><code><a href="#Import">Import[]</a></code></td>
-<td>
-<p>REQUIRED: Import describes the set of namespaces whose exported
-services will be accessed by the workloads selected by the
-sourceWorkloadLabels. The sidecars attached to the workloads will be
-configured with information required to reach other services in the
-same namespace and the imported services. In addition to the
-explicitly specified namespaces, namespaces specified in the global
-mesh config (through NetworkScope.sharedNamespaces) will also be
-imported.</p>
-
 </td>
 </tr>
 </tbody>
@@ -1087,6 +1073,7 @@ <h2 id="Gateway">Gateway</h2>
 kind: Gateway
 metadata:
   name: my-gateway
+  namespace: some-config-namespace
 spec:
   selector:
     app: my-gateway-controller
@@ -1144,13 +1131,14 @@ <h2 id="Gateway">Gateway</h2>
 kind: VirtualService
 metadata:
   name: bookinfo-rule
+  namespace: bookinfo-namespace
 spec:
   hosts:
   - reviews.prod.svc.cluster.local
   - uk.bookinfo.com
   - eu.bookinfo.com
   gateways:
-  - my-gateway
+  - some-config-namespace/my-gateway
   - mesh # applies to all the sidecars in the mesh
   http:
   - match:
@@ -1185,11 +1173,13 @@ <h2 id="Gateway">Gateway</h2>
 kind: VirtualService
 metadata:
   name: bookinfo-Mongo
+  namespace: bookinfo-namespace
 spec:
   hosts:
   - mongosvr.prod.svc.cluster.local #name of internal Mongo service
   gateways:
-  - my-gateway
+  - some-config-namespace/my-gateway # can omit the namespace if gateway is in same
+                                       namespace as virtual service.
   tcp:
   - match:
     - port: 27017
@@ -2126,58 +2116,6 @@ <h2 id="Headers-HeaderOperations">Headers.HeaderOperations</h2>
 <td>
 <p>Remove a the specified headers</p>
 
-</td>
-</tr>
-</tbody>
-</table>
-</section>
-<h2 id="Import">Import</h2>
-<section>
-<p>Import describes the set of namespaces whose exported services
-(real/virtual) will be accessed by workloads in a given namespace. The
-sidecars attached to the workloads will be configured with information
-required to reach the imported services only. The gateways in the
-current namespace will only honor imported VirtualServices instead of
-every VirtualService that binds itself to the gateway.</p>
-
-<p>Importing a service from a namespace will automatically import the
-exported configuration artifacts associated with the service, such as
-VirtualService, DestinationRule, etc. The service in a namespace can be
-a service in the service registry (e.g., a kubernetes or cloud foundry
-service) or a service specified via ServiceEntry configuration.</p>
-
-<p>NOTE: Only exported services and configuration artifacts from a
-namespace can be imported. Private services/configuration will not be
-imported. See the scope setting associated with VirtualService,
-DestinationRule, ServiceEntry, etc.</p>
-
-<table class="message-fields">
-<thead>
-<tr>
-<th>Field</th>
-<th>Type</th>
-<th>Description</th>
-</tr>
-</thead>
-<tbody>
-<tr id="Import-namespace">
-<td><code>namespace</code></td>
-<td><code>string</code></td>
-<td>
-<p>The configuration namespace whose services need to be imported.
-Specify * to import all namespaces. The import can be scoped further
-by specifying individual hosts.</p>
-
-</td>
-</tr>
-<tr id="Import-host">
-<td><code>host</code></td>
-<td><code>string</code></td>
-<td>
-<p>A FQDN or wildcard prefixed DNS name of the host to import from the
-specified namespace. The hostnames include names of services from the
-service registry as well as those specified in a VirtualService.</p>
-
 </td>
 </tr>
 </tbody>
@@ -2546,13 +2484,111 @@ <h2 id="NetworkScope">NetworkScope</h2>
 <tbody>
 <tr id="NetworkScope-dependencies">
 <td><code>dependencies</code></td>
-<td><code><a href="#Dependency">Dependency[]</a></code></td>
+<td><code><a href="#NetworkScope-Dependency">NetworkScope.Dependency[]</a></code></td>
 <td>
 <p>REQUIRED. The set of services that workloads in this namespace are
 expected to talk to, in addition to other workloads in the same
 namespace. Dependencies describe the properties of egress traffic from
 a given workload.</p>
 
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="NetworkScope-Dependency">NetworkScope.Dependency</h2>
+<section>
+<p>Dependency describes a workload and the set of service dependencies
+for the workload.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr id="NetworkScope-Dependency-source_workload_labels">
+<td><code>sourceWorkloadLabels</code></td>
+<td><code>map&lt;string,&nbsp;string&gt;</code></td>
+<td>
+<p>One or more labels that indicate a specific set of pods/VMs on which
+this dependency configuration should be applied.  The scope of label
+search is platform dependent.  On Kubernetes, for example, the scope
+includes pods running in the namespace in which the NetworkScope
+resource is present.  If the sourceWorkloadLabels are omitted, the
+imports specified will be applicable to all workloads in the current
+configuration namespace.</p>
+
+</td>
+</tr>
+<tr id="NetworkScope-Dependency-imports">
+<td><code>imports</code></td>
+<td><code><a href="#NetworkScope-Import">NetworkScope.Import[]</a></code></td>
+<td>
+<p>REQUIRED: Import describes the set of namespaces whose exported
+services will be accessed by the workloads selected by the
+sourceWorkloadLabels. The sidecars attached to the workloads will be
+configured with information required to reach other services in the
+same namespace and the imported services. In addition to the
+explicitly specified namespaces, namespaces specified in the global
+mesh config (through NetworkScope.sharedNamespaces) will also be
+imported.</p>
+
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="NetworkScope-Import">NetworkScope.Import</h2>
+<section>
+<p>Import describes the set of namespaces whose exported services
+(real/virtual) will be accessed by workloads in a given namespace. The
+sidecars attached to the workloads will be configured with information
+required to reach the imported services only. The gateways in the
+current namespace will only honor imported VirtualServices instead of
+every VirtualService that binds itself to the gateway.</p>
+
+<p>Importing a service from a namespace will automatically import the
+exported configuration artifacts associated with the service, such as
+VirtualService, DestinationRule, etc. The service in a namespace can be
+a service in the service registry (e.g., a kubernetes or cloud foundry
+service) or a service specified via ServiceEntry configuration.</p>
+
+<p>NOTE: Only exported services and configuration artifacts from a
+namespace can be imported. Private services/configuration will not be
+imported. See the scope setting associated with VirtualService,
+DestinationRule, ServiceEntry, etc.</p>
+
+<table class="message-fields">
+<thead>
+<tr>
+<th>Field</th>
+<th>Type</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr id="NetworkScope-Import-namespace">
+<td><code>namespace</code></td>
+<td><code>string</code></td>
+<td>
+<p>The configuration namespace whose services need to be imported.
+Specify * to import all namespaces. The import can be scoped further
+by specifying individual hosts.</p>
+
+</td>
+</tr>
+<tr id="NetworkScope-Import-host">
+<td><code>host</code></td>
+<td><code>string</code></td>
+<td>
+<p>A FQDN or wildcard prefixed DNS name of the host to import from the
+specified namespace. The hostnames include names of services from the
+service registry as well as those specified in a VirtualService.</p>
+
 </td>
 </tr>
 </tbody>
@@ -3434,6 +3470,18 @@ <h2 id="ServiceEntry">ServiceEntry</h2>
 <td>
 <p>One or more endpoints associated with the service.</p>
 
+</td>
+</tr>
+<tr id="ServiceEntry-scope">
+<td><code>scope</code></td>
+<td><code><a href="#ConfigScope">ConfigScope</a></code></td>
+<td>
+<p>The visibility setting associated with this service entry. Set to
+PRIVATE if this service should not be visible outside the namespace
+where the service entry was added. The default scope is public,
+i.e. the service added by the service entry will be visible to
+workloads in the entire mesh.</p>
+
 </td>
 </tr>
 </tbody>
@@ -4376,6 +4424,17 @@ <h2 id="VirtualService">VirtualService</h2>
 be applied to any port that is not a HTTP or TLS port. The first rule
 matching an incoming request is used.</p>
 
+</td>
+</tr>
+<tr id="VirtualService-scope">
+<td><code>scope</code></td>
+<td><code><a href="#ConfigScope">ConfigScope</a></code></td>
+<td>
+<p>The visibility setting associated with this virtual service. Set to
+PRIVATE if this virtual service should not be exported, i.e. restrict
+the applicability of this virtual service to only workloads in the same
+namespace as the virtual service.</p>
+
 </td>
 </tr>
 </tbody>
diff --git a/networking/v1alpha3/network_scope.pb.go b/networking/v1alpha3/network_scope.pb.go
index 917f9ed91d..d04b604135 100644
--- a/networking/v1alpha3/network_scope.pb.go
+++ b/networking/v1alpha3/network_scope.pb.go
@@ -1,5 +1,5 @@
 // Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: networking/v1alpha3/network_Scope.proto
+// source: networking/v1alpha3/network_scope.proto
 
 package v1alpha3
 
@@ -14,6 +14,32 @@ var _ = proto.Marshal
 var _ = fmt.Errorf
 var _ = math.Inf
 
+// ConfigScope defines the visibility of an Istio configuration artifact in
+// a namespace when the namespace is imported.  By default all
+// configuration artifacts are public. Configurations with private scope
+// will not be imported when the namespace containing the configuration is
+// imported in a NetworkScope.
+type ConfigScope int32
+
+const (
+	ConfigScope_PUBLIC  ConfigScope = 0
+	ConfigScope_PRIVATE ConfigScope = 1
+)
+
+var ConfigScope_name = map[int32]string{
+	0: "PUBLIC",
+	1: "PRIVATE",
+}
+var ConfigScope_value = map[string]int32{
+	"PUBLIC":  0,
+	"PRIVATE": 1,
+}
+
+func (x ConfigScope) String() string {
+	return proto.EnumName(ConfigScope_name, int32(x))
+}
+func (ConfigScope) EnumDescriptor() ([]byte, []int) { return fileDescriptorNetworkScope, []int{0} }
+
 // `NetworkScope` describes the set of services that a workload depends on
 // for its operation. In other words, it describes the properties of egress
 // traffic from a given workload. By default, the service mesh established
@@ -102,60 +128,21 @@ type NetworkScope struct {
 	// expected to talk to, in addition to other workloads in the same
 	// namespace. Dependencies describe the properties of egress traffic from
 	// a given workload.
-	Dependencies []*Dependency `protobuf:"bytes,1,rep,name=dependencies" json:"dependencies,omitempty"`
+	Dependencies []*NetworkScope_Dependency `protobuf:"bytes,1,rep,name=dependencies" json:"dependencies,omitempty"`
 }
 
 func (m *NetworkScope) Reset()                    { *m = NetworkScope{} }
 func (m *NetworkScope) String() string            { return proto.CompactTextString(m) }
 func (*NetworkScope) ProtoMessage()               {}
-func (*NetworkScope) Descriptor() ([]byte, []int) { return fileDescriptorNetwork_Scope, []int{0} }
+func (*NetworkScope) Descriptor() ([]byte, []int) { return fileDescriptorNetworkScope, []int{0} }
 
-func (m *NetworkScope) GetDependencies() []*Dependency {
+func (m *NetworkScope) GetDependencies() []*NetworkScope_Dependency {
 	if m != nil {
 		return m.Dependencies
 	}
 	return nil
 }
 
-type Dependency struct {
-	// One or more labels that indicate a specific set of pods/VMs on which
-	// this dependency configuration should be applied.  The scope of label
-	// search is platform dependent.  On Kubernetes, for example, the scope
-	// includes pods running in the namespace in which the NetworkScope
-	// resource is present.  If the sourceWorkloadLabels are omitted, the
-	// imports specified will be applicable to all workloads in the current
-	// configuration namespace.
-	SourceWorkloadLabels map[string]string `protobuf:"bytes,1,rep,name=source_workload_labels,json=sourceWorkloadLabels" json:"source_workload_labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	// REQUIRED: Import describes the set of namespaces whose exported
-	// services will be accessed by the workloads selected by the
-	// sourceWorkloadLabels. The sidecars attached to the workloads will be
-	// configured with information required to reach other services in the
-	// same namespace and the imported services. In addition to the
-	// explicitly specified namespaces, namespaces specified in the global
-	// mesh config (through NetworkScope.sharedNamespaces) will also be
-	// imported.
-	Imports []*Import `protobuf:"bytes,2,rep,name=imports" json:"imports,omitempty"`
-}
-
-func (m *Dependency) Reset()                    { *m = Dependency{} }
-func (m *Dependency) String() string            { return proto.CompactTextString(m) }
-func (*Dependency) ProtoMessage()               {}
-func (*Dependency) Descriptor() ([]byte, []int) { return fileDescriptorNetwork_Scope, []int{1} }
-
-func (m *Dependency) GetSourceWorkloadLabels() map[string]string {
-	if m != nil {
-		return m.SourceWorkloadLabels
-	}
-	return nil
-}
-
-func (m *Dependency) GetImports() []*Import {
-	if m != nil {
-		return m.Imports
-	}
-	return nil
-}
-
 // Import describes the set of namespaces whose exported services
 // (real/virtual) will be accessed by workloads in a given namespace. The
 // sidecars attached to the workloads will be configured with information
@@ -173,7 +160,7 @@ func (m *Dependency) GetImports() []*Import {
 // namespace can be imported. Private services/configuration will not be
 // imported. See the scope setting associated with VirtualService,
 // DestinationRule, ServiceEntry, etc.
-type Import struct {
+type NetworkScope_Import struct {
 	// The configuration namespace whose services need to be imported.
 	// Specify * to import all namespaces. The import can be scoped further
 	// by specifying individual hosts.
@@ -184,29 +171,75 @@ type Import struct {
 	Host string `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"`
 }
 
-func (m *Import) Reset()                    { *m = Import{} }
-func (m *Import) String() string            { return proto.CompactTextString(m) }
-func (*Import) ProtoMessage()               {}
-func (*Import) Descriptor() ([]byte, []int) { return fileDescriptorNetwork_Scope, []int{2} }
+func (m *NetworkScope_Import) Reset()         { *m = NetworkScope_Import{} }
+func (m *NetworkScope_Import) String() string { return proto.CompactTextString(m) }
+func (*NetworkScope_Import) ProtoMessage()    {}
+func (*NetworkScope_Import) Descriptor() ([]byte, []int) {
+	return fileDescriptorNetworkScope, []int{0, 0}
+}
 
-func (m *Import) GetNamespace() string {
+func (m *NetworkScope_Import) GetNamespace() string {
 	if m != nil {
 		return m.Namespace
 	}
 	return ""
 }
 
-func (m *Import) GetHost() string {
+func (m *NetworkScope_Import) GetHost() string {
 	if m != nil {
 		return m.Host
 	}
 	return ""
 }
 
+// Dependency describes a workload and the set of service dependencies
+// for the workload.
+type NetworkScope_Dependency struct {
+	// One or more labels that indicate a specific set of pods/VMs on which
+	// this dependency configuration should be applied.  The scope of label
+	// search is platform dependent.  On Kubernetes, for example, the scope
+	// includes pods running in the namespace in which the NetworkScope
+	// resource is present.  If the sourceWorkloadLabels are omitted, the
+	// imports specified will be applicable to all workloads in the current
+	// configuration namespace.
+	SourceWorkloadLabels map[string]string `protobuf:"bytes,1,rep,name=source_workload_labels,json=sourceWorkloadLabels" json:"source_workload_labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// REQUIRED: Import describes the set of namespaces whose exported
+	// services will be accessed by the workloads selected by the
+	// sourceWorkloadLabels. The sidecars attached to the workloads will be
+	// configured with information required to reach other services in the
+	// same namespace and the imported services. In addition to the
+	// explicitly specified namespaces, namespaces specified in the global
+	// mesh config (through NetworkScope.sharedNamespaces) will also be
+	// imported.
+	Imports []*NetworkScope_Import `protobuf:"bytes,2,rep,name=imports" json:"imports,omitempty"`
+}
+
+func (m *NetworkScope_Dependency) Reset()         { *m = NetworkScope_Dependency{} }
+func (m *NetworkScope_Dependency) String() string { return proto.CompactTextString(m) }
+func (*NetworkScope_Dependency) ProtoMessage()    {}
+func (*NetworkScope_Dependency) Descriptor() ([]byte, []int) {
+	return fileDescriptorNetworkScope, []int{0, 1}
+}
+
+func (m *NetworkScope_Dependency) GetSourceWorkloadLabels() map[string]string {
+	if m != nil {
+		return m.SourceWorkloadLabels
+	}
+	return nil
+}
+
+func (m *NetworkScope_Dependency) GetImports() []*NetworkScope_Import {
+	if m != nil {
+		return m.Imports
+	}
+	return nil
+}
+
 func init() {
 	proto.RegisterType((*NetworkScope)(nil), "istio.networking.v1alpha3.NetworkScope")
-	proto.RegisterType((*Dependency)(nil), "istio.networking.v1alpha3.Dependency")
-	proto.RegisterType((*Import)(nil), "istio.networking.v1alpha3.Import")
+	proto.RegisterType((*NetworkScope_Import)(nil), "istio.networking.v1alpha3.NetworkScope.Import")
+	proto.RegisterType((*NetworkScope_Dependency)(nil), "istio.networking.v1alpha3.NetworkScope.Dependency")
+	proto.RegisterEnum("istio.networking.v1alpha3.ConfigScope", ConfigScope_name, ConfigScope_value)
 }
 func (m *NetworkScope) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
@@ -227,7 +260,7 @@ func (m *NetworkScope) MarshalTo(dAtA []byte) (int, error) {
 		for _, msg := range m.Dependencies {
 			dAtA[i] = 0xa
 			i++
-			i = encodeVarintNetwork_Scope(dAtA, i, uint64(msg.Size()))
+			i = encodeVarintNetworkScope(dAtA, i, uint64(msg.Size()))
 			n, err := msg.MarshalTo(dAtA[i:])
 			if err != nil {
 				return 0, err
@@ -238,7 +271,37 @@ func (m *NetworkScope) MarshalTo(dAtA []byte) (int, error) {
 	return i, nil
 }
 
-func (m *Dependency) Marshal() (dAtA []byte, err error) {
+func (m *NetworkScope_Import) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *NetworkScope_Import) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.Namespace) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintNetworkScope(dAtA, i, uint64(len(m.Namespace)))
+		i += copy(dAtA[i:], m.Namespace)
+	}
+	if len(m.Host) > 0 {
+		dAtA[i] = 0x12
+		i++
+		i = encodeVarintNetworkScope(dAtA, i, uint64(len(m.Host)))
+		i += copy(dAtA[i:], m.Host)
+	}
+	return i, nil
+}
+
+func (m *NetworkScope_Dependency) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalTo(dAtA)
@@ -248,7 +311,7 @@ func (m *Dependency) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *Dependency) MarshalTo(dAtA []byte) (int, error) {
+func (m *NetworkScope_Dependency) MarshalTo(dAtA []byte) (int, error) {
 	var i int
 	_ = i
 	var l int
@@ -258,15 +321,15 @@ func (m *Dependency) MarshalTo(dAtA []byte) (int, error) {
 			dAtA[i] = 0xa
 			i++
 			v := m.SourceWorkloadLabels[k]
-			mapSize := 1 + len(k) + sovNetwork_Scope(uint64(len(k))) + 1 + len(v) + sovNetwork_Scope(uint64(len(v)))
-			i = encodeVarintNetwork_Scope(dAtA, i, uint64(mapSize))
+			mapSize := 1 + len(k) + sovNetworkScope(uint64(len(k))) + 1 + len(v) + sovNetworkScope(uint64(len(v)))
+			i = encodeVarintNetworkScope(dAtA, i, uint64(mapSize))
 			dAtA[i] = 0xa
 			i++
-			i = encodeVarintNetwork_Scope(dAtA, i, uint64(len(k)))
+			i = encodeVarintNetworkScope(dAtA, i, uint64(len(k)))
 			i += copy(dAtA[i:], k)
 			dAtA[i] = 0x12
 			i++
-			i = encodeVarintNetwork_Scope(dAtA, i, uint64(len(v)))
+			i = encodeVarintNetworkScope(dAtA, i, uint64(len(v)))
 			i += copy(dAtA[i:], v)
 		}
 	}
@@ -274,7 +337,7 @@ func (m *Dependency) MarshalTo(dAtA []byte) (int, error) {
 		for _, msg := range m.Imports {
 			dAtA[i] = 0x12
 			i++
-			i = encodeVarintNetwork_Scope(dAtA, i, uint64(msg.Size()))
+			i = encodeVarintNetworkScope(dAtA, i, uint64(msg.Size()))
 			n, err := msg.MarshalTo(dAtA[i:])
 			if err != nil {
 				return 0, err
@@ -285,37 +348,7 @@ func (m *Dependency) MarshalTo(dAtA []byte) (int, error) {
 	return i, nil
 }
 
-func (m *Import) Marshal() (dAtA []byte, err error) {
-	size := m.Size()
-	dAtA = make([]byte, size)
-	n, err := m.MarshalTo(dAtA)
-	if err != nil {
-		return nil, err
-	}
-	return dAtA[:n], nil
-}
-
-func (m *Import) MarshalTo(dAtA []byte) (int, error) {
-	var i int
-	_ = i
-	var l int
-	_ = l
-	if len(m.Namespace) > 0 {
-		dAtA[i] = 0xa
-		i++
-		i = encodeVarintNetwork_Scope(dAtA, i, uint64(len(m.Namespace)))
-		i += copy(dAtA[i:], m.Namespace)
-	}
-	if len(m.Host) > 0 {
-		dAtA[i] = 0x12
-		i++
-		i = encodeVarintNetwork_Scope(dAtA, i, uint64(len(m.Host)))
-		i += copy(dAtA[i:], m.Host)
-	}
-	return i, nil
-}
-
-func encodeVarintNetwork_Scope(dAtA []byte, offset int, v uint64) int {
+func encodeVarintNetworkScope(dAtA []byte, offset int, v uint64) int {
 	for v >= 1<<7 {
 		dAtA[offset] = uint8(v&0x7f | 0x80)
 		v >>= 7
@@ -330,47 +363,47 @@ func (m *NetworkScope) Size() (n int) {
 	if len(m.Dependencies) > 0 {
 		for _, e := range m.Dependencies {
 			l = e.Size()
-			n += 1 + l + sovNetwork_Scope(uint64(l))
+			n += 1 + l + sovNetworkScope(uint64(l))
 		}
 	}
 	return n
 }
 
-func (m *Dependency) Size() (n int) {
+func (m *NetworkScope_Import) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.Namespace)
+	if l > 0 {
+		n += 1 + l + sovNetworkScope(uint64(l))
+	}
+	l = len(m.Host)
+	if l > 0 {
+		n += 1 + l + sovNetworkScope(uint64(l))
+	}
+	return n
+}
+
+func (m *NetworkScope_Dependency) Size() (n int) {
 	var l int
 	_ = l
 	if len(m.SourceWorkloadLabels) > 0 {
 		for k, v := range m.SourceWorkloadLabels {
 			_ = k
 			_ = v
-			mapEntrySize := 1 + len(k) + sovNetwork_Scope(uint64(len(k))) + 1 + len(v) + sovNetwork_Scope(uint64(len(v)))
-			n += mapEntrySize + 1 + sovNetwork_Scope(uint64(mapEntrySize))
+			mapEntrySize := 1 + len(k) + sovNetworkScope(uint64(len(k))) + 1 + len(v) + sovNetworkScope(uint64(len(v)))
+			n += mapEntrySize + 1 + sovNetworkScope(uint64(mapEntrySize))
 		}
 	}
 	if len(m.Imports) > 0 {
 		for _, e := range m.Imports {
 			l = e.Size()
-			n += 1 + l + sovNetwork_Scope(uint64(l))
+			n += 1 + l + sovNetworkScope(uint64(l))
 		}
 	}
 	return n
 }
 
-func (m *Import) Size() (n int) {
-	var l int
-	_ = l
-	l = len(m.Namespace)
-	if l > 0 {
-		n += 1 + l + sovNetwork_Scope(uint64(l))
-	}
-	l = len(m.Host)
-	if l > 0 {
-		n += 1 + l + sovNetwork_Scope(uint64(l))
-	}
-	return n
-}
-
-func sovNetwork_Scope(x uint64) (n int) {
+func sovNetworkScope(x uint64) (n int) {
 	for {
 		n++
 		x >>= 7
@@ -380,8 +413,8 @@ func sovNetwork_Scope(x uint64) (n int) {
 	}
 	return n
 }
-func sozNetwork_Scope(x uint64) (n int) {
-	return sovNetwork_Scope(uint64((x << 1) ^ uint64((int64(x) >> 63))))
+func sozNetworkScope(x uint64) (n int) {
+	return sovNetworkScope(uint64((x << 1) ^ uint64((int64(x) >> 63))))
 }
 func (m *NetworkScope) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
@@ -391,7 +424,7 @@ func (m *NetworkScope) Unmarshal(dAtA []byte) error {
 		var wire uint64
 		for shift := uint(0); ; shift += 7 {
 			if shift >= 64 {
-				return ErrIntOverflowNetwork_Scope
+				return ErrIntOverflowNetworkScope
 			}
 			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
@@ -419,7 +452,7 @@ func (m *NetworkScope) Unmarshal(dAtA []byte) error {
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
-					return ErrIntOverflowNetwork_Scope
+					return ErrIntOverflowNetworkScope
 				}
 				if iNdEx >= l {
 					return io.ErrUnexpectedEOF
@@ -432,25 +465,133 @@ func (m *NetworkScope) Unmarshal(dAtA []byte) error {
 				}
 			}
 			if msglen < 0 {
-				return ErrInvalidLengthNetwork_Scope
+				return ErrInvalidLengthNetworkScope
 			}
 			postIndex := iNdEx + msglen
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Dependencies = append(m.Dependencies, &Dependency{})
+			m.Dependencies = append(m.Dependencies, &NetworkScope_Dependency{})
 			if err := m.Dependencies[len(m.Dependencies)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
-			skippy, err := skipNetwork_Scope(dAtA[iNdEx:])
+			skippy, err := skipNetworkScope(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthNetworkScope
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *NetworkScope_Import) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowNetworkScope
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Import: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Import: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNetworkScope
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthNetworkScope
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Namespace = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Host", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNetworkScope
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthNetworkScope
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Host = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipNetworkScope(dAtA[iNdEx:])
 			if err != nil {
 				return err
 			}
 			if skippy < 0 {
-				return ErrInvalidLengthNetwork_Scope
+				return ErrInvalidLengthNetworkScope
 			}
 			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
@@ -464,7 +605,7 @@ func (m *NetworkScope) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *Dependency) Unmarshal(dAtA []byte) error {
+func (m *NetworkScope_Dependency) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -472,7 +613,7 @@ func (m *Dependency) Unmarshal(dAtA []byte) error {
 		var wire uint64
 		for shift := uint(0); ; shift += 7 {
 			if shift >= 64 {
-				return ErrIntOverflowNetwork_Scope
+				return ErrIntOverflowNetworkScope
 			}
 			if iNdEx >= l {
 				return io.ErrUnexpectedEOF
@@ -500,7 +641,7 @@ func (m *Dependency) Unmarshal(dAtA []byte) error {
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
-					return ErrIntOverflowNetwork_Scope
+					return ErrIntOverflowNetworkScope
 				}
 				if iNdEx >= l {
 					return io.ErrUnexpectedEOF
@@ -513,7 +654,7 @@ func (m *Dependency) Unmarshal(dAtA []byte) error {
 				}
 			}
 			if msglen < 0 {
-				return ErrInvalidLengthNetwork_Scope
+				return ErrInvalidLengthNetworkScope
 			}
 			postIndex := iNdEx + msglen
 			if postIndex > l {
@@ -529,7 +670,7 @@ func (m *Dependency) Unmarshal(dAtA []byte) error {
 				var wire uint64
 				for shift := uint(0); ; shift += 7 {
 					if shift >= 64 {
-						return ErrIntOverflowNetwork_Scope
+						return ErrIntOverflowNetworkScope
 					}
 					if iNdEx >= l {
 						return io.ErrUnexpectedEOF
@@ -546,7 +687,7 @@ func (m *Dependency) Unmarshal(dAtA []byte) error {
 					var stringLenmapkey uint64
 					for shift := uint(0); ; shift += 7 {
 						if shift >= 64 {
-							return ErrIntOverflowNetwork_Scope
+							return ErrIntOverflowNetworkScope
 						}
 						if iNdEx >= l {
 							return io.ErrUnexpectedEOF
@@ -560,7 +701,7 @@ func (m *Dependency) Unmarshal(dAtA []byte) error {
 					}
 					intStringLenmapkey := int(stringLenmapkey)
 					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthNetwork_Scope
+						return ErrInvalidLengthNetworkScope
 					}
 					postStringIndexmapkey := iNdEx + intStringLenmapkey
 					if postStringIndexmapkey > l {
@@ -572,7 +713,7 @@ func (m *Dependency) Unmarshal(dAtA []byte) error {
 					var stringLenmapvalue uint64
 					for shift := uint(0); ; shift += 7 {
 						if shift >= 64 {
-							return ErrIntOverflowNetwork_Scope
+							return ErrIntOverflowNetworkScope
 						}
 						if iNdEx >= l {
 							return io.ErrUnexpectedEOF
@@ -586,7 +727,7 @@ func (m *Dependency) Unmarshal(dAtA []byte) error {
 					}
 					intStringLenmapvalue := int(stringLenmapvalue)
 					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthNetwork_Scope
+						return ErrInvalidLengthNetworkScope
 					}
 					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
 					if postStringIndexmapvalue > l {
@@ -596,12 +737,12 @@ func (m *Dependency) Unmarshal(dAtA []byte) error {
 					iNdEx = postStringIndexmapvalue
 				} else {
 					iNdEx = entryPreIndex
-					skippy, err := skipNetwork_Scope(dAtA[iNdEx:])
+					skippy, err := skipNetworkScope(dAtA[iNdEx:])
 					if err != nil {
 						return err
 					}
 					if skippy < 0 {
-						return ErrInvalidLengthNetwork_Scope
+						return ErrInvalidLengthNetworkScope
 					}
 					if (iNdEx + skippy) > postIndex {
 						return io.ErrUnexpectedEOF
@@ -618,7 +759,7 @@ func (m *Dependency) Unmarshal(dAtA []byte) error {
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
-					return ErrIntOverflowNetwork_Scope
+					return ErrIntOverflowNetworkScope
 				}
 				if iNdEx >= l {
 					return io.ErrUnexpectedEOF
@@ -631,133 +772,25 @@ func (m *Dependency) Unmarshal(dAtA []byte) error {
 				}
 			}
 			if msglen < 0 {
-				return ErrInvalidLengthNetwork_Scope
+				return ErrInvalidLengthNetworkScope
 			}
 			postIndex := iNdEx + msglen
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.Imports = append(m.Imports, &Import{})
+			m.Imports = append(m.Imports, &NetworkScope_Import{})
 			if err := m.Imports[len(m.Imports)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
-			skippy, err := skipNetwork_Scope(dAtA[iNdEx:])
-			if err != nil {
-				return err
-			}
-			if skippy < 0 {
-				return ErrInvalidLengthNetwork_Scope
-			}
-			if (iNdEx + skippy) > l {
-				return io.ErrUnexpectedEOF
-			}
-			iNdEx += skippy
-		}
-	}
-
-	if iNdEx > l {
-		return io.ErrUnexpectedEOF
-	}
-	return nil
-}
-func (m *Import) Unmarshal(dAtA []byte) error {
-	l := len(dAtA)
-	iNdEx := 0
-	for iNdEx < l {
-		preIndex := iNdEx
-		var wire uint64
-		for shift := uint(0); ; shift += 7 {
-			if shift >= 64 {
-				return ErrIntOverflowNetwork_Scope
-			}
-			if iNdEx >= l {
-				return io.ErrUnexpectedEOF
-			}
-			b := dAtA[iNdEx]
-			iNdEx++
-			wire |= (uint64(b) & 0x7F) << shift
-			if b < 0x80 {
-				break
-			}
-		}
-		fieldNum := int32(wire >> 3)
-		wireType := int(wire & 0x7)
-		if wireType == 4 {
-			return fmt.Errorf("proto: Import: wiretype end group for non-group")
-		}
-		if fieldNum <= 0 {
-			return fmt.Errorf("proto: Import: illegal tag %d (wire type %d)", fieldNum, wire)
-		}
-		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowNetwork_Scope
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= (uint64(b) & 0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthNetwork_Scope
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Namespace = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Host", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowNetwork_Scope
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= (uint64(b) & 0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthNetwork_Scope
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.Host = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		default:
-			iNdEx = preIndex
-			skippy, err := skipNetwork_Scope(dAtA[iNdEx:])
+			skippy, err := skipNetworkScope(dAtA[iNdEx:])
 			if err != nil {
 				return err
 			}
 			if skippy < 0 {
-				return ErrInvalidLengthNetwork_Scope
+				return ErrInvalidLengthNetworkScope
 			}
 			if (iNdEx + skippy) > l {
 				return io.ErrUnexpectedEOF
@@ -771,14 +804,14 @@ func (m *Import) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func skipNetwork_Scope(dAtA []byte) (n int, err error) {
+func skipNetworkScope(dAtA []byte) (n int, err error) {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
 		var wire uint64
 		for shift := uint(0); ; shift += 7 {
 			if shift >= 64 {
-				return 0, ErrIntOverflowNetwork_Scope
+				return 0, ErrIntOverflowNetworkScope
 			}
 			if iNdEx >= l {
 				return 0, io.ErrUnexpectedEOF
@@ -795,7 +828,7 @@ func skipNetwork_Scope(dAtA []byte) (n int, err error) {
 		case 0:
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
-					return 0, ErrIntOverflowNetwork_Scope
+					return 0, ErrIntOverflowNetworkScope
 				}
 				if iNdEx >= l {
 					return 0, io.ErrUnexpectedEOF
@@ -813,7 +846,7 @@ func skipNetwork_Scope(dAtA []byte) (n int, err error) {
 			var length int
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
-					return 0, ErrIntOverflowNetwork_Scope
+					return 0, ErrIntOverflowNetworkScope
 				}
 				if iNdEx >= l {
 					return 0, io.ErrUnexpectedEOF
@@ -827,7 +860,7 @@ func skipNetwork_Scope(dAtA []byte) (n int, err error) {
 			}
 			iNdEx += length
 			if length < 0 {
-				return 0, ErrInvalidLengthNetwork_Scope
+				return 0, ErrInvalidLengthNetworkScope
 			}
 			return iNdEx, nil
 		case 3:
@@ -836,7 +869,7 @@ func skipNetwork_Scope(dAtA []byte) (n int, err error) {
 				var start int = iNdEx
 				for shift := uint(0); ; shift += 7 {
 					if shift >= 64 {
-						return 0, ErrIntOverflowNetwork_Scope
+						return 0, ErrIntOverflowNetworkScope
 					}
 					if iNdEx >= l {
 						return 0, io.ErrUnexpectedEOF
@@ -852,7 +885,7 @@ func skipNetwork_Scope(dAtA []byte) (n int, err error) {
 				if innerWireType == 4 {
 					break
 				}
-				next, err := skipNetwork_Scope(dAtA[start:])
+				next, err := skipNetworkScope(dAtA[start:])
 				if err != nil {
 					return 0, err
 				}
@@ -872,34 +905,34 @@ func skipNetwork_Scope(dAtA []byte) (n int, err error) {
 }
 
 var (
-	ErrInvalidLengthNetwork_Scope = fmt.Errorf("proto: negative length found during unmarshaling")
-	ErrIntOverflowNetwork_Scope   = fmt.Errorf("proto: integer overflow")
+	ErrInvalidLengthNetworkScope = fmt.Errorf("proto: negative length found during unmarshaling")
+	ErrIntOverflowNetworkScope   = fmt.Errorf("proto: integer overflow")
 )
 
-func init() {
-	proto.RegisterFile("networking/v1alpha3/network_Scope.proto", fileDescriptorNetwork_Scope)
-}
+func init() { proto.RegisterFile("networking/v1alpha3/network_scope.proto", fileDescriptorNetworkScope) }
 
-var fileDescriptorNetwork_Scope = []byte{
-	// 308 bytes of a gzipped FileDescriptorProto
+var fileDescriptorNetworkScope = []byte{
+	// 352 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x52, 0xcf, 0x4b, 0x2d, 0x29,
 	0xcf, 0x2f, 0xca, 0xce, 0xcc, 0x4b, 0xd7, 0x2f, 0x33, 0x4c, 0xcc, 0x29, 0xc8, 0x48, 0x34, 0xd6,
-	0x87, 0x8a, 0xc5, 0x07, 0x27, 0xe7, 0x17, 0xa4, 0xea, 0x15, 0x14, 0xe5, 0x97, 0xe4, 0x0b, 0x49,
-	0x66, 0x16, 0x97, 0x64, 0xe6, 0xeb, 0x21, 0x94, 0xeb, 0xc1, 0x94, 0x2b, 0x45, 0x72, 0xf1, 0xf8,
-	0x41, 0x84, 0xc1, 0x1a, 0x84, 0x3c, 0xb9, 0x78, 0x52, 0x52, 0x0b, 0x52, 0xf3, 0x52, 0x52, 0xf3,
-	0x92, 0x33, 0x53, 0x8b, 0x25, 0x18, 0x15, 0x98, 0x35, 0xb8, 0x8d, 0x54, 0xf5, 0x70, 0x9a, 0xa0,
-	0xe7, 0x02, 0x53, 0x5e, 0x19, 0x84, 0xa2, 0x55, 0xa9, 0x93, 0x89, 0x8b, 0x0b, 0x21, 0x29, 0x54,
-	0xca, 0x25, 0x56, 0x9c, 0x5f, 0x5a, 0x94, 0x9c, 0x1a, 0x0f, 0x32, 0x22, 0x27, 0x3f, 0x31, 0x25,
-	0x3e, 0x27, 0x31, 0x29, 0x35, 0x07, 0x66, 0x87, 0x3d, 0x51, 0x76, 0xe8, 0x05, 0x83, 0xcd, 0x08,
-	0x87, 0x1a, 0xe1, 0x03, 0x36, 0xc1, 0x35, 0xaf, 0xa4, 0xa8, 0x32, 0x48, 0xa4, 0x18, 0x8b, 0x94,
-	0x90, 0x35, 0x17, 0x7b, 0x66, 0x6e, 0x41, 0x7e, 0x51, 0x49, 0xb1, 0x04, 0x13, 0xd8, 0x1e, 0x45,
-	0x3c, 0xf6, 0x78, 0x82, 0x55, 0x06, 0xc1, 0x74, 0x48, 0xb9, 0x73, 0x49, 0xe2, 0xb4, 0x4f, 0x48,
-	0x80, 0x8b, 0x39, 0x3b, 0xb5, 0x52, 0x82, 0x51, 0x81, 0x51, 0x83, 0x33, 0x08, 0xc4, 0x14, 0x12,
-	0xe1, 0x62, 0x2d, 0x4b, 0xcc, 0x29, 0x4d, 0x95, 0x60, 0x02, 0x8b, 0x41, 0x38, 0x56, 0x4c, 0x16,
-	0x8c, 0x4a, 0x56, 0x5c, 0x6c, 0x10, 0xb3, 0x85, 0x64, 0xb8, 0x38, 0xf3, 0x12, 0x73, 0x53, 0x8b,
-	0x0b, 0x12, 0x93, 0x53, 0xa1, 0x7a, 0x11, 0x02, 0x42, 0x42, 0x5c, 0x2c, 0x19, 0xf9, 0xc5, 0x25,
-	0x50, 0x03, 0xc0, 0x6c, 0x27, 0xbd, 0x13, 0x8f, 0xe4, 0x18, 0x2f, 0x3c, 0x92, 0x63, 0x7c, 0xf0,
-	0x48, 0x8e, 0x31, 0x4a, 0x01, 0xe2, 0xfa, 0xcc, 0x7c, 0xfd, 0xc4, 0x82, 0x4c, 0x7d, 0x2c, 0x29,
-	0x20, 0x89, 0x0d, 0x1c, 0xe9, 0xc6, 0x80, 0x00, 0x00, 0x00, 0xff, 0xff, 0xe6, 0x7a, 0x07, 0xad,
-	0x1f, 0x02, 0x00, 0x00,
+	0x87, 0x8a, 0xc5, 0x17, 0x27, 0xe7, 0x17, 0xa4, 0xea, 0x15, 0x14, 0xe5, 0x97, 0xe4, 0x0b, 0x49,
+	0x66, 0x16, 0x97, 0x64, 0xe6, 0xeb, 0x21, 0x94, 0xeb, 0xc1, 0x94, 0x2b, 0x9d, 0x64, 0xe6, 0xe2,
+	0xf1, 0x83, 0x88, 0x07, 0x83, 0x74, 0x08, 0x85, 0x71, 0xf1, 0xa4, 0xa4, 0x16, 0xa4, 0xe6, 0xa5,
+	0xa4, 0xe6, 0x25, 0x67, 0xa6, 0x16, 0x4b, 0x30, 0x2a, 0x30, 0x6b, 0x70, 0x1b, 0x19, 0xe9, 0xe1,
+	0x34, 0x42, 0x0f, 0x59, 0xbb, 0x9e, 0x0b, 0x4c, 0x6f, 0x65, 0x10, 0x8a, 0x39, 0x52, 0x56, 0x5c,
+	0x6c, 0x9e, 0xb9, 0x05, 0xf9, 0x45, 0x25, 0x42, 0x32, 0x5c, 0x9c, 0x79, 0x89, 0xb9, 0xa9, 0xc5,
+	0x05, 0x89, 0xc9, 0xa9, 0x12, 0x8c, 0x0a, 0x8c, 0x1a, 0x9c, 0x41, 0x08, 0x01, 0x21, 0x21, 0x2e,
+	0x96, 0x8c, 0xfc, 0xe2, 0x12, 0x09, 0x26, 0xb0, 0x04, 0x98, 0x2d, 0xb5, 0x84, 0x89, 0x8b, 0x0b,
+	0x61, 0xb0, 0x50, 0x13, 0x23, 0x97, 0x58, 0x71, 0x7e, 0x69, 0x51, 0x72, 0x6a, 0x3c, 0xc8, 0xe2,
+	0x9c, 0xfc, 0xc4, 0x94, 0xf8, 0x9c, 0xc4, 0xa4, 0xd4, 0x1c, 0x98, 0x6b, 0x7d, 0x48, 0x77, 0xad,
+	0x5e, 0x30, 0xd8, 0xc0, 0x70, 0xa8, 0x79, 0x3e, 0x60, 0xe3, 0x5c, 0xf3, 0x4a, 0x8a, 0x2a, 0x83,
+	0x44, 0x8a, 0xb1, 0x48, 0x09, 0x79, 0x70, 0xb1, 0x67, 0x82, 0xfd, 0x53, 0x2c, 0xc1, 0x04, 0xb6,
+	0x54, 0x8f, 0x58, 0x4b, 0x21, 0xc1, 0x10, 0x04, 0xd3, 0x2e, 0xe5, 0xce, 0x25, 0x89, 0xd3, 0x72,
+	0x21, 0x01, 0x2e, 0xe6, 0xec, 0xd4, 0x4a, 0x68, 0x30, 0x81, 0x98, 0x42, 0x22, 0x5c, 0xac, 0x65,
+	0x89, 0x39, 0xa5, 0xa9, 0xd0, 0x10, 0x82, 0x70, 0xac, 0x98, 0x2c, 0x18, 0xb5, 0xd4, 0xb8, 0xb8,
+	0x9d, 0xf3, 0xf3, 0xd2, 0x32, 0xd3, 0x21, 0x31, 0xc9, 0xc5, 0xc5, 0x16, 0x10, 0xea, 0xe4, 0xe3,
+	0xe9, 0x2c, 0xc0, 0x20, 0xc4, 0xcd, 0xc5, 0x1e, 0x10, 0xe4, 0x19, 0xe6, 0x18, 0xe2, 0x2a, 0xc0,
+	0xe8, 0xa4, 0x77, 0xe2, 0x91, 0x1c, 0xe3, 0x85, 0x47, 0x72, 0x8c, 0x0f, 0x1e, 0xc9, 0x31, 0x46,
+	0x29, 0x40, 0x9c, 0x9d, 0x99, 0xaf, 0x9f, 0x58, 0x90, 0xa9, 0x8f, 0x25, 0x49, 0x25, 0xb1, 0x81,
+	0x53, 0x91, 0x31, 0x20, 0x00, 0x00, 0xff, 0xff, 0x64, 0xd5, 0x9b, 0x1f, 0x70, 0x02, 0x00, 0x00,
 }
diff --git a/networking/v1alpha3/network_scope.proto b/networking/v1alpha3/network_scope.proto
index ec7a27e64f..c3928c8c58 100644
--- a/networking/v1alpha3/network_scope.proto
+++ b/networking/v1alpha3/network_scope.proto
@@ -102,6 +102,59 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // (CURRENT_NAMESPACE).
 //
 message NetworkScope {
+
+  // Import describes the set of namespaces whose exported services
+  // (real/virtual) will be accessed by workloads in a given namespace. The
+  // sidecars attached to the workloads will be configured with information
+  // required to reach the imported services only. The gateways in the
+  // current namespace will only honor imported VirtualServices instead of
+  // every VirtualService that binds itself to the gateway.
+  //
+  // Importing a service from a namespace will automatically import the
+  // exported configuration artifacts associated with the service, such as
+  // VirtualService, DestinationRule, etc. The service in a namespace can be
+  // a service in the service registry (e.g., a kubernetes or cloud foundry
+  // service) or a service specified via ServiceEntry configuration.
+  //
+  // NOTE: Only exported services and configuration artifacts from a
+  // namespace can be imported. Private services/configuration will not be
+  // imported. See the scope setting associated with VirtualService,
+  // DestinationRule, ServiceEntry, etc.
+  message Import {
+    // The configuration namespace whose services need to be imported.
+    // Specify * to import all namespaces. The import can be scoped further
+    // by specifying individual hosts.
+    string namespace = 1;
+
+    // A FQDN or wildcard prefixed DNS name of the host to import from the
+    // specified namespace. The hostnames include names of services from the
+    // service registry as well as those specified in a VirtualService.
+    string host = 2;
+  };
+
+  // Dependency describes a workload and the set of service dependencies
+  // for the workload.
+  message Dependency {
+    // One or more labels that indicate a specific set of pods/VMs on which
+    // this dependency configuration should be applied.  The scope of label
+    // search is platform dependent.  On Kubernetes, for example, the scope
+    // includes pods running in the namespace in which the NetworkScope
+    // resource is present.  If the sourceWorkloadLabels are omitted, the
+    // imports specified will be applicable to all workloads in the current
+    // configuration namespace.
+    map<string, string> source_workload_labels = 1;
+
+    // REQUIRED: Import describes the set of namespaces whose exported
+    // services will be accessed by the workloads selected by the
+    // sourceWorkloadLabels. The sidecars attached to the workloads will be
+    // configured with information required to reach other services in the
+    // same namespace and the imported services. In addition to the
+    // explicitly specified namespaces, namespaces specified in the global
+    // mesh config (through NetworkScope.sharedNamespaces) will also be
+    // imported.
+    repeated Import imports = 2;
+  };
+
   // REQUIRED. The set of services that workloads in this namespace are
   // expected to talk to, in addition to other workloads in the same
   // namespace. Dependencies describe the properties of egress traffic from
@@ -109,52 +162,12 @@ message NetworkScope {
   repeated Dependency dependencies = 1;
 }
 
-message Dependency {
-  // One or more labels that indicate a specific set of pods/VMs on which
-  // this dependency configuration should be applied.  The scope of label
-  // search is platform dependent.  On Kubernetes, for example, the scope
-  // includes pods running in the namespace in which the NetworkScope
-  // resource is present.  If the sourceWorkloadLabels are omitted, the
-  // imports specified will be applicable to all workloads in the current
-  // configuration namespace.
-  map<string, string> source_workload_labels = 1;
-
-  // REQUIRED: Import describes the set of namespaces whose exported
-  // services will be accessed by the workloads selected by the
-  // sourceWorkloadLabels. The sidecars attached to the workloads will be
-  // configured with information required to reach other services in the
-  // same namespace and the imported services. In addition to the
-  // explicitly specified namespaces, namespaces specified in the global
-  // mesh config (through NetworkScope.sharedNamespaces) will also be
-  // imported.
-  repeated Import imports = 2;
-}
-
-// Import describes the set of namespaces whose exported services
-// (real/virtual) will be accessed by workloads in a given namespace. The
-// sidecars attached to the workloads will be configured with information
-// required to reach the imported services only. The gateways in the
-// current namespace will only honor imported VirtualServices instead of
-// every VirtualService that binds itself to the gateway.
-//
-// Importing a service from a namespace will automatically import the
-// exported configuration artifacts associated with the service, such as
-// VirtualService, DestinationRule, etc. The service in a namespace can be
-// a service in the service registry (e.g., a kubernetes or cloud foundry
-// service) or a service specified via ServiceEntry configuration.
-//
-// NOTE: Only exported services and configuration artifacts from a
-// namespace can be imported. Private services/configuration will not be
-// imported. See the scope setting associated with VirtualService,
-// DestinationRule, ServiceEntry, etc.
-message Import {
-  // The configuration namespace whose services need to be imported.
-  // Specify * to import all namespaces. The import can be scoped further
-  // by specifying individual hosts.
-  string namespace = 1;
-
-  // A FQDN or wildcard prefixed DNS name of the host to import from the
-  // specified namespace. The hostnames include names of services from the
-  // service registry as well as those specified in a VirtualService.
-  string host = 2;
+// ConfigScope defines the visibility of an Istio configuration artifact in
+// a namespace when the namespace is imported.  By default all
+// configuration artifacts are public. Configurations with private scope
+// will not be imported when the namespace containing the configuration is
+// imported in a NetworkScope.
+enum ConfigScope {
+  PUBLIC = 0;
+  PRIVATE = 1;
 }
diff --git a/networking/v1alpha3/service_entry.pb.go b/networking/v1alpha3/service_entry.pb.go
index faa5471fde..f95afa6684 100644
--- a/networking/v1alpha3/service_entry.pb.go
+++ b/networking/v1alpha3/service_entry.pb.go
@@ -400,6 +400,12 @@ type ServiceEntry struct {
 	Resolution ServiceEntry_Resolution `protobuf:"varint,5,opt,name=resolution,proto3,enum=istio.networking.v1alpha3.ServiceEntry_Resolution" json:"resolution,omitempty"`
 	// One or more endpoints associated with the service.
 	Endpoints []*ServiceEntry_Endpoint `protobuf:"bytes,6,rep,name=endpoints" json:"endpoints,omitempty"`
+	// The visibility setting associated with this service entry. Set to
+	// PRIVATE if this service should not be visible outside the namespace
+	// where the service entry was added. The default scope is public,
+	// i.e. the service added by the service entry will be visible to
+	// workloads in the entire mesh.
+	Scope ConfigScope `protobuf:"varint,7,opt,name=scope,proto3,enum=istio.networking.v1alpha3.ConfigScope" json:"scope,omitempty"`
 }
 
 func (m *ServiceEntry) Reset()                    { *m = ServiceEntry{} }
@@ -449,6 +455,13 @@ func (m *ServiceEntry) GetEndpoints() []*ServiceEntry_Endpoint {
 	return nil
 }
 
+func (m *ServiceEntry) GetScope() ConfigScope {
+	if m != nil {
+		return m.Scope
+	}
+	return ConfigScope_PUBLIC
+}
+
 // Endpoint defines a network address (IP or hostname) associated with
 // the mesh service.
 type ServiceEntry_Endpoint struct {
@@ -629,6 +642,11 @@ func (m *ServiceEntry) MarshalTo(dAtA []byte) (int, error) {
 			i += n
 		}
 	}
+	if m.Scope != 0 {
+		dAtA[i] = 0x38
+		i++
+		i = encodeVarintServiceEntry(dAtA, i, uint64(m.Scope))
+	}
 	return i, nil
 }
 
@@ -748,6 +766,9 @@ func (m *ServiceEntry) Size() (n int) {
 			n += 1 + l + sovServiceEntry(uint64(l))
 		}
 	}
+	if m.Scope != 0 {
+		n += 1 + sovServiceEntry(uint64(m.Scope))
+	}
 	return n
 }
 
@@ -988,6 +1009,25 @@ func (m *ServiceEntry) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Scope", wireType)
+			}
+			m.Scope = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowServiceEntry
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Scope |= (ConfigScope(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipServiceEntry(dAtA[iNdEx:])
@@ -1498,36 +1538,38 @@ var (
 func init() { proto.RegisterFile("networking/v1alpha3/service_entry.proto", fileDescriptorServiceEntry) }
 
 var fileDescriptorServiceEntry = []byte{
-	// 481 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x93, 0xdf, 0x6e, 0xd3, 0x30,
-	0x14, 0xc6, 0xe7, 0x66, 0xcd, 0x9a, 0x33, 0x86, 0x82, 0x85, 0x90, 0x89, 0x50, 0x09, 0xbd, 0x21,
-	0x12, 0x52, 0x3a, 0x3a, 0x21, 0x8d, 0x3f, 0x37, 0x03, 0x22, 0x31, 0xa9, 0x04, 0x70, 0x7b, 0x81,
-	0xb8, 0x99, 0xbc, 0xd5, 0x6a, 0xad, 0x45, 0x71, 0x14, 0x7b, 0xad, 0xfa, 0x16, 0x3c, 0x16, 0x97,
-	0xbc, 0x00, 0x12, 0xea, 0x93, 0xa0, 0x3a, 0x4e, 0xd3, 0x8b, 0x01, 0xdb, 0x5d, 0xbe, 0x13, 0x7f,
-	0x3f, 0x1f, 0x7f, 0xc7, 0x86, 0xa7, 0x39, 0xd7, 0x0b, 0x59, 0x5e, 0x8a, 0x7c, 0xda, 0x9f, 0x3f,
-	0x67, 0x59, 0x31, 0x63, 0x47, 0x7d, 0xc5, 0xcb, 0xb9, 0xb8, 0xe0, 0x67, 0x3c, 0xd7, 0xe5, 0x32,
-	0x2e, 0x4a, 0xa9, 0x25, 0x7e, 0x28, 0x94, 0x16, 0x32, 0x6e, 0x96, 0xc7, 0xf5, 0xf2, 0xe0, 0xc9,
-	0x75, 0x8c, 0x29, 0xd3, 0x7c, 0xc1, 0xac, 0xbb, 0xf7, 0xcb, 0x85, 0x3b, 0xa3, 0x8a, 0x9a, 0xac,
-	0xa1, 0xf8, 0x3e, 0xb4, 0x67, 0x52, 0x69, 0x45, 0x50, 0xe8, 0x44, 0x1e, 0xad, 0x04, 0x7e, 0x04,
-	0x1e, 0x9b, 0x4c, 0x4a, 0xae, 0x14, 0x57, 0xa4, 0x65, 0xfe, 0x34, 0x05, 0xfc, 0x02, 0xda, 0x85,
-	0x2c, 0xb5, 0x22, 0x4e, 0xe8, 0x44, 0xfb, 0x83, 0xc7, 0xf1, 0x5f, 0x5b, 0x8a, 0x3f, 0xcb, 0x52,
-	0xd3, 0x6a, 0x35, 0x1e, 0x42, 0x27, 0x93, 0x17, 0x4c, 0x0b, 0x99, 0x93, 0xdd, 0x10, 0x45, 0x77,
-	0x07, 0x87, 0xff, 0x70, 0x6e, 0x77, 0x19, 0x0f, 0xad, 0x8f, 0x6e, 0x08, 0x98, 0x02, 0x94, 0x5c,
-	0xc9, 0xec, 0xca, 0xf0, 0xda, 0x86, 0x37, 0xb8, 0x29, 0x8f, 0x6e, 0x9c, 0x74, 0x8b, 0x82, 0x53,
-	0xf0, 0x78, 0x3e, 0x29, 0xa4, 0xc8, 0xb5, 0x22, 0xae, 0x39, 0xdc, 0x8d, 0x5b, 0x4c, 0xac, 0x91,
-	0x36, 0x88, 0xe0, 0xbb, 0x03, 0x9d, 0xba, 0x8e, 0x09, 0xec, 0xd9, 0x08, 0x09, 0x0a, 0x51, 0xe4,
-	0xd1, 0x5a, 0xe2, 0x2f, 0x75, 0x9e, 0x2d, 0xb3, 0xe5, 0xeb, 0xdb, 0x6e, 0x69, 0x52, 0x56, 0xa6,
-	0x56, 0x67, 0x3d, 0x06, 0x37, 0x63, 0xe7, 0x3c, 0xab, 0x67, 0xf4, 0xe6, 0xd6, 0xcc, 0xa1, 0xb1,
-	0x57, 0x50, 0xcb, 0x5a, 0x1f, 0xc1, 0x02, 0xcc, 0x00, 0x3d, 0x5a, 0x4b, 0x1c, 0x54, 0xb3, 0xcd,
-	0x84, 0x5e, 0x9a, 0x59, 0x78, 0x74, 0xa3, 0xf1, 0x03, 0x70, 0x17, 0x5c, 0x4c, 0x67, 0x9a, 0xb8,
-	0x21, 0x8a, 0x0e, 0xa8, 0x55, 0xc1, 0x31, 0x40, 0xd3, 0x38, 0xf6, 0xc1, 0xb9, 0xe4, 0x4b, 0x1b,
-	0xcd, 0xfa, 0x73, 0x7d, 0x35, 0xe7, 0x2c, 0xbb, 0xe2, 0xa4, 0x65, 0x6c, 0x95, 0x78, 0xd5, 0x3a,
-	0x46, 0xc1, 0x4b, 0xd8, 0xdf, 0x6a, 0xef, 0x7f, 0x56, 0x6f, 0xcb, 0xda, 0x3b, 0x84, 0x4e, 0x7d,
-	0x99, 0xf0, 0x3d, 0x38, 0xf8, 0x98, 0x8c, 0x3e, 0x9c, 0x25, 0x5f, 0xc7, 0x09, 0x4d, 0x4f, 0x86,
-	0xfe, 0xce, 0xa6, 0x74, 0x9a, 0xda, 0x12, 0xea, 0x3d, 0x03, 0x68, 0xae, 0x0b, 0xee, 0xc0, 0x6e,
-	0xfa, 0x29, 0x4d, 0xfc, 0x1d, 0x0c, 0xe0, 0x8e, 0xc6, 0x27, 0xe3, 0xd3, 0x77, 0x3e, 0xc2, 0x7b,
-	0xe0, 0xbc, 0x4f, 0x47, 0x7e, 0xeb, 0x6d, 0xfc, 0x63, 0xd5, 0x45, 0x3f, 0x57, 0x5d, 0xf4, 0x7b,
-	0xd5, 0x45, 0xdf, 0xc2, 0x2a, 0x74, 0x21, 0xfb, 0xac, 0x10, 0xfd, 0x6b, 0x5e, 0xe7, 0xb9, 0x6b,
-	0x9e, 0xe5, 0xd1, 0x9f, 0x00, 0x00, 0x00, 0xff, 0xff, 0xe5, 0xb0, 0x1f, 0xc6, 0xff, 0x03, 0x00,
-	0x00,
+	// 516 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x93, 0xd1, 0x6e, 0xd3, 0x3e,
+	0x14, 0xc6, 0xe7, 0x66, 0x4d, 0x9b, 0xb3, 0xff, 0xfe, 0x2a, 0x16, 0x42, 0x26, 0x42, 0x25, 0xf4,
+	0x02, 0x2a, 0x21, 0xa5, 0xa3, 0x13, 0xd2, 0x80, 0xdd, 0x8c, 0x11, 0x89, 0x49, 0x25, 0x80, 0xdb,
+	0x0b, 0xc4, 0x4d, 0x95, 0xb5, 0xa6, 0xb5, 0x16, 0xc5, 0x51, 0xec, 0xb5, 0xea, 0x5b, 0x70, 0xcf,
+	0x0b, 0x71, 0xc9, 0x23, 0xa0, 0x3e, 0x09, 0x8a, 0xe3, 0x34, 0xbd, 0x28, 0x63, 0xbb, 0xeb, 0x39,
+	0x3d, 0xdf, 0xcf, 0x5f, 0xfc, 0x1d, 0xc3, 0xb3, 0x84, 0xa9, 0xa5, 0xc8, 0xae, 0x78, 0x32, 0xeb,
+	0x2d, 0x5e, 0x44, 0x71, 0x3a, 0x8f, 0x8e, 0x7b, 0x92, 0x65, 0x0b, 0x3e, 0x61, 0x63, 0x96, 0xa8,
+	0x6c, 0xe5, 0xa7, 0x99, 0x50, 0x02, 0x3f, 0xe4, 0x52, 0x71, 0xe1, 0x57, 0xe3, 0x7e, 0x39, 0xee,
+	0x3e, 0xd9, 0xc5, 0x98, 0x45, 0x8a, 0x2d, 0x23, 0xa3, 0x76, 0x77, 0x1e, 0x63, 0x7a, 0x63, 0x39,
+	0x11, 0x29, 0x2b, 0x06, 0x3b, 0x3f, 0x1a, 0xf0, 0xdf, 0xb0, 0x38, 0x3e, 0xc8, 0x4f, 0xc7, 0xf7,
+	0xa1, 0x3e, 0x17, 0x52, 0x49, 0x82, 0x3c, 0xab, 0xeb, 0xd0, 0xa2, 0xc0, 0x8f, 0xc0, 0x89, 0xa6,
+	0xd3, 0x8c, 0x49, 0xc9, 0x24, 0xa9, 0xe9, 0x7f, 0xaa, 0x06, 0x7e, 0x09, 0xf5, 0x54, 0x64, 0x4a,
+	0x12, 0xcb, 0xb3, 0xba, 0x07, 0xfd, 0xc7, 0xfe, 0x5f, 0xbd, 0xfb, 0x9f, 0x44, 0xa6, 0x68, 0x31,
+	0x8d, 0x07, 0xd0, 0x8c, 0xc5, 0x24, 0x52, 0x5c, 0x24, 0x64, 0xdf, 0x43, 0xdd, 0xff, 0xfb, 0x47,
+	0x37, 0x28, 0xb7, 0x5d, 0xfa, 0x03, 0xa3, 0xa3, 0x1b, 0x02, 0xa6, 0x00, 0x19, 0x93, 0x22, 0xbe,
+	0xd6, 0xbc, 0xba, 0xe6, 0xf5, 0x6f, 0xcb, 0xa3, 0x1b, 0x25, 0xdd, 0xa2, 0xe0, 0x10, 0x1c, 0x96,
+	0x4c, 0x53, 0xc1, 0x13, 0x25, 0x89, 0xad, 0x3f, 0xee, 0xd6, 0x16, 0x03, 0x23, 0xa4, 0x15, 0x02,
+	0x9f, 0x42, 0x5d, 0x5f, 0x3e, 0x69, 0x68, 0x7b, 0x4f, 0x6f, 0x60, 0x9d, 0x8b, 0xe4, 0x1b, 0x9f,
+	0x0d, 0xf3, 0x69, 0x5a, 0x88, 0xdc, 0xef, 0x16, 0x34, 0x4b, 0x2a, 0x26, 0xd0, 0x30, 0x01, 0x10,
+	0xe4, 0xa1, 0xae, 0x43, 0xcb, 0x12, 0x7f, 0x2e, 0xd3, 0xa8, 0x69, 0xc3, 0x6f, 0xee, 0x6a, 0x58,
+	0x67, 0x24, 0x75, 0xaf, 0x4c, 0x6a, 0x04, 0x76, 0x1c, 0x5d, 0xb2, 0xb8, 0x4c, 0xf8, 0xf4, 0xce,
+	0xcc, 0x81, 0x96, 0x17, 0x50, 0xc3, 0xca, 0x3f, 0xc1, 0x00, 0x74, 0xfc, 0x0e, 0x2d, 0x4b, 0xec,
+	0x16, 0x9b, 0x11, 0x73, 0xb5, 0xd2, 0x49, 0x3a, 0x74, 0x53, 0xe3, 0x07, 0x60, 0x2f, 0x19, 0x9f,
+	0xcd, 0x15, 0xb1, 0x3d, 0xd4, 0x3d, 0xa4, 0xa6, 0x72, 0x4f, 0x00, 0x2a, 0xe3, 0xb8, 0x05, 0xd6,
+	0x15, 0x5b, 0x99, 0xab, 0xc9, 0x7f, 0xe6, 0x8b, 0xbd, 0x88, 0xe2, 0x6b, 0x46, 0x6a, 0x5a, 0x56,
+	0x14, 0xaf, 0x6b, 0x27, 0xc8, 0x7d, 0x05, 0x07, 0x5b, 0xf6, 0xfe, 0x25, 0x75, 0xb6, 0xa4, 0x9d,
+	0x23, 0x68, 0x96, 0xab, 0x88, 0xef, 0xc1, 0xe1, 0x87, 0x60, 0xf8, 0x7e, 0x1c, 0x7c, 0x19, 0x05,
+	0x34, 0x3c, 0x1b, 0xb4, 0xf6, 0x36, 0xad, 0x8b, 0xd0, 0xb4, 0x50, 0xe7, 0x39, 0x40, 0xb5, 0x6c,
+	0xb8, 0x09, 0xfb, 0xe1, 0xc7, 0x30, 0x68, 0xed, 0x61, 0x00, 0x7b, 0x38, 0x3a, 0x1b, 0x5d, 0x9c,
+	0xb7, 0x10, 0x6e, 0x80, 0xf5, 0x2e, 0x1c, 0xb6, 0x6a, 0x6f, 0xfd, 0x9f, 0xeb, 0x36, 0xfa, 0xb5,
+	0x6e, 0xa3, 0xdf, 0xeb, 0x36, 0xfa, 0xea, 0x15, 0x97, 0xce, 0x45, 0x2f, 0x4a, 0x79, 0x6f, 0xc7,
+	0x0b, 0xbf, 0xb4, 0xf5, 0xa3, 0x3e, 0xfe, 0x13, 0x00, 0x00, 0xff, 0xff, 0xc7, 0x74, 0xc7, 0x64,
+	0x66, 0x04, 0x00, 0x00,
 }
diff --git a/networking/v1alpha3/service_entry.proto b/networking/v1alpha3/service_entry.proto
index 69bc993da0..1af4134422 100644
--- a/networking/v1alpha3/service_entry.proto
+++ b/networking/v1alpha3/service_entry.proto
@@ -15,6 +15,7 @@
 syntax = "proto3";
 
 import "networking/v1alpha3/gateway.proto";
+import "networking/v1alpha3/network_scope.proto";
 
 package istio.networking.v1alpha3;
 
@@ -427,4 +428,11 @@ message ServiceEntry {
 
   // One or more endpoints associated with the service.
   repeated Endpoint endpoints = 6;
+
+  // The visibility setting associated with this service entry. Set to
+  // PRIVATE if this service should not be visible outside the namespace
+  // where the service entry was added. The default scope is public,
+  // i.e. the service added by the service entry will be visible to
+  // workloads in the entire mesh.
+  ConfigScope scope = 7;
 }
diff --git a/networking/v1alpha3/virtual_service.pb.go b/networking/v1alpha3/virtual_service.pb.go
index 26eca07a01..3927cea164 100644
--- a/networking/v1alpha3/virtual_service.pb.go
+++ b/networking/v1alpha3/virtual_service.pb.go
@@ -134,6 +134,11 @@ type VirtualService struct {
 	// be applied to any port that is not a HTTP or TLS port. The first rule
 	// matching an incoming request is used.
 	Tcp []*TCPRoute `protobuf:"bytes,4,rep,name=tcp" json:"tcp,omitempty"`
+	// The visibility setting associated with this virtual service. Set to
+	// PRIVATE if this virtual service should not be exported, i.e. restrict
+	// the applicability of this virtual service to only workloads in the same
+	// namespace as the virtual service.
+	Scope ConfigScope `protobuf:"varint,6,opt,name=scope,proto3,enum=istio.networking.v1alpha3.ConfigScope" json:"scope,omitempty"`
 }
 
 func (m *VirtualService) Reset()                    { *m = VirtualService{} }
@@ -176,6 +181,13 @@ func (m *VirtualService) GetTcp() []*TCPRoute {
 	return nil
 }
 
+func (m *VirtualService) GetScope() ConfigScope {
+	if m != nil {
+		return m.Scope
+	}
+	return ConfigScope_PUBLIC
+}
+
 // Destination indicates the network addressable service to which the
 // request/connection will be sent after processing a routing rule. The
 // destination.host should unambiguously refer to a service in the service
@@ -2251,6 +2263,11 @@ func (m *VirtualService) MarshalTo(dAtA []byte) (int, error) {
 			i += n
 		}
 	}
+	if m.Scope != 0 {
+		dAtA[i] = 0x30
+		i++
+		i = encodeVarintVirtualService(dAtA, i, uint64(m.Scope))
+	}
 	return i, nil
 }
 
@@ -3649,6 +3666,9 @@ func (m *VirtualService) Size() (n int) {
 			n += 1 + l + sovVirtualService(uint64(l))
 		}
 	}
+	if m.Scope != 0 {
+		n += 1 + sovVirtualService(uint64(m.Scope))
+	}
 	return n
 }
 
@@ -4440,6 +4460,25 @@ func (m *VirtualService) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Scope", wireType)
+			}
+			m.Scope = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowVirtualService
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Scope |= (ConfigScope(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipVirtualService(dAtA[iNdEx:])
@@ -9092,116 +9131,118 @@ func init() {
 }
 
 var fileDescriptorVirtualService = []byte{
-	// 1771 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x59, 0x4f, 0x73, 0xdb, 0xc6,
-	0x15, 0x37, 0x48, 0x82, 0x7f, 0x1e, 0x29, 0x99, 0xda, 0xca, 0x32, 0xc4, 0x7a, 0x54, 0x99, 0xae,
-	0x5b, 0x75, 0x5c, 0x93, 0x53, 0xa9, 0x75, 0x35, 0xae, 0x2c, 0x9b, 0x94, 0x6c, 0xd3, 0x1d, 0xbb,
-	0xd2, 0x80, 0xaa, 0x0f, 0xbd, 0x70, 0x40, 0x60, 0x45, 0xa2, 0x06, 0x01, 0x74, 0xb1, 0x90, 0xc8,
-	0xe9, 0xb1, 0x4d, 0xee, 0xc9, 0xe4, 0x9a, 0xc9, 0xf7, 0xc8, 0x25, 0xd7, 0x9c, 0x32, 0xf9, 0x04,
-	0x19, 0x8f, 0x0f, 0x39, 0xe4, 0x92, 0xaf, 0x90, 0xd9, 0x5d, 0x00, 0x84, 0x44, 0x89, 0x20, 0x15,
-	0x27, 0x93, 0x93, 0xb8, 0x8b, 0xf7, 0xfb, 0xbd, 0xb7, 0x0f, 0x6f, 0xdf, 0x7b, 0x78, 0x82, 0x3f,
-	0xd8, 0x98, 0x9e, 0x3a, 0xe4, 0x8d, 0x69, 0xf7, 0xea, 0x27, 0x7f, 0xd2, 0x2c, 0xb7, 0xaf, 0x6d,
-	0xd5, 0x4f, 0x4c, 0x42, 0x7d, 0xcd, 0xea, 0x78, 0x98, 0x9c, 0x98, 0x3a, 0xae, 0xb9, 0xc4, 0xa1,
-	0x0e, 0x5a, 0x35, 0x3d, 0x6a, 0x3a, 0xb5, 0x31, 0xa0, 0x16, 0x02, 0x2a, 0x6b, 0x3d, 0xc7, 0xe9,
-	0x59, 0xb8, 0xce, 0x05, 0xbb, 0xfe, 0x71, 0xdd, 0xf0, 0x89, 0x46, 0x4d, 0xc7, 0x16, 0xd0, 0xc9,
-	0xe7, 0xa7, 0x44, 0x73, 0x5d, 0x4c, 0x3c, 0xf1, 0xbc, 0xfa, 0x9d, 0x04, 0x8b, 0xaf, 0x85, 0xd2,
-	0xb6, 0xd0, 0x89, 0x96, 0x41, 0xee, 0x3b, 0x1e, 0xf5, 0x14, 0x69, 0x3d, 0xbd, 0x51, 0x50, 0xc5,
-	0x02, 0x55, 0x20, 0xdf, 0xd3, 0x28, 0x3e, 0xd5, 0x46, 0x9e, 0x92, 0xe2, 0x0f, 0xa2, 0x35, 0xda,
-	0x86, 0x4c, 0x9f, 0x52, 0x57, 0x49, 0xaf, 0xa7, 0x37, 0x8a, 0x9b, 0xbf, 0xad, 0x5d, 0x6a, 0x6e,
-	0xad, 0x75, 0x74, 0x74, 0xa8, 0x3a, 0x3e, 0xc5, 0x2a, 0x47, 0xa0, 0xbf, 0x40, 0x9a, 0xea, 0xae,
-	0x92, 0xe1, 0xc0, 0x3b, 0x53, 0x80, 0x47, 0x7b, 0x01, 0x8e, 0xc9, 0x73, 0x98, 0xe5, 0x29, 0x72,
-	0x32, 0xec, 0x65, 0x3b, 0x84, 0x59, 0x5e, 0xf5, 0x04, 0x8a, 0xfb, 0xd8, 0xa3, 0xa6, 0xcd, 0x3d,
-	0x84, 0x10, 0x64, 0xd8, 0xd9, 0x14, 0x69, 0x5d, 0xda, 0x28, 0xa8, 0xfc, 0x37, 0x5a, 0x81, 0xac,
-	0xe7, 0x77, 0x3d, 0x4c, 0x95, 0x14, 0xdf, 0x0d, 0x56, 0xe8, 0x6f, 0x90, 0x71, 0x1d, 0x42, 0x95,
-	0xf4, 0xba, 0xb4, 0x51, 0xdc, 0xfc, 0xfd, 0x14, 0x95, 0x87, 0x0e, 0xa1, 0x6d, 0x6c, 0x61, 0x9d,
-	0x3a, 0x44, 0xe5, 0xa0, 0xea, 0xf7, 0x00, 0x85, 0xe8, 0xe4, 0xa8, 0x01, 0xf2, 0x40, 0xa3, 0x7a,
-	0x9f, 0xfb, 0xb7, 0xb8, 0x79, 0x2f, 0xc1, 0x5d, 0xaf, 0x98, 0xac, 0x8a, 0xff, 0xe3, 0x63, 0x8f,
-	0xaa, 0x02, 0x89, 0x9e, 0x82, 0x4c, 0x18, 0x17, 0x7f, 0x13, 0xc5, 0xcd, 0xfa, 0x2c, 0x1e, 0x8f,
-	0x9d, 0x5c, 0x15, 0x68, 0xb4, 0x07, 0x79, 0x82, 0x0d, 0x93, 0x60, 0x7d, 0x96, 0x83, 0x71, 0xa6,
-	0x40, 0x5c, 0x8d, 0x80, 0xe8, 0x09, 0xe4, 0x08, 0x3e, 0x25, 0x26, 0xc5, 0x4a, 0x86, 0x73, 0xfc,
-	0x2e, 0x91, 0x83, 0x4b, 0xab, 0x21, 0x0c, 0xdd, 0x83, 0xa5, 0x53, 0xdc, 0xf5, 0x1c, 0xfd, 0x0d,
-	0xa6, 0x1d, 0xdf, 0xed, 0x11, 0xcd, 0xc0, 0x8a, 0xbc, 0x2e, 0x6d, 0xe4, 0xd5, 0x72, 0xf4, 0xe0,
-	0x9f, 0x62, 0x1f, 0x6d, 0x41, 0x8e, 0x9a, 0x03, 0xec, 0xf8, 0x54, 0xc9, 0x72, 0x75, 0xab, 0x35,
-	0x11, 0xe2, 0xb5, 0x30, 0xc4, 0x6b, 0xfb, 0xc1, 0x15, 0x50, 0x43, 0x49, 0xb4, 0xcb, 0x6c, 0xa4,
-	0xc4, 0xc4, 0x9e, 0x92, 0xe3, 0xa0, 0xc4, 0x18, 0xc5, 0x94, 0x8c, 0xd4, 0x10, 0x84, 0xf6, 0x40,
-	0x3e, 0xd6, 0x7c, 0x8b, 0x2a, 0x79, 0x8e, 0xbe, 0x9f, 0x80, 0x7e, 0xc6, 0x64, 0x5f, 0xd8, 0xff,
-	0xc6, 0xba, 0xf0, 0x36, 0xc7, 0xa2, 0x5d, 0xc8, 0x0e, 0x4c, 0x42, 0x1c, 0xa2, 0x14, 0x12, 0xfd,
-	0x14, 0x7f, 0x59, 0x01, 0x0a, 0x3d, 0x83, 0xa2, 0xee, 0x10, 0xaf, 0xe3, 0x3a, 0x96, 0xa9, 0x8f,
-	0x14, 0xe0, 0x24, 0x77, 0xa7, 0x90, 0xec, 0x39, 0xc4, 0x3b, 0xe4, 0xc2, 0x2a, 0xe8, 0xd1, 0x6f,
-	0xd4, 0x85, 0x45, 0x96, 0x02, 0x6c, 0xa3, 0xd3, 0xc7, 0x9a, 0x81, 0x89, 0xa7, 0x14, 0x79, 0x14,
-	0xfd, 0x75, 0x96, 0x28, 0xaa, 0x35, 0x38, 0xb4, 0x25, 0x90, 0x4f, 0x6d, 0x4a, 0x46, 0xcd, 0x94,
-	0x22, 0xa9, 0x0b, 0x5a, 0x7c, 0x1f, 0x3d, 0x84, 0x9b, 0x04, 0x0f, 0x9c, 0x13, 0xdc, 0x21, 0xd8,
-	0x73, 0x1d, 0xdb, 0xc3, 0x91, 0xb2, 0x12, 0x4b, 0x1e, 0x1c, 0x73, 0x43, 0x88, 0xa8, 0x81, 0x44,
-	0x88, 0xfd, 0x2f, 0xdc, 0x0c, 0xec, 0x9b, 0xc0, 0x2e, 0x70, 0x43, 0x1f, 0xcf, 0x61, 0xe8, 0x39,
-	0xf2, 0xb1, 0xc1, 0x37, 0xb4, 0x8b, 0x9e, 0xa3, 0x6d, 0x58, 0x89, 0x0c, 0xe7, 0x57, 0x2e, 0xd2,
-	0xbd, 0x18, 0xd9, 0xbd, 0x1c, 0xda, 0xcd, 0x05, 0x42, 0xe4, 0x10, 0x56, 0x22, 0xb3, 0xcf, 0x22,
-	0xaf, 0x73, 0xab, 0x77, 0xe7, 0xb2, 0x3a, 0x4e, 0x3d, 0x36, 0x7a, 0x59, 0xbb, 0xe0, 0x31, 0xda,
-	0x81, 0x5c, 0xa8, 0xaa, 0xcc, 0x83, 0xa2, 0x3a, 0x4d, 0x95, 0x90, 0x54, 0x43, 0x48, 0xe5, 0x09,
-	0xa0, 0xc9, 0x77, 0x8a, 0xca, 0x90, 0x7e, 0x83, 0x47, 0x41, 0x6a, 0x64, 0x3f, 0x59, 0x59, 0x38,
-	0xd1, 0x2c, 0x1f, 0x07, 0x89, 0x51, 0x2c, 0x1e, 0xa6, 0xb6, 0xa5, 0x4a, 0x0b, 0x2a, 0x97, 0x3b,
-	0x7b, 0x2e, 0xa6, 0xe7, 0xb0, 0x7a, 0xa9, 0x03, 0xe6, 0x21, 0xaa, 0x7e, 0x9b, 0x86, 0x5c, 0xe8,
-	0x9e, 0x57, 0xec, 0xf2, 0x73, 0x3a, 0x8e, 0x2d, 0x6e, 0x6e, 0x25, 0xbb, 0x27, 0xf8, 0x7b, 0xe0,
-	0x62, 0x91, 0x4a, 0x3c, 0x35, 0xe4, 0x40, 0x07, 0x2c, 0x69, 0x8a, 0x73, 0x72, 0xbd, 0x57, 0xe4,
-	0x8b, 0x48, 0x2a, 0x9f, 0xa7, 0xa0, 0x7c, 0xfe, 0x31, 0xfa, 0x07, 0xa4, 0x59, 0x11, 0x12, 0x25,
-	0x62, 0xe7, 0x0a, 0x0a, 0x6a, 0x6d, 0x4c, 0xb9, 0xdf, 0x54, 0x46, 0xc4, 0xf8, 0x34, 0xc3, 0x08,
-	0xea, 0xc5, 0x95, 0xf8, 0x1a, 0x86, 0x11, 0xf0, 0x69, 0x86, 0xc1, 0xea, 0xa4, 0xb8, 0x05, 0xbc,
-	0xe8, 0x17, 0xd4, 0x60, 0x55, 0x79, 0x00, 0xf9, 0x50, 0xf1, 0x5c, 0x6f, 0xfe, 0x01, 0xe4, 0x43,
-	0x05, 0x73, 0xbd, 0xe8, 0x8f, 0x25, 0xc8, 0x87, 0x45, 0x9e, 0xa5, 0xe9, 0x78, 0x65, 0xbd, 0x3f,
-	0xbd, 0x31, 0xe0, 0x85, 0xb5, 0x41, 0x29, 0x31, 0xbb, 0x3e, 0xc5, 0x5e, 0x58, 0x5b, 0x1b, 0x67,
-	0x6b, 0xeb, 0xb4, 0xf2, 0x7c, 0x49, 0x5d, 0xad, 0x7e, 0xc4, 0x8c, 0x0a, 0x1a, 0x16, 0xd4, 0x3c,
-	0x6b, 0xd4, 0x1f, 0xa7, 0xf0, 0xbd, 0xfc, 0xf3, 0x4f, 0x67, 0xd3, 0x67, 0x32, 0x94, 0xcf, 0xb7,
-	0x13, 0x68, 0x1b, 0xd2, 0x3e, 0x31, 0x83, 0x6b, 0x31, 0xad, 0x1e, 0xb5, 0x29, 0x31, 0xed, 0x9e,
-	0xc0, 0x32, 0x08, 0x2b, 0x66, 0x9e, 0xde, 0xc7, 0x83, 0xf0, 0x0e, 0xcc, 0x0a, 0x0e, 0x50, 0xbc,
-	0x18, 0x62, 0xda, 0x77, 0x8c, 0xa0, 0xf1, 0x98, 0x19, 0x2f, 0x50, 0x68, 0x1f, 0x0a, 0x9a, 0x4f,
-	0xfb, 0x0e, 0x31, 0xe9, 0x68, 0x86, 0xbe, 0x23, 0x4e, 0x31, 0x06, 0x22, 0x75, 0x9c, 0x39, 0x45,
-	0x2f, 0xb9, 0x3d, 0x47, 0x33, 0x56, 0x8b, 0x67, 0xa7, 0x28, 0x9f, 0xb2, 0xae, 0x92, 0x77, 0x8a,
-	0xac, 0x3b, 0x59, 0x10, 0x0d, 0x20, 0xea, 0xc2, 0x82, 0xe7, 0xf8, 0x44, 0xc7, 0x1d, 0x4b, 0xeb,
-	0x62, 0x8b, 0x75, 0x21, 0x4c, 0xdb, 0xa3, 0x79, 0xb4, 0xb5, 0x39, 0xc1, 0x4b, 0x8e, 0x17, 0x2a,
-	0x4b, 0x5e, 0x6c, 0xeb, 0x4c, 0x83, 0x9e, 0x3f, 0xdb, 0xa0, 0x57, 0xba, 0x50, 0x4a, 0x48, 0xa5,
-	0x3b, 0xf1, 0x1b, 0x36, 0xbb, 0x2f, 0x63, 0x37, 0xf8, 0x31, 0x2c, 0x4d, 0x98, 0x38, 0xd7, 0x55,
-	0xfe, 0x4a, 0x86, 0xe5, 0x8b, 0xba, 0x55, 0xd4, 0x82, 0xa2, 0x31, 0x5e, 0xce, 0x10, 0xad, 0xf1,
-	0xf0, 0x8f, 0x43, 0x59, 0xd6, 0x3a, 0xc5, 0x66, 0xaf, 0x2f, 0xba, 0x7b, 0x59, 0x0d, 0x56, 0xd3,
-	0xda, 0x95, 0x74, 0x52, 0xbb, 0xf2, 0xa1, 0x74, 0x79, 0xbf, 0x22, 0xbe, 0x6b, 0xfe, 0x3e, 0x67,
-	0x7b, 0xfe, 0xde, 0x5b, 0x17, 0x39, 0xa1, 0x75, 0xf9, 0x9f, 0x74, 0x69, 0xef, 0x92, 0xe5, 0x27,
-	0x78, 0x71, 0xd5, 0x13, 0x5c, 0xb1, 0x8d, 0xc9, 0xcd, 0xdf, 0xc6, 0xfc, 0x02, 0x9b, 0x10, 0x0a,
-	0xe5, 0x9f, 0x3f, 0x96, 0xab, 0x5f, 0xa4, 0x60, 0x69, 0xa2, 0x90, 0xa0, 0x3a, 0xfc, 0x2a, 0x06,
-	0xee, 0x78, 0x7e, 0xd7, 0xc6, 0xd1, 0x27, 0x3e, 0x8a, 0x3d, 0x6a, 0x8b, 0x27, 0x51, 0x1a, 0x4b,
-	0xc5, 0xd2, 0xd8, 0x9d, 0x28, 0x8d, 0x09, 0x3c, 0xcf, 0xdd, 0x85, 0x30, 0x0f, 0x09, 0x24, 0xd2,
-	0xcf, 0xe7, 0xba, 0x4c, 0x62, 0xfb, 0x3b, 0x61, 0xee, 0x5c, 0xc9, 0x4e, 0x3e, 0x97, 0xec, 0x7e,
-	0x74, 0x22, 0xfa, 0x26, 0x05, 0x68, 0xb2, 0x3f, 0x40, 0xbf, 0x86, 0x82, 0x67, 0x9b, 0x9d, 0xf8,
-	0x6c, 0x24, 0xef, 0xd9, 0x66, 0x8b, 0x8f, 0x47, 0x2e, 0xf1, 0x6f, 0x2a, 0xd1, 0xbf, 0xe9, 0x69,
-	0xfe, 0xcd, 0x5c, 0xe0, 0x5f, 0xe3, 0xbc, 0x7f, 0xe5, 0xc4, 0x8f, 0xa2, 0xc9, 0xc3, 0xcc, 0xe5,
-	0xe0, 0xec, 0xfb, 0x76, 0xf0, 0x2e, 0x94, 0xe2, 0xc3, 0x04, 0x86, 0x0d, 0xdb, 0x90, 0x82, 0x68,
-	0x2f, 0x6e, 0xc5, 0xcb, 0xbb, 0xc0, 0x8f, 0x37, 0xaa, 0x8f, 0xa0, 0x18, 0x1b, 0x24, 0xcc, 0x0d,
-	0xc7, 0x50, 0x8c, 0xd5, 0x30, 0xb4, 0x02, 0x32, 0x1e, 0x6a, 0x7a, 0x30, 0x07, 0x6a, 0x5d, 0x53,
-	0xc5, 0x12, 0x29, 0x90, 0x75, 0x09, 0x3e, 0x36, 0x87, 0x82, 0xa1, 0x75, 0x4d, 0x0d, 0xd6, 0x0c,
-	0x41, 0x70, 0x0f, 0x0f, 0x45, 0xfc, 0x33, 0x04, 0x5f, 0x36, 0x4b, 0x00, 0xbc, 0x5f, 0xeb, 0xd0,
-	0x91, 0x8b, 0xab, 0x1f, 0x48, 0xc1, 0xd4, 0x07, 0x33, 0xff, 0x54, 0x20, 0xaf, 0x51, 0x8a, 0x07,
-	0x2e, 0x0f, 0x1e, 0x76, 0x61, 0xa3, 0x35, 0x6a, 0xc0, 0x75, 0x17, 0x93, 0x0e, 0x25, 0xa3, 0x4e,
-	0x38, 0xdb, 0x48, 0x25, 0xcd, 0x36, 0x16, 0x5c, 0x4c, 0x8e, 0xc8, 0xe8, 0x28, 0x98, 0x70, 0xac,
-	0xb2, 0xaf, 0x12, 0x46, 0xe0, 0xd8, 0xc1, 0xad, 0xe4, 0xc3, 0x8b, 0xd1, 0x81, 0x5d, 0xfd, 0x34,
-	0x05, 0x30, 0x1e, 0x05, 0xa0, 0xdb, 0x50, 0xd2, 0x2c, 0xcb, 0x39, 0xed, 0x38, 0xc4, 0xec, 0x99,
-	0x76, 0x10, 0xc9, 0x45, 0xbe, 0x77, 0xc0, 0xb7, 0x58, 0x1c, 0x0a, 0x11, 0xd1, 0x6c, 0x85, 0x61,
-	0x2c, 0x70, 0xaf, 0xc4, 0xde, 0x58, 0xe8, 0x4c, 0xa5, 0x0c, 0x84, 0xc2, 0x9c, 0x7e, 0x17, 0x16,
-	0xf1, 0xd0, 0x75, 0xce, 0x95, 0xc4, 0x82, 0xba, 0x20, 0x76, 0x43, 0xb1, 0x4d, 0xc8, 0x0d, 0xb4,
-	0x61, 0x47, 0xeb, 0x89, 0xb9, 0xcf, 0xd4, 0x83, 0x67, 0x07, 0xda, 0xb0, 0xd1, 0xc3, 0xe8, 0x39,
-	0x2c, 0x09, 0xfd, 0x3a, 0xc1, 0x06, 0xb6, 0xa9, 0xa9, 0x59, 0x5e, 0x30, 0x12, 0xaa, 0x4c, 0xa0,
-	0x9b, 0x8e, 0x63, 0xbd, 0x66, 0xf1, 0xa7, 0x96, 0x39, 0x68, 0x6f, 0x8c, 0xa9, 0x7e, 0x22, 0x03,
-	0x9a, 0x9c, 0xda, 0xa0, 0x17, 0x20, 0x1b, 0xd8, 0xd2, 0x46, 0xb3, 0x7c, 0x34, 0x4e, 0xa0, 0x6b,
-	0xfb, 0x0c, 0xaa, 0x0a, 0x06, 0x46, 0xa5, 0x75, 0xc3, 0x64, 0x3a, 0x37, 0x55, 0x83, 0x41, 0x55,
-	0xc1, 0x50, 0xf9, 0x7f, 0x0a, 0x64, 0xce, 0x8d, 0x6e, 0x41, 0xce, 0xc5, 0x44, 0xc7, 0xb6, 0x08,
-	0x5c, 0x99, 0x57, 0xd6, 0x70, 0x0b, 0xed, 0x40, 0xf1, 0xd8, 0x1c, 0x62, 0xa3, 0x23, 0xce, 0x90,
-	0x14, 0x4e, 0xad, 0x6b, 0x2a, 0x70, 0x79, 0xc1, 0xdd, 0x82, 0x25, 0xf6, 0x82, 0x6c, 0xe1, 0xa2,
-	0x80, 0x23, 0x9d, 0xcc, 0x51, 0x8e, 0xa1, 0x04, 0x53, 0x13, 0x20, 0x30, 0x69, 0xfc, 0x72, 0xa7,
-	0xd5, 0xf5, 0x43, 0x21, 0xac, 0xc6, 0x50, 0xcd, 0x25, 0xb8, 0xde, 0xa7, 0xd4, 0x15, 0x66, 0xf0,
-	0xbb, 0x55, 0x79, 0x2b, 0x81, 0xcc, 0xfd, 0x92, 0xe0, 0x86, 0xdb, 0x50, 0xe4, 0x50, 0x8f, 0x6a,
-	0xd4, 0xf7, 0x44, 0xa5, 0x64, 0x67, 0x65, 0x9b, 0x6d, 0xbe, 0xc7, 0x44, 0x7a, 0xc4, 0xd5, 0x43,
-	0x91, 0xf0, 0x4a, 0x03, 0xdb, 0x1c, 0x8b, 0x30, 0xc0, 0x66, 0x07, 0xf3, 0xf1, 0x5d, 0x26, 0x14,
-	0xe1, 0x9b, 0x4f, 0xf9, 0x70, 0xee, 0x7d, 0x9c, 0xb3, 0x04, 0xc0, 0x15, 0x88, 0xf4, 0xf1, 0x0c,
-	0x4a, 0xf1, 0x51, 0x32, 0x4b, 0x47, 0xb6, 0x3f, 0xe8, 0x62, 0xc2, 0xcf, 0xb9, 0xc0, 0xd2, 0x91,
-	0x58, 0xa3, 0x65, 0xc8, 0xd8, 0x5a, 0xf0, 0x25, 0xc6, 0xec, 0xe2, 0xab, 0x66, 0x56, 0x14, 0x98,
-	0xea, 0x6f, 0x20, 0x17, 0x28, 0x1b, 0x67, 0x64, 0xc6, 0x20, 0x05, 0x19, 0xb9, 0x59, 0xfb, 0xf2,
-	0xdd, 0x9a, 0xf4, 0xf5, 0xbb, 0x35, 0xe9, 0xed, 0xbb, 0x35, 0xe9, 0x5f, 0xeb, 0xc2, 0x66, 0xd3,
-	0xa9, 0x6b, 0xae, 0x59, 0xbf, 0xe0, 0x7f, 0x14, 0xdd, 0x2c, 0x7f, 0xf3, 0x5b, 0x3f, 0x04, 0x00,
-	0x00, 0xff, 0xff, 0x9e, 0x6d, 0x35, 0x27, 0xc1, 0x18, 0x00, 0x00,
+	// 1806 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x59, 0x4f, 0x73, 0xe3, 0x48,
+	0x15, 0x1f, 0xd9, 0x96, 0xff, 0x3c, 0x3b, 0x19, 0xa7, 0xc9, 0xce, 0x6a, 0xcc, 0x56, 0xc8, 0x7a,
+	0xd9, 0xdd, 0x50, 0xcb, 0xda, 0x85, 0x03, 0x4b, 0x6a, 0xc9, 0x66, 0xd7, 0x4e, 0x66, 0xd6, 0x43,
+	0xcd, 0x90, 0x94, 0x1c, 0xf6, 0xc0, 0x45, 0x25, 0x4b, 0x1d, 0x5b, 0x8c, 0x2c, 0x89, 0x56, 0x2b,
+	0xb1, 0x8b, 0x23, 0x7f, 0xee, 0x50, 0x5c, 0x29, 0xae, 0x7c, 0x06, 0x2e, 0x5c, 0x39, 0x51, 0x7c,
+	0x02, 0x6a, 0x6a, 0x0e, 0x5c, 0xf9, 0x0a, 0x54, 0xff, 0x91, 0xac, 0xc4, 0x89, 0x65, 0x87, 0x81,
+	0xda, 0x53, 0xdc, 0xdd, 0xef, 0xf7, 0xfa, 0xf5, 0xeb, 0x7e, 0xef, 0xfd, 0xf4, 0x02, 0xdf, 0xf1,
+	0x30, 0xbd, 0xf2, 0xc9, 0x4b, 0xc7, 0x1b, 0xb5, 0x2f, 0xbf, 0x67, 0xba, 0xc1, 0xd8, 0xdc, 0x6f,
+	0x5f, 0x3a, 0x84, 0x46, 0xa6, 0x6b, 0x84, 0x98, 0x5c, 0x3a, 0x16, 0x6e, 0x05, 0xc4, 0xa7, 0x3e,
+	0x7a, 0xec, 0x84, 0xd4, 0xf1, 0x5b, 0x73, 0x40, 0x2b, 0x06, 0x34, 0x76, 0x46, 0xbe, 0x3f, 0x72,
+	0x71, 0x9b, 0x0b, 0x0e, 0xa3, 0x8b, 0xb6, 0x1d, 0x11, 0x93, 0x3a, 0xbe, 0x27, 0xa0, 0x8b, 0xeb,
+	0x57, 0xc4, 0x0c, 0x02, 0x4c, 0x42, 0xb9, 0xfe, 0xe1, 0x6d, 0x56, 0xc8, 0x39, 0x23, 0xb4, 0xfc,
+	0x40, 0xda, 0xd0, 0xfc, 0x73, 0x0e, 0x36, 0xbf, 0x12, 0xd6, 0x0d, 0x84, 0x71, 0x68, 0x1b, 0xd4,
+	0xb1, 0x1f, 0xd2, 0x50, 0x53, 0x76, 0xf3, 0x7b, 0x15, 0x5d, 0x0c, 0x50, 0x03, 0xca, 0x23, 0x93,
+	0xe2, 0x2b, 0x73, 0x16, 0x6a, 0x39, 0xbe, 0x90, 0x8c, 0xd1, 0x01, 0x14, 0xc6, 0x94, 0x06, 0x5a,
+	0x7e, 0x37, 0xbf, 0x57, 0xed, 0x7c, 0xbb, 0x75, 0xe7, 0xb9, 0x5a, 0xfd, 0xf3, 0xf3, 0x33, 0xdd,
+	0x8f, 0x28, 0xd6, 0x39, 0x02, 0xfd, 0x00, 0xf2, 0xd4, 0x0a, 0xb4, 0x02, 0x07, 0xbe, 0xb7, 0x04,
+	0x78, 0x7e, 0x2c, 0x71, 0x4c, 0x9e, 0xc3, 0xdc, 0x50, 0x53, 0xb3, 0x61, 0xcf, 0x07, 0x31, 0xcc,
+	0x0d, 0xd1, 0x21, 0xa8, 0xfc, 0xec, 0x5a, 0x71, 0x57, 0xd9, 0xdb, 0xec, 0x7c, 0xb0, 0x04, 0x78,
+	0xec, 0x7b, 0x17, 0xce, 0x68, 0xc0, 0xa4, 0x75, 0x01, 0x6a, 0x5e, 0x42, 0xf5, 0x04, 0x87, 0xd4,
+	0xf1, 0xf8, 0x45, 0x20, 0x04, 0x05, 0xe6, 0x19, 0x4d, 0xd9, 0x55, 0xf6, 0x2a, 0x3a, 0xff, 0x8d,
+	0x1e, 0x41, 0x31, 0x8c, 0x86, 0x21, 0xa6, 0x5a, 0x8e, 0xcf, 0xca, 0x11, 0xfa, 0x11, 0x14, 0x02,
+	0x9f, 0x50, 0x2d, 0xbf, 0xab, 0xec, 0x55, 0x3b, 0x1f, 0x2e, 0xd9, 0xf7, 0xcc, 0x27, 0x74, 0x80,
+	0x5d, 0x6c, 0x51, 0x9f, 0xe8, 0x1c, 0xd4, 0xfc, 0x37, 0x40, 0x25, 0xf1, 0x1b, 0xea, 0x82, 0x3a,
+	0x31, 0xa9, 0x35, 0xe6, 0xb7, 0x53, 0xed, 0x7c, 0x94, 0xe1, 0xec, 0x17, 0x4c, 0x56, 0xc7, 0xbf,
+	0x88, 0x70, 0x48, 0x75, 0x81, 0x44, 0x4f, 0x40, 0x25, 0x4c, 0x17, 0xbf, 0xc7, 0x6a, 0xa7, 0xbd,
+	0xca, 0x7d, 0xa5, 0x4e, 0xae, 0x0b, 0x34, 0x3a, 0x86, 0x32, 0xc1, 0xb6, 0x43, 0xb0, 0xb5, 0xca,
+	0xc1, 0xb8, 0x26, 0x29, 0xae, 0x27, 0x40, 0xf4, 0x05, 0x94, 0x08, 0xbe, 0x22, 0x0e, 0xc5, 0x5a,
+	0x81, 0xeb, 0xf8, 0x20, 0x53, 0x07, 0x97, 0xd6, 0x63, 0x18, 0xfa, 0x08, 0xb6, 0xae, 0xf0, 0x30,
+	0xf4, 0xad, 0x97, 0x98, 0x1a, 0x51, 0x30, 0x22, 0xa6, 0x8d, 0x35, 0x75, 0x57, 0xd9, 0x2b, 0xeb,
+	0xf5, 0x64, 0xe1, 0xa7, 0x62, 0x1e, 0xed, 0x43, 0x89, 0x3a, 0x13, 0xec, 0x47, 0x94, 0xbf, 0x81,
+	0x6a, 0xe7, 0x71, 0x4b, 0x44, 0x52, 0x2b, 0x8e, 0xa4, 0xd6, 0x89, 0x8c, 0x34, 0x3d, 0x96, 0x44,
+	0x47, 0xcc, 0x46, 0x4a, 0x1c, 0x1c, 0x6a, 0x25, 0x0e, 0xca, 0x7c, 0xe1, 0x98, 0x92, 0x99, 0x1e,
+	0x83, 0xd0, 0x31, 0xa8, 0x17, 0x66, 0xe4, 0x52, 0xad, 0xcc, 0xd1, 0x1f, 0x67, 0xa0, 0x9f, 0x32,
+	0xd9, 0x67, 0xde, 0xcf, 0xb1, 0x25, 0xbc, 0xcd, 0xb1, 0xe8, 0x08, 0x8a, 0x13, 0x87, 0x10, 0x9f,
+	0x68, 0x95, 0x4c, 0x3f, 0xa5, 0x2f, 0x4b, 0xa2, 0xd0, 0x53, 0xa8, 0x5a, 0x3e, 0x09, 0x8d, 0xc0,
+	0x77, 0x1d, 0x6b, 0xa6, 0x01, 0x57, 0xf2, 0xfe, 0xd2, 0x08, 0x20, 0xe1, 0x19, 0x17, 0xd6, 0xc1,
+	0x4a, 0x7e, 0xa3, 0x21, 0x6c, 0xb2, 0x4c, 0xe3, 0xd9, 0xc6, 0x18, 0x9b, 0x36, 0x26, 0xa1, 0x56,
+	0xe5, 0xaf, 0xe8, 0x87, 0xab, 0xbc, 0xa2, 0x56, 0x97, 0x43, 0xfb, 0x02, 0xf9, 0xc4, 0xa3, 0x64,
+	0xd6, 0xcb, 0x69, 0x8a, 0xbe, 0x61, 0xa6, 0xe7, 0xd1, 0xa7, 0xf0, 0x36, 0xc1, 0x13, 0xff, 0x12,
+	0x1b, 0x04, 0x87, 0x81, 0xef, 0x85, 0x38, 0xd9, 0xac, 0xc6, 0x52, 0x0f, 0xc7, 0xbc, 0x25, 0x44,
+	0x74, 0x29, 0x11, 0x63, 0x7f, 0x09, 0x6f, 0x4b, 0xfb, 0x16, 0xb0, 0x1b, 0xdc, 0xd0, 0xcf, 0xd7,
+	0x30, 0xf4, 0x86, 0xf2, 0xb9, 0xc1, 0x6f, 0x99, 0xb7, 0xad, 0xa3, 0x03, 0x78, 0x94, 0x18, 0xce,
+	0x43, 0x2e, 0xd9, 0x7b, 0x33, 0xb1, 0x7b, 0x3b, 0xb6, 0x9b, 0x0b, 0xc4, 0xc8, 0x29, 0x3c, 0x4a,
+	0xcc, 0xbe, 0x8e, 0x7c, 0xc8, 0xad, 0x3e, 0x5a, 0xcb, 0xea, 0xb4, 0xea, 0xb9, 0xd1, 0xdb, 0xe6,
+	0x2d, 0xcb, 0xe8, 0x10, 0x4a, 0xf1, 0x56, 0x75, 0xfe, 0x28, 0x9a, 0xcb, 0xb6, 0x12, 0x92, 0x7a,
+	0x0c, 0x69, 0x7c, 0x01, 0x68, 0xf1, 0x4e, 0x51, 0x1d, 0xf2, 0x2f, 0xf1, 0x4c, 0xa6, 0x46, 0xf6,
+	0x93, 0x15, 0x95, 0x4b, 0xd3, 0x8d, 0xb0, 0x4c, 0x8c, 0x62, 0xf0, 0x69, 0xee, 0x40, 0x69, 0xf4,
+	0xa1, 0x71, 0xb7, 0xb3, 0xd7, 0xd2, 0xf4, 0x25, 0x3c, 0xbe, 0xd3, 0x01, 0xeb, 0x28, 0x6a, 0xfe,
+	0x2b, 0x0f, 0xa5, 0xd8, 0x3d, 0x2f, 0x58, 0xf0, 0x73, 0x75, 0x1c, 0x5b, 0xed, 0xec, 0x67, 0xbb,
+	0x47, 0xfe, 0x3d, 0x0d, 0xb0, 0x48, 0x25, 0xa1, 0x1e, 0xeb, 0x40, 0xa7, 0x2c, 0x69, 0x8a, 0x73,
+	0xf2, 0x7d, 0xef, 0xa9, 0x2f, 0x51, 0xd2, 0xf8, 0x4b, 0x0e, 0xea, 0x37, 0x97, 0xd1, 0x4f, 0x20,
+	0xcf, 0x8a, 0x90, 0x28, 0x11, 0x87, 0xf7, 0xd8, 0xa0, 0x35, 0xc0, 0x94, 0xfb, 0x4d, 0x67, 0x8a,
+	0x98, 0x3e, 0xd3, 0xb6, 0x65, 0xbd, 0xb8, 0x97, 0xbe, 0xae, 0x6d, 0x4b, 0x7d, 0xa6, 0x6d, 0xb3,
+	0x3a, 0x29, 0xa2, 0x80, 0x53, 0x86, 0x8a, 0x2e, 0x47, 0x8d, 0x4f, 0xa0, 0x1c, 0x6f, 0xbc, 0xd6,
+	0xcd, 0x7f, 0x02, 0xe5, 0x78, 0x83, 0xb5, 0x2e, 0xfa, 0xf7, 0x0a, 0x94, 0x63, 0x8a, 0xc0, 0xd2,
+	0x74, 0xba, 0xb2, 0x7e, 0xbc, 0x9c, 0x56, 0xf0, 0xc2, 0xda, 0xa5, 0x94, 0x38, 0xc3, 0x88, 0xe2,
+	0x30, 0xae, 0xad, 0xdd, 0xeb, 0xb5, 0x75, 0x59, 0x79, 0xbe, 0xa3, 0xae, 0x36, 0x7f, 0xc7, 0x8c,
+	0x92, 0x74, 0x07, 0xf5, 0xae, 0x1b, 0xf5, 0xdd, 0x25, 0xfa, 0x9e, 0x7f, 0xff, 0x7f, 0x67, 0xd3,
+	0x9f, 0x54, 0xa8, 0xdf, 0xa4, 0x13, 0xe8, 0x00, 0xf2, 0x11, 0x71, 0x64, 0x58, 0x2c, 0xab, 0x47,
+	0x03, 0x4a, 0x1c, 0x6f, 0x24, 0xb0, 0x0c, 0xc2, 0x8a, 0x59, 0x68, 0x8d, 0xf1, 0x24, 0x8e, 0x81,
+	0x55, 0xc1, 0x12, 0xc5, 0x8b, 0x21, 0xa6, 0x63, 0xdf, 0x96, 0xc4, 0x63, 0x65, 0xbc, 0x40, 0xa1,
+	0x13, 0xa8, 0x98, 0x11, 0x1d, 0xfb, 0xc4, 0xa1, 0xb3, 0x15, 0x78, 0x47, 0x5a, 0xc5, 0x1c, 0x88,
+	0xf4, 0x79, 0xe6, 0x14, 0x4c, 0xf4, 0x60, 0x0d, 0x32, 0xd6, 0x4a, 0x67, 0xa7, 0x24, 0x9f, 0x32,
+	0x56, 0xc9, 0x99, 0x22, 0x63, 0x27, 0x1b, 0x82, 0x00, 0xa2, 0x21, 0x6c, 0x84, 0x7e, 0x44, 0x2c,
+	0x6c, 0xb8, 0xe6, 0x10, 0xbb, 0x8c, 0x85, 0xb0, 0xdd, 0x3e, 0x5b, 0x67, 0xb7, 0x01, 0x57, 0xf0,
+	0x9c, 0xe3, 0xc5, 0x96, 0xb5, 0x30, 0x35, 0x75, 0x8d, 0xde, 0x97, 0xaf, 0xd3, 0xfb, 0xc6, 0x10,
+	0x6a, 0x19, 0xa9, 0xf4, 0x30, 0x1d, 0x61, 0xab, 0xfb, 0x32, 0x15, 0xc1, 0x9f, 0xc3, 0xd6, 0x82,
+	0x89, 0x6b, 0x85, 0xf2, 0xdf, 0x55, 0xd8, 0xbe, 0x8d, 0xad, 0xa2, 0x3e, 0x54, 0xed, 0xf9, 0x70,
+	0x85, 0xd7, 0x9a, 0x7e, 0xfe, 0x69, 0x28, 0xcb, 0x5a, 0x57, 0xd8, 0x19, 0x8d, 0x05, 0xbb, 0x57,
+	0x75, 0x39, 0x5a, 0x46, 0x57, 0xf2, 0x59, 0x74, 0xe5, 0xb7, 0xca, 0xdd, 0x7c, 0x45, 0x7c, 0x15,
+	0xfd, 0x78, 0x4d, 0x7a, 0xfe, 0xc6, 0xa9, 0x8b, 0x9a, 0x41, 0x5d, 0x7e, 0xa5, 0xdc, 0xc9, 0x5d,
+	0x8a, 0xfc, 0x04, 0xcf, 0xee, 0x7b, 0x82, 0x7b, 0xd2, 0x98, 0xd2, 0xfa, 0x34, 0xe6, 0x6b, 0x48,
+	0x42, 0x28, 0xd4, 0xff, 0xff, 0x6f, 0xb9, 0xf9, 0xd7, 0x1c, 0x6c, 0x2d, 0x14, 0x12, 0xd4, 0x86,
+	0x6f, 0xa4, 0xc0, 0x46, 0x18, 0x0d, 0x3d, 0x9c, 0x34, 0x08, 0x50, 0x6a, 0x69, 0x20, 0x56, 0x92,
+	0x34, 0x96, 0x4b, 0xa5, 0xb1, 0xf7, 0x92, 0x34, 0x26, 0xf0, 0x3c, 0x77, 0x57, 0xe2, 0x3c, 0x24,
+	0x90, 0xc8, 0xba, 0x99, 0xeb, 0x0a, 0x99, 0xf4, 0x77, 0xc1, 0xdc, 0xb5, 0x92, 0x9d, 0x7a, 0x23,
+	0xd9, 0xfd, 0xd7, 0x89, 0xe8, 0x9f, 0x39, 0x40, 0x8b, 0xfc, 0x00, 0x7d, 0x13, 0x2a, 0xa1, 0xe7,
+	0x18, 0xe9, 0xce, 0x4a, 0x39, 0xf4, 0x9c, 0x3e, 0x6f, 0xae, 0xdc, 0xe1, 0xdf, 0x5c, 0xa6, 0x7f,
+	0xf3, 0xcb, 0xfc, 0x5b, 0xb8, 0xc5, 0xbf, 0xf6, 0x4d, 0xff, 0xaa, 0x99, 0x1f, 0x45, 0x8b, 0x87,
+	0x59, 0xcb, 0xc1, 0xc5, 0x37, 0xed, 0xe0, 0x23, 0xa8, 0xa5, 0x9b, 0x09, 0x0c, 0x1b, 0xd3, 0x90,
+	0x8a, 0xa0, 0x17, 0xef, 0xa4, 0xcb, 0xbb, 0xc0, 0xcf, 0x27, 0x9a, 0x9f, 0x41, 0x35, 0xd5, 0x48,
+	0x58, 0x1b, 0x8e, 0xa1, 0x9a, 0xaa, 0x61, 0xe8, 0x11, 0xa8, 0x78, 0x6a, 0x5a, 0xb2, 0x0f, 0xd4,
+	0x7f, 0xa0, 0x8b, 0x21, 0xd2, 0xa0, 0x18, 0x10, 0x7c, 0xe1, 0x4c, 0x85, 0x86, 0xfe, 0x03, 0x5d,
+	0x8e, 0x19, 0x82, 0xe0, 0x11, 0x9e, 0x8a, 0xf7, 0xcf, 0x10, 0x7c, 0xd8, 0xab, 0x01, 0x70, 0xbe,
+	0x66, 0xd0, 0x59, 0x80, 0x9b, 0xbf, 0x51, 0x64, 0xd7, 0x07, 0x33, 0xff, 0x34, 0xa0, 0x6c, 0x52,
+	0x8a, 0x27, 0x01, 0x7f, 0x3c, 0x2c, 0x60, 0x93, 0x31, 0xea, 0xc2, 0xc3, 0x00, 0x13, 0x83, 0x92,
+	0x99, 0x11, 0xf7, 0x36, 0x72, 0x59, 0xbd, 0x8d, 0x8d, 0x00, 0x93, 0x73, 0x32, 0x3b, 0x97, 0x1d,
+	0x8e, 0xc7, 0xec, 0xab, 0x84, 0x29, 0xf0, 0x3d, 0x19, 0x95, 0xbc, 0x79, 0x31, 0x3b, 0xf5, 0x9a,
+	0x7f, 0xcc, 0x01, 0xcc, 0x5b, 0x01, 0xe8, 0x5d, 0xa8, 0x99, 0xae, 0xeb, 0x5f, 0x19, 0x3e, 0x71,
+	0x46, 0x8e, 0x27, 0x5f, 0x72, 0x95, 0xcf, 0x9d, 0xf2, 0x29, 0xf6, 0x0e, 0x85, 0x88, 0x20, 0x5b,
+	0xf1, 0x33, 0x16, 0xb8, 0x17, 0x62, 0x6e, 0x2e, 0x74, 0xad, 0x52, 0x4a, 0xa1, 0x38, 0xa7, 0xbf,
+	0x0f, 0x9b, 0x78, 0x1a, 0xf8, 0x37, 0x4a, 0x62, 0x45, 0xdf, 0x10, 0xb3, 0xb1, 0x58, 0x07, 0x4a,
+	0x13, 0x73, 0x6a, 0x98, 0x23, 0xd1, 0xf7, 0x59, 0x7a, 0xf0, 0xe2, 0xc4, 0x9c, 0x76, 0x47, 0x18,
+	0x7d, 0x09, 0x5b, 0x62, 0x7f, 0x8b, 0x60, 0x1b, 0x7b, 0xd4, 0x31, 0xdd, 0x50, 0xb6, 0x84, 0x1a,
+	0x0b, 0xe8, 0x9e, 0xef, 0xbb, 0x5f, 0xb1, 0xf7, 0xa7, 0xd7, 0x39, 0xe8, 0x78, 0x8e, 0x69, 0xfe,
+	0x41, 0x05, 0xb4, 0xd8, 0xb5, 0x41, 0xcf, 0x40, 0xb5, 0xb1, 0x6b, 0xce, 0x56, 0xf9, 0x68, 0x5c,
+	0x40, 0xb7, 0x4e, 0x18, 0x54, 0x17, 0x1a, 0x98, 0x2a, 0x73, 0x18, 0x27, 0xd3, 0xb5, 0x55, 0x75,
+	0x19, 0x54, 0x17, 0x1a, 0x1a, 0xbf, 0xce, 0x81, 0xca, 0x75, 0xa3, 0x77, 0xa0, 0x14, 0x60, 0x62,
+	0x61, 0x4f, 0x3c, 0x5c, 0x95, 0x57, 0xd6, 0x78, 0x0a, 0x1d, 0x42, 0xf5, 0xc2, 0x99, 0x62, 0xdb,
+	0x10, 0x67, 0xc8, 0x7a, 0x4e, 0xfd, 0x07, 0x3a, 0x70, 0x79, 0xa1, 0xbb, 0x0f, 0x5b, 0xec, 0x82,
+	0x3c, 0xe1, 0x22, 0xa9, 0x23, 0x9f, 0xad, 0xa3, 0x9e, 0x42, 0x09, 0x4d, 0x3d, 0x00, 0x69, 0xd2,
+	0xfc, 0x72, 0x97, 0xd5, 0xf5, 0x33, 0x21, 0xac, 0xa7, 0x50, 0xbd, 0x2d, 0x78, 0x38, 0xa6, 0x34,
+	0x10, 0x66, 0xf0, 0xd8, 0x6a, 0xbc, 0x52, 0x40, 0xe5, 0x7e, 0xc9, 0x70, 0xc3, 0xbb, 0x50, 0xe5,
+	0xd0, 0x90, 0x9a, 0x34, 0x0a, 0x45, 0xa5, 0x64, 0x67, 0x65, 0x93, 0x03, 0x3e, 0xc7, 0x44, 0x46,
+	0x24, 0xb0, 0x62, 0x91, 0x38, 0xa4, 0x81, 0x4d, 0xce, 0x45, 0x18, 0xa0, 0x63, 0x60, 0xde, 0xbe,
+	0x2b, 0xc4, 0x22, 0x7c, 0xf2, 0x09, 0x6f, 0xce, 0xbd, 0x89, 0x73, 0xd6, 0x00, 0xf8, 0x06, 0x22,
+	0x7d, 0x3c, 0x85, 0x5a, 0xba, 0x95, 0xcc, 0xd2, 0x91, 0x17, 0x4d, 0x86, 0x98, 0xf0, 0x73, 0x6e,
+	0xb0, 0x74, 0x24, 0xc6, 0x68, 0x1b, 0x0a, 0x9e, 0x29, 0xbf, 0xc4, 0x98, 0x5d, 0x7c, 0xd4, 0x2b,
+	0x8a, 0x02, 0xd3, 0xfc, 0x16, 0x94, 0xe4, 0x66, 0xf3, 0x8c, 0xcc, 0x34, 0x28, 0x32, 0x23, 0xf7,
+	0x5a, 0x7f, 0x7b, 0xbd, 0xa3, 0xfc, 0xe3, 0xf5, 0x8e, 0xf2, 0xea, 0xf5, 0x8e, 0xf2, 0xb3, 0x5d,
+	0x61, 0xb3, 0xe3, 0xb7, 0xcd, 0xc0, 0x69, 0xdf, 0xf2, 0x4f, 0x88, 0x61, 0x91, 0xdf, 0xfc, 0xfe,
+	0x7f, 0x02, 0x00, 0x00, 0xff, 0xff, 0x8d, 0x99, 0xb2, 0xe8, 0x28, 0x19, 0x00, 0x00,
 }
diff --git a/networking/v1alpha3/virtual_service.proto b/networking/v1alpha3/virtual_service.proto
index 946dca69e2..d299590965 100644
--- a/networking/v1alpha3/virtual_service.proto
+++ b/networking/v1alpha3/virtual_service.proto
@@ -17,6 +17,8 @@ syntax = "proto3";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
+import "networking/v1alpha3/network_scope.proto";
+
 // $title: Traffic Routing
 // $description: Configuration affecting traffic routing.
 // $location: https://istio.io/docs/reference/config/istio.networking.v1alpha3.html
@@ -175,6 +177,12 @@ message VirtualService {
   // be applied to any port that is not a HTTP or TLS port. The first rule
   // matching an incoming request is used.
   repeated TCPRoute tcp = 4;
+
+  // The visibility setting associated with this virtual service. Set to
+  // PRIVATE if this virtual service should not be exported, i.e. restrict
+  // the applicability of this virtual service to only workloads in the same
+  // namespace as the virtual service.
+  ConfigScope scope = 6;
 }
 
 // Destination indicates the network addressable service to which the
diff --git a/proto.lock b/proto.lock
index 854cce856e..78e49bcf9a 100644
--- a/proto.lock
+++ b/proto.lock
@@ -3113,6 +3113,21 @@
     {
       "protopath": "networking:/:v1alpha3:/:network_scope.proto",
       "def": {
+        "enums": [
+          {
+            "name": "ConfigScope",
+            "enum_fields": [
+              {
+                "name": "PUBLIC",
+                "integer": 0
+              },
+              {
+                "name": "PRIVATE",
+                "integer": 1
+              }
+            ]
+          }
+        ],
         "messages": [
           {
             "name": "NetworkScope",
@@ -3123,41 +3138,43 @@
                 "type": "Dependency",
                 "is_repeated": true
               }
-            ]
-          },
-          {
-            "name": "Dependency",
-            "fields": [
-              {
-                "id": 2,
-                "name": "imports",
-                "type": "Import",
-                "is_repeated": true
-              }
             ],
-            "maps": [
-              {
-                "key_type": "string",
-                "field": {
-                  "id": 1,
-                  "name": "source_workload_labels",
-                  "type": "string"
-                }
-              }
-            ]
-          },
-          {
-            "name": "Import",
-            "fields": [
+            "messages": [
               {
-                "id": 1,
-                "name": "namespace",
-                "type": "string"
+                "name": "Import",
+                "fields": [
+                  {
+                    "id": 1,
+                    "name": "namespace",
+                    "type": "string"
+                  },
+                  {
+                    "id": 2,
+                    "name": "host",
+                    "type": "string"
+                  }
+                ]
               },
               {
-                "id": 2,
-                "name": "host",
-                "type": "string"
+                "name": "Dependency",
+                "fields": [
+                  {
+                    "id": 2,
+                    "name": "imports",
+                    "type": "Import",
+                    "is_repeated": true
+                  }
+                ],
+                "maps": [
+                  {
+                    "key_type": "string",
+                    "field": {
+                      "id": 1,
+                      "name": "source_workload_labels",
+                      "type": "string"
+                    }
+                  }
+                ]
               }
             ]
           }
@@ -3236,6 +3253,11 @@
                 "name": "endpoints",
                 "type": "Endpoint",
                 "is_repeated": true
+              },
+              {
+                "id": 7,
+                "name": "scope",
+                "type": "ConfigScope"
               }
             ],
             "messages": [
@@ -3323,6 +3345,11 @@
                 "name": "tcp",
                 "type": "TCPRoute",
                 "is_repeated": true
+              },
+              {
+                "id": 6,
+                "name": "scope",
+                "type": "ConfigScope"
               }
             ]
           },
diff --git a/python/istio_api/networking/v1alpha3/network_Scope_pb2.py b/python/istio_api/networking/v1alpha3/network_Scope_pb2.py
index b2ec5be392..2fd1a36238 100644
--- a/python/istio_api/networking/v1alpha3/network_Scope_pb2.py
+++ b/python/istio_api/networking/v1alpha3/network_Scope_pb2.py
@@ -1,8 +1,9 @@
 # Generated by the protocol buffer compiler.  DO NOT EDIT!
-# source: networking/v1alpha3/network_Scope.proto
+# source: networking/v1alpha3/network_scope.proto
 
 import sys
 _b=sys.version_info[0]<3 and (lambda x:x) or (lambda x:x.encode('latin1'))
+from google.protobuf.internal import enum_type_wrapper
 from google.protobuf import descriptor as _descriptor
 from google.protobuf import message as _message
 from google.protobuf import reflection as _reflection
@@ -16,26 +17,58 @@
 
 
 DESCRIPTOR = _descriptor.FileDescriptor(
-  name='networking/v1alpha3/network_Scope.proto',
+  name='networking/v1alpha3/network_scope.proto',
   package='istio.networking.v1alpha3',
   syntax='proto3',
-  serialized_pb=_b('\n\'networking/v1alpha3/network_Scope.proto\x12\x19istio.networking.v1alpha3\"K\n\x0cNetworkScope\x12;\n\x0c\x64\x65pendencies\x18\x01 \x03(\x0b\x32%.istio.networking.v1alpha3.Dependency\"\xde\x01\n\nDependency\x12_\n\x16source_workload_labels\x18\x01 \x03(\x0b\x32?.istio.networking.v1alpha3.Dependency.SourceWorkloadLabelsEntry\x12\x32\n\x07imports\x18\x02 \x03(\x0b\x32!.istio.networking.v1alpha3.Import\x1a;\n\x19SourceWorkloadLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\")\n\x06Import\x12\x11\n\tnamespace\x18\x01 \x01(\t\x12\x0c\n\x04host\x18\x02 \x01(\tB\"Z istio.io/api/networking/v1alpha3b\x06proto3')
+  serialized_pb=_b('\n\'networking/v1alpha3/network_scope.proto\x12\x19istio.networking.v1alpha3\"\xfe\x02\n\x0cNetworkScope\x12H\n\x0c\x64\x65pendencies\x18\x01 \x03(\x0b\x32\x32.istio.networking.v1alpha3.NetworkScope.Dependency\x1a)\n\x06Import\x12\x11\n\tnamespace\x18\x01 \x01(\t\x12\x0c\n\x04host\x18\x02 \x01(\t\x1a\xf8\x01\n\nDependency\x12l\n\x16source_workload_labels\x18\x01 \x03(\x0b\x32L.istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry\x12?\n\x07imports\x18\x02 \x03(\x0b\x32..istio.networking.v1alpha3.NetworkScope.Import\x1a;\n\x19SourceWorkloadLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01*&\n\x0b\x43onfigScope\x12\n\n\x06PUBLIC\x10\x00\x12\x0b\n\x07PRIVATE\x10\x01\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
 )
 
+_CONFIGSCOPE = _descriptor.EnumDescriptor(
+  name='ConfigScope',
+  full_name='istio.networking.v1alpha3.ConfigScope',
+  filename=None,
+  file=DESCRIPTOR,
+  values=[
+    _descriptor.EnumValueDescriptor(
+      name='PUBLIC', index=0, number=0,
+      options=None,
+      type=None),
+    _descriptor.EnumValueDescriptor(
+      name='PRIVATE', index=1, number=1,
+      options=None,
+      type=None),
+  ],
+  containing_type=None,
+  options=None,
+  serialized_start=455,
+  serialized_end=493,
+)
+_sym_db.RegisterEnumDescriptor(_CONFIGSCOPE)
 
+ConfigScope = enum_type_wrapper.EnumTypeWrapper(_CONFIGSCOPE)
+PUBLIC = 0
+PRIVATE = 1
 
 
-_NETWORKSCOPE = _descriptor.Descriptor(
-  name='NetworkScope',
-  full_name='istio.networking.v1alpha3.NetworkScope',
+
+_NETWORKSCOPE_IMPORT = _descriptor.Descriptor(
+  name='Import',
+  full_name='istio.networking.v1alpha3.NetworkScope.Import',
   filename=None,
   file=DESCRIPTOR,
   containing_type=None,
   fields=[
     _descriptor.FieldDescriptor(
-      name='dependencies', full_name='istio.networking.v1alpha3.NetworkScope.dependencies', index=0,
-      number=1, type=11, cpp_type=10, label=3,
-      has_default_value=False, default_value=[],
+      name='namespace', full_name='istio.networking.v1alpha3.NetworkScope.Import.namespace', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='host', full_name='istio.networking.v1alpha3.NetworkScope.Import.host', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
@@ -51,27 +84,26 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=70,
-  serialized_end=145,
+  serialized_start=161,
+  serialized_end=202,
 )
 
-
-_DEPENDENCY_SOURCEWORKLOADLABELSENTRY = _descriptor.Descriptor(
+_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY = _descriptor.Descriptor(
   name='SourceWorkloadLabelsEntry',
-  full_name='istio.networking.v1alpha3.Dependency.SourceWorkloadLabelsEntry',
+  full_name='istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry',
   filename=None,
   file=DESCRIPTOR,
   containing_type=None,
   fields=[
     _descriptor.FieldDescriptor(
-      name='key', full_name='istio.networking.v1alpha3.Dependency.SourceWorkloadLabelsEntry.key', index=0,
+      name='key', full_name='istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry.key', index=0,
       number=1, type=9, cpp_type=9, label=1,
       has_default_value=False, default_value=_b("").decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='value', full_name='istio.networking.v1alpha3.Dependency.SourceWorkloadLabelsEntry.value', index=1,
+      name='value', full_name='istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry.value', index=1,
       number=2, type=9, cpp_type=9, label=1,
       has_default_value=False, default_value=_b("").decode('utf-8'),
       message_type=None, enum_type=None, containing_type=None,
@@ -89,26 +121,26 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=311,
-  serialized_end=370,
+  serialized_start=394,
+  serialized_end=453,
 )
 
-_DEPENDENCY = _descriptor.Descriptor(
+_NETWORKSCOPE_DEPENDENCY = _descriptor.Descriptor(
   name='Dependency',
-  full_name='istio.networking.v1alpha3.Dependency',
+  full_name='istio.networking.v1alpha3.NetworkScope.Dependency',
   filename=None,
   file=DESCRIPTOR,
   containing_type=None,
   fields=[
     _descriptor.FieldDescriptor(
-      name='source_workload_labels', full_name='istio.networking.v1alpha3.Dependency.source_workload_labels', index=0,
+      name='source_workload_labels', full_name='istio.networking.v1alpha3.NetworkScope.Dependency.source_workload_labels', index=0,
       number=1, type=11, cpp_type=10, label=3,
       has_default_value=False, default_value=[],
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='imports', full_name='istio.networking.v1alpha3.Dependency.imports', index=1,
+      name='imports', full_name='istio.networking.v1alpha3.NetworkScope.Dependency.imports', index=1,
       number=2, type=11, cpp_type=10, label=3,
       has_default_value=False, default_value=[],
       message_type=None, enum_type=None, containing_type=None,
@@ -117,7 +149,7 @@
   ],
   extensions=[
   ],
-  nested_types=[_DEPENDENCY_SOURCEWORKLOADLABELSENTRY, ],
+  nested_types=[_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY, ],
   enum_types=[
   ],
   options=None,
@@ -126,36 +158,28 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=148,
-  serialized_end=370,
+  serialized_start=205,
+  serialized_end=453,
 )
 
-
-_IMPORT = _descriptor.Descriptor(
-  name='Import',
-  full_name='istio.networking.v1alpha3.Import',
+_NETWORKSCOPE = _descriptor.Descriptor(
+  name='NetworkScope',
+  full_name='istio.networking.v1alpha3.NetworkScope',
   filename=None,
   file=DESCRIPTOR,
   containing_type=None,
   fields=[
     _descriptor.FieldDescriptor(
-      name='namespace', full_name='istio.networking.v1alpha3.Import.namespace', index=0,
-      number=1, type=9, cpp_type=9, label=1,
-      has_default_value=False, default_value=_b("").decode('utf-8'),
-      message_type=None, enum_type=None, containing_type=None,
-      is_extension=False, extension_scope=None,
-      options=None, file=DESCRIPTOR),
-    _descriptor.FieldDescriptor(
-      name='host', full_name='istio.networking.v1alpha3.Import.host', index=1,
-      number=2, type=9, cpp_type=9, label=1,
-      has_default_value=False, default_value=_b("").decode('utf-8'),
+      name='dependencies', full_name='istio.networking.v1alpha3.NetworkScope.dependencies', index=0,
+      number=1, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
   ],
   extensions=[
   ],
-  nested_types=[],
+  nested_types=[_NETWORKSCOPE_IMPORT, _NETWORKSCOPE_DEPENDENCY, ],
   enum_types=[
   ],
   options=None,
@@ -164,51 +188,54 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=372,
-  serialized_end=413,
+  serialized_start=71,
+  serialized_end=453,
 )
 
-_NETWORKSCOPE.fields_by_name['dependencies'].message_type = _DEPENDENCY
-_DEPENDENCY_SOURCEWORKLOADLABELSENTRY.containing_type = _DEPENDENCY
-_DEPENDENCY.fields_by_name['source_workload_labels'].message_type = _DEPENDENCY_SOURCEWORKLOADLABELSENTRY
-_DEPENDENCY.fields_by_name['imports'].message_type = _IMPORT
+_NETWORKSCOPE_IMPORT.containing_type = _NETWORKSCOPE
+_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY.containing_type = _NETWORKSCOPE_DEPENDENCY
+_NETWORKSCOPE_DEPENDENCY.fields_by_name['source_workload_labels'].message_type = _NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY
+_NETWORKSCOPE_DEPENDENCY.fields_by_name['imports'].message_type = _NETWORKSCOPE_IMPORT
+_NETWORKSCOPE_DEPENDENCY.containing_type = _NETWORKSCOPE
+_NETWORKSCOPE.fields_by_name['dependencies'].message_type = _NETWORKSCOPE_DEPENDENCY
 DESCRIPTOR.message_types_by_name['NetworkScope'] = _NETWORKSCOPE
-DESCRIPTOR.message_types_by_name['Dependency'] = _DEPENDENCY
-DESCRIPTOR.message_types_by_name['Import'] = _IMPORT
+DESCRIPTOR.enum_types_by_name['ConfigScope'] = _CONFIGSCOPE
 _sym_db.RegisterFileDescriptor(DESCRIPTOR)
 
 NetworkScope = _reflection.GeneratedProtocolMessageType('NetworkScope', (_message.Message,), dict(
-  DESCRIPTOR = _NETWORKSCOPE,
-  __module__ = 'networking.v1alpha3.network_Scope_pb2'
-  # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.NetworkScope)
-  ))
-_sym_db.RegisterMessage(NetworkScope)
-
-Dependency = _reflection.GeneratedProtocolMessageType('Dependency', (_message.Message,), dict(
 
-  SourceWorkloadLabelsEntry = _reflection.GeneratedProtocolMessageType('SourceWorkloadLabelsEntry', (_message.Message,), dict(
-    DESCRIPTOR = _DEPENDENCY_SOURCEWORKLOADLABELSENTRY,
-    __module__ = 'networking.v1alpha3.network_Scope_pb2'
-    # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.Dependency.SourceWorkloadLabelsEntry)
+  Import = _reflection.GeneratedProtocolMessageType('Import', (_message.Message,), dict(
+    DESCRIPTOR = _NETWORKSCOPE_IMPORT,
+    __module__ = 'networking.v1alpha3.network_scope_pb2'
+    # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.NetworkScope.Import)
     ))
   ,
-  DESCRIPTOR = _DEPENDENCY,
-  __module__ = 'networking.v1alpha3.network_Scope_pb2'
-  # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.Dependency)
-  ))
-_sym_db.RegisterMessage(Dependency)
-_sym_db.RegisterMessage(Dependency.SourceWorkloadLabelsEntry)
 
-Import = _reflection.GeneratedProtocolMessageType('Import', (_message.Message,), dict(
-  DESCRIPTOR = _IMPORT,
-  __module__ = 'networking.v1alpha3.network_Scope_pb2'
-  # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.Import)
+  Dependency = _reflection.GeneratedProtocolMessageType('Dependency', (_message.Message,), dict(
+
+    SourceWorkloadLabelsEntry = _reflection.GeneratedProtocolMessageType('SourceWorkloadLabelsEntry', (_message.Message,), dict(
+      DESCRIPTOR = _NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY,
+      __module__ = 'networking.v1alpha3.network_scope_pb2'
+      # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry)
+      ))
+    ,
+    DESCRIPTOR = _NETWORKSCOPE_DEPENDENCY,
+    __module__ = 'networking.v1alpha3.network_scope_pb2'
+    # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.NetworkScope.Dependency)
+    ))
+  ,
+  DESCRIPTOR = _NETWORKSCOPE,
+  __module__ = 'networking.v1alpha3.network_scope_pb2'
+  # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.NetworkScope)
   ))
-_sym_db.RegisterMessage(Import)
+_sym_db.RegisterMessage(NetworkScope)
+_sym_db.RegisterMessage(NetworkScope.Import)
+_sym_db.RegisterMessage(NetworkScope.Dependency)
+_sym_db.RegisterMessage(NetworkScope.Dependency.SourceWorkloadLabelsEntry)
 
 
 DESCRIPTOR.has_options = True
 DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z istio.io/api/networking/v1alpha3'))
-_DEPENDENCY_SOURCEWORKLOADLABELSENTRY.has_options = True
-_DEPENDENCY_SOURCEWORKLOADLABELSENTRY._options = _descriptor._ParseOptions(descriptor_pb2.MessageOptions(), _b('8\001'))
+_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY.has_options = True
+_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY._options = _descriptor._ParseOptions(descriptor_pb2.MessageOptions(), _b('8\001'))
 # @@protoc_insertion_point(module_scope)
diff --git a/python/istio_api/networking/v1alpha3/service_entry_pb2.py b/python/istio_api/networking/v1alpha3/service_entry_pb2.py
index 09d81c603a..3e3d1001bc 100644
--- a/python/istio_api/networking/v1alpha3/service_entry_pb2.py
+++ b/python/istio_api/networking/v1alpha3/service_entry_pb2.py
@@ -14,15 +14,16 @@
 
 
 from networking.v1alpha3 import gateway_pb2 as networking_dot_v1alpha3_dot_gateway__pb2
+from networking.v1alpha3 import network_scope_pb2 as networking_dot_v1alpha3_dot_network__scope__pb2
 
 
 DESCRIPTOR = _descriptor.FileDescriptor(
   name='networking/v1alpha3/service_entry.proto',
   package='istio.networking.v1alpha3',
   syntax='proto3',
-  serialized_pb=_b('\n\'networking/v1alpha3/service_entry.proto\x12\x19istio.networking.v1alpha3\x1a!networking/v1alpha3/gateway.proto\"\xd8\x05\n\x0cServiceEntry\x12\r\n\x05hosts\x18\x01 \x03(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12.\n\x05ports\x18\x03 \x03(\x0b\x32\x1f.istio.networking.v1alpha3.Port\x12\x42\n\x08location\x18\x04 \x01(\x0e\x32\x30.istio.networking.v1alpha3.ServiceEntry.Location\x12\x46\n\nresolution\x18\x05 \x01(\x0e\x32\x32.istio.networking.v1alpha3.ServiceEntry.Resolution\x12\x43\n\tendpoints\x18\x06 \x03(\x0b\x32\x30.istio.networking.v1alpha3.ServiceEntry.Endpoint\x1a\xc5\x02\n\x08\x45ndpoint\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12J\n\x05ports\x18\x02 \x03(\x0b\x32;.istio.networking.v1alpha3.ServiceEntry.Endpoint.PortsEntry\x12L\n\x06labels\x18\x03 \x03(\x0b\x32<.istio.networking.v1alpha3.ServiceEntry.Endpoint.LabelsEntry\x12\x0f\n\x07network\x18\x04 \x01(\t\x12\x10\n\x08locality\x18\x05 \x01(\t\x12\x0e\n\x06weight\x18\x06 \x01(\r\x1a,\n\nPortsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\r:\x02\x38\x01\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"0\n\x08Location\x12\x11\n\rMESH_EXTERNAL\x10\x00\x12\x11\n\rMESH_INTERNAL\x10\x01\"+\n\nResolution\x12\x08\n\x04NONE\x10\x00\x12\n\n\x06STATIC\x10\x01\x12\x07\n\x03\x44NS\x10\x02\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
+  serialized_pb=_b('\n\'networking/v1alpha3/service_entry.proto\x12\x19istio.networking.v1alpha3\x1a!networking/v1alpha3/gateway.proto\x1a\'networking/v1alpha3/network_scope.proto\"\x8f\x06\n\x0cServiceEntry\x12\r\n\x05hosts\x18\x01 \x03(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12.\n\x05ports\x18\x03 \x03(\x0b\x32\x1f.istio.networking.v1alpha3.Port\x12\x42\n\x08location\x18\x04 \x01(\x0e\x32\x30.istio.networking.v1alpha3.ServiceEntry.Location\x12\x46\n\nresolution\x18\x05 \x01(\x0e\x32\x32.istio.networking.v1alpha3.ServiceEntry.Resolution\x12\x43\n\tendpoints\x18\x06 \x03(\x0b\x32\x30.istio.networking.v1alpha3.ServiceEntry.Endpoint\x12\x35\n\x05scope\x18\x07 \x01(\x0e\x32&.istio.networking.v1alpha3.ConfigScope\x1a\xc5\x02\n\x08\x45ndpoint\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12J\n\x05ports\x18\x02 \x03(\x0b\x32;.istio.networking.v1alpha3.ServiceEntry.Endpoint.PortsEntry\x12L\n\x06labels\x18\x03 \x03(\x0b\x32<.istio.networking.v1alpha3.ServiceEntry.Endpoint.LabelsEntry\x12\x0f\n\x07network\x18\x04 \x01(\t\x12\x10\n\x08locality\x18\x05 \x01(\t\x12\x0e\n\x06weight\x18\x06 \x01(\r\x1a,\n\nPortsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\r:\x02\x38\x01\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"0\n\x08Location\x12\x11\n\rMESH_EXTERNAL\x10\x00\x12\x11\n\rMESH_INTERNAL\x10\x01\"+\n\nResolution\x12\x08\n\x04NONE\x10\x00\x12\n\n\x06STATIC\x10\x01\x12\x07\n\x03\x44NS\x10\x02\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
   ,
-  dependencies=[networking_dot_v1alpha3_dot_gateway__pb2.DESCRIPTOR,])
+  dependencies=[networking_dot_v1alpha3_dot_gateway__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_network__scope__pb2.DESCRIPTOR,])
 
 
 
@@ -43,8 +44,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=741,
-  serialized_end=789,
+  serialized_start=837,
+  serialized_end=885,
 )
 _sym_db.RegisterEnumDescriptor(_SERVICEENTRY_LOCATION)
 
@@ -69,8 +70,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=791,
-  serialized_end=834,
+  serialized_start=887,
+  serialized_end=930,
 )
 _sym_db.RegisterEnumDescriptor(_SERVICEENTRY_RESOLUTION)
 
@@ -108,8 +109,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=648,
-  serialized_end=692,
+  serialized_start=744,
+  serialized_end=788,
 )
 
 _SERVICEENTRY_ENDPOINT_LABELSENTRY = _descriptor.Descriptor(
@@ -145,8 +146,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=694,
-  serialized_end=739,
+  serialized_start=790,
+  serialized_end=835,
 )
 
 _SERVICEENTRY_ENDPOINT = _descriptor.Descriptor(
@@ -210,8 +211,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=414,
-  serialized_end=739,
+  serialized_start=510,
+  serialized_end=835,
 )
 
 _SERVICEENTRY = _descriptor.Descriptor(
@@ -263,6 +264,13 @@
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='scope', full_name='istio.networking.v1alpha3.ServiceEntry.scope', index=6,
+      number=7, type=14, cpp_type=8, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
   ],
   extensions=[
   ],
@@ -277,8 +285,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=106,
-  serialized_end=834,
+  serialized_start=147,
+  serialized_end=930,
 )
 
 _SERVICEENTRY_ENDPOINT_PORTSENTRY.containing_type = _SERVICEENTRY_ENDPOINT
@@ -290,6 +298,7 @@
 _SERVICEENTRY.fields_by_name['location'].enum_type = _SERVICEENTRY_LOCATION
 _SERVICEENTRY.fields_by_name['resolution'].enum_type = _SERVICEENTRY_RESOLUTION
 _SERVICEENTRY.fields_by_name['endpoints'].message_type = _SERVICEENTRY_ENDPOINT
+_SERVICEENTRY.fields_by_name['scope'].enum_type = networking_dot_v1alpha3_dot_network__scope__pb2._CONFIGSCOPE
 _SERVICEENTRY_LOCATION.containing_type = _SERVICEENTRY
 _SERVICEENTRY_RESOLUTION.containing_type = _SERVICEENTRY
 DESCRIPTOR.message_types_by_name['ServiceEntry'] = _SERVICEENTRY
diff --git a/python/istio_api/networking/v1alpha3/virtual_service_pb2.py b/python/istio_api/networking/v1alpha3/virtual_service_pb2.py
index 69497908ab..c61fc09a42 100644
--- a/python/istio_api/networking/v1alpha3/virtual_service_pb2.py
+++ b/python/istio_api/networking/v1alpha3/virtual_service_pb2.py
@@ -15,15 +15,16 @@
 
 from google.protobuf import duration_pb2 as google_dot_protobuf_dot_duration__pb2
 from google.protobuf import wrappers_pb2 as google_dot_protobuf_dot_wrappers__pb2
+from networking.v1alpha3 import network_scope_pb2 as networking_dot_v1alpha3_dot_network__scope__pb2
 
 
 DESCRIPTOR = _descriptor.FileDescriptor(
   name='networking/v1alpha3/virtual_service.proto',
   package='istio.networking.v1alpha3',
   syntax='proto3',
-  serialized_pb=_b('\n)networking/v1alpha3/virtual_service.proto\x12\x19istio.networking.v1alpha3\x1a\x1egoogle/protobuf/duration.proto\x1a\x1egoogle/protobuf/wrappers.proto\"\xc9\x01\n\x0eVirtualService\x12\r\n\x05hosts\x18\x01 \x03(\t\x12\x10\n\x08gateways\x18\x02 \x03(\t\x12\x32\n\x04http\x18\x03 \x03(\x0b\x32$.istio.networking.v1alpha3.HTTPRoute\x12\x30\n\x03tls\x18\x05 \x03(\x0b\x32#.istio.networking.v1alpha3.TLSRoute\x12\x30\n\x03tcp\x18\x04 \x03(\x0b\x32#.istio.networking.v1alpha3.TCPRoute\"b\n\x0b\x44\x65stination\x12\x0c\n\x04host\x18\x01 \x01(\t\x12\x0e\n\x06subset\x18\x02 \x01(\t\x12\x35\n\x04port\x18\x03 \x01(\x0b\x32\'.istio.networking.v1alpha3.PortSelector\"\xf9\x08\n\tHTTPRoute\x12:\n\x05match\x18\x01 \x03(\x0b\x32+.istio.networking.v1alpha3.HTTPMatchRequest\x12>\n\x05route\x18\x02 \x03(\x0b\x32/.istio.networking.v1alpha3.HTTPRouteDestination\x12\x39\n\x08redirect\x18\x03 \x01(\x0b\x32\'.istio.networking.v1alpha3.HTTPRedirect\x12\x37\n\x07rewrite\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.HTTPRewrite\x12\x19\n\x11websocket_upgrade\x18\x05 \x01(\x08\x12*\n\x07timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x07retries\x18\x07 \x01(\x0b\x32$.istio.networking.v1alpha3.HTTPRetry\x12<\n\x05\x66\x61ult\x18\x08 \x01(\x0b\x32-.istio.networking.v1alpha3.HTTPFaultInjection\x12\x36\n\x06mirror\x18\t \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12:\n\x0b\x63ors_policy\x18\n \x01(\x0b\x32%.istio.networking.v1alpha3.CorsPolicy\x12S\n\x0e\x61ppend_headers\x18\x0b \x03(\x0b\x32\x37.istio.networking.v1alpha3.HTTPRoute.AppendHeadersEntryB\x02\x18\x01\x12#\n\x17remove_response_headers\x18\x0c \x03(\tB\x02\x18\x01\x12\x64\n\x17\x61ppend_response_headers\x18\r \x03(\x0b\x32?.istio.networking.v1alpha3.HTTPRoute.AppendResponseHeadersEntryB\x02\x18\x01\x12\"\n\x16remove_request_headers\x18\x0e \x03(\tB\x02\x18\x01\x12\x62\n\x16\x61ppend_request_headers\x18\x0f \x03(\x0b\x32>.istio.networking.v1alpha3.HTTPRoute.AppendRequestHeadersEntryB\x02\x18\x01\x12\x33\n\x07headers\x18\x10 \x01(\x0b\x32\".istio.networking.v1alpha3.Headers\x1a\x34\n\x12\x41ppendHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a<\n\x1a\x41ppendResponseHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a;\n\x19\x41ppendRequestHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xa9\x03\n\x07Headers\x12\x44\n\x07request\x18\x01 \x01(\x0b\x32\x33.istio.networking.v1alpha3.Headers.HeaderOperations\x12\x45\n\x08response\x18\x02 \x01(\x0b\x32\x33.istio.networking.v1alpha3.Headers.HeaderOperations\x1a\x90\x02\n\x10HeaderOperations\x12I\n\x03set\x18\x01 \x03(\x0b\x32<.istio.networking.v1alpha3.Headers.HeaderOperations.SetEntry\x12I\n\x03\x61\x64\x64\x18\x02 \x03(\x0b\x32<.istio.networking.v1alpha3.Headers.HeaderOperations.AddEntry\x12\x0e\n\x06remove\x18\x03 \x03(\t\x1a*\n\x08SetEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a*\n\x08\x41\x64\x64\x45ntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x84\x01\n\x08TLSRoute\x12<\n\x05match\x18\x01 \x03(\x0b\x32-.istio.networking.v1alpha3.TLSMatchAttributes\x12:\n\x05route\x18\x02 \x03(\x0b\x32+.istio.networking.v1alpha3.RouteDestination\"\x83\x01\n\x08TCPRoute\x12;\n\x05match\x18\x01 \x03(\x0b\x32,.istio.networking.v1alpha3.L4MatchAttributes\x12:\n\x05route\x18\x02 \x03(\x0b\x32+.istio.networking.v1alpha3.RouteDestination\"\xc0\x04\n\x10HTTPMatchRequest\x12\x33\n\x03uri\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x36\n\x06scheme\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x36\n\x06method\x18\x03 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x39\n\tauthority\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12I\n\x07headers\x18\x05 \x03(\x0b\x32\x38.istio.networking.v1alpha3.HTTPMatchRequest.HeadersEntry\x12\x0c\n\x04port\x18\x06 \x01(\r\x12T\n\rsource_labels\x18\x07 \x03(\x0b\x32=.istio.networking.v1alpha3.HTTPMatchRequest.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x08 \x03(\t\x1aV\n\x0cHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\x35\n\x05value\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch:\x02\x38\x01\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xbc\x04\n\x14HTTPRouteDestination\x12;\n\x0b\x64\x65stination\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12\x0e\n\x06weight\x18\x02 \x01(\x05\x12#\n\x17remove_response_headers\x18\x03 \x03(\tB\x02\x18\x01\x12o\n\x17\x61ppend_response_headers\x18\x04 \x03(\x0b\x32J.istio.networking.v1alpha3.HTTPRouteDestination.AppendResponseHeadersEntryB\x02\x18\x01\x12\"\n\x16remove_request_headers\x18\x05 \x03(\tB\x02\x18\x01\x12m\n\x16\x61ppend_request_headers\x18\x06 \x03(\x0b\x32I.istio.networking.v1alpha3.HTTPRouteDestination.AppendRequestHeadersEntryB\x02\x18\x01\x12\x33\n\x07headers\x18\x07 \x01(\x0b\x32\".istio.networking.v1alpha3.Headers\x1a<\n\x1a\x41ppendResponseHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a;\n\x19\x41ppendRequestHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"_\n\x10RouteDestination\x12;\n\x0b\x64\x65stination\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12\x0e\n\x06weight\x18\x02 \x01(\x05\"\xf3\x01\n\x11L4MatchAttributes\x12\x1b\n\x13\x64\x65stination_subnets\x18\x01 \x03(\t\x12\x0c\n\x04port\x18\x02 \x01(\r\x12\x15\n\rsource_subnet\x18\x03 \x01(\t\x12U\n\rsource_labels\x18\x04 \x03(\x0b\x32>.istio.networking.v1alpha3.L4MatchAttributes.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x05 \x03(\t\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x88\x02\n\x12TLSMatchAttributes\x12\x11\n\tsni_hosts\x18\x01 \x03(\t\x12\x1b\n\x13\x64\x65stination_subnets\x18\x02 \x03(\t\x12\x0c\n\x04port\x18\x03 \x01(\r\x12\x15\n\rsource_subnet\x18\x04 \x01(\t\x12V\n\rsource_labels\x18\x05 \x03(\x0b\x32?.istio.networking.v1alpha3.TLSMatchAttributes.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x06 \x03(\t\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\".\n\x0cHTTPRedirect\x12\x0b\n\x03uri\x18\x01 \x01(\t\x12\x11\n\tauthority\x18\x02 \x01(\t\"-\n\x0bHTTPRewrite\x12\x0b\n\x03uri\x18\x01 \x01(\t\x12\x11\n\tauthority\x18\x02 \x01(\t\"O\n\x0bStringMatch\x12\x0f\n\x05\x65xact\x18\x01 \x01(\tH\x00\x12\x10\n\x06prefix\x18\x02 \x01(\tH\x00\x12\x0f\n\x05regex\x18\x03 \x01(\tH\x00\x42\x0c\n\nmatch_type\"c\n\tHTTPRetry\x12\x10\n\x08\x61ttempts\x18\x01 \x01(\x05\x12\x32\n\x0fper_try_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x10\n\x08retry_on\x18\x03 \x01(\t\"\xcb\x01\n\nCorsPolicy\x12\x14\n\x0c\x61llow_origin\x18\x01 \x03(\t\x12\x15\n\rallow_methods\x18\x02 \x03(\t\x12\x15\n\rallow_headers\x18\x03 \x03(\t\x12\x16\n\x0e\x65xpose_headers\x18\x04 \x03(\t\x12*\n\x07max_age\x18\x05 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x11\x61llow_credentials\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.BoolValue\"\x9a\x04\n\x12HTTPFaultInjection\x12\x42\n\x05\x64\x65lay\x18\x01 \x01(\x0b\x32\x33.istio.networking.v1alpha3.HTTPFaultInjection.Delay\x12\x42\n\x05\x61\x62ort\x18\x02 \x01(\x0b\x32\x33.istio.networking.v1alpha3.HTTPFaultInjection.Abort\x1a\xd1\x01\n\x05\x44\x65lay\x12\x13\n\x07percent\x18\x01 \x01(\x05\x42\x02\x18\x01\x12\x30\n\x0b\x66ixed_delay\x18\x02 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12\x36\n\x11\x65xponential_delay\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12\x36\n\npercentage\x18\x05 \x01(\x0b\x32\".istio.networking.v1alpha3.PercentB\x11\n\x0fhttp_delay_type\x1a\xa7\x01\n\x05\x41\x62ort\x12\x13\n\x07percent\x18\x01 \x01(\x05\x42\x02\x18\x01\x12\x15\n\x0bhttp_status\x18\x02 \x01(\x05H\x00\x12\x15\n\x0bgrpc_status\x18\x03 \x01(\tH\x00\x12\x15\n\x0bhttp2_error\x18\x04 \x01(\tH\x00\x12\x36\n\npercentage\x18\x05 \x01(\x0b\x32\".istio.networking.v1alpha3.PercentB\x0c\n\nerror_type\"8\n\x0cPortSelector\x12\x10\n\x06number\x18\x01 \x01(\rH\x00\x12\x0e\n\x04name\x18\x02 \x01(\tH\x00\x42\x06\n\x04port\"\x18\n\x07Percent\x12\r\n\x05value\x18\x01 \x01(\x01\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
+  serialized_pb=_b('\n)networking/v1alpha3/virtual_service.proto\x12\x19istio.networking.v1alpha3\x1a\x1egoogle/protobuf/duration.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a\'networking/v1alpha3/network_scope.proto\"\x80\x02\n\x0eVirtualService\x12\r\n\x05hosts\x18\x01 \x03(\t\x12\x10\n\x08gateways\x18\x02 \x03(\t\x12\x32\n\x04http\x18\x03 \x03(\x0b\x32$.istio.networking.v1alpha3.HTTPRoute\x12\x30\n\x03tls\x18\x05 \x03(\x0b\x32#.istio.networking.v1alpha3.TLSRoute\x12\x30\n\x03tcp\x18\x04 \x03(\x0b\x32#.istio.networking.v1alpha3.TCPRoute\x12\x35\n\x05scope\x18\x06 \x01(\x0e\x32&.istio.networking.v1alpha3.ConfigScope\"b\n\x0b\x44\x65stination\x12\x0c\n\x04host\x18\x01 \x01(\t\x12\x0e\n\x06subset\x18\x02 \x01(\t\x12\x35\n\x04port\x18\x03 \x01(\x0b\x32\'.istio.networking.v1alpha3.PortSelector\"\xf9\x08\n\tHTTPRoute\x12:\n\x05match\x18\x01 \x03(\x0b\x32+.istio.networking.v1alpha3.HTTPMatchRequest\x12>\n\x05route\x18\x02 \x03(\x0b\x32/.istio.networking.v1alpha3.HTTPRouteDestination\x12\x39\n\x08redirect\x18\x03 \x01(\x0b\x32\'.istio.networking.v1alpha3.HTTPRedirect\x12\x37\n\x07rewrite\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.HTTPRewrite\x12\x19\n\x11websocket_upgrade\x18\x05 \x01(\x08\x12*\n\x07timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x07retries\x18\x07 \x01(\x0b\x32$.istio.networking.v1alpha3.HTTPRetry\x12<\n\x05\x66\x61ult\x18\x08 \x01(\x0b\x32-.istio.networking.v1alpha3.HTTPFaultInjection\x12\x36\n\x06mirror\x18\t \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12:\n\x0b\x63ors_policy\x18\n \x01(\x0b\x32%.istio.networking.v1alpha3.CorsPolicy\x12S\n\x0e\x61ppend_headers\x18\x0b \x03(\x0b\x32\x37.istio.networking.v1alpha3.HTTPRoute.AppendHeadersEntryB\x02\x18\x01\x12#\n\x17remove_response_headers\x18\x0c \x03(\tB\x02\x18\x01\x12\x64\n\x17\x61ppend_response_headers\x18\r \x03(\x0b\x32?.istio.networking.v1alpha3.HTTPRoute.AppendResponseHeadersEntryB\x02\x18\x01\x12\"\n\x16remove_request_headers\x18\x0e \x03(\tB\x02\x18\x01\x12\x62\n\x16\x61ppend_request_headers\x18\x0f \x03(\x0b\x32>.istio.networking.v1alpha3.HTTPRoute.AppendRequestHeadersEntryB\x02\x18\x01\x12\x33\n\x07headers\x18\x10 \x01(\x0b\x32\".istio.networking.v1alpha3.Headers\x1a\x34\n\x12\x41ppendHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a<\n\x1a\x41ppendResponseHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a;\n\x19\x41ppendRequestHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xa9\x03\n\x07Headers\x12\x44\n\x07request\x18\x01 \x01(\x0b\x32\x33.istio.networking.v1alpha3.Headers.HeaderOperations\x12\x45\n\x08response\x18\x02 \x01(\x0b\x32\x33.istio.networking.v1alpha3.Headers.HeaderOperations\x1a\x90\x02\n\x10HeaderOperations\x12I\n\x03set\x18\x01 \x03(\x0b\x32<.istio.networking.v1alpha3.Headers.HeaderOperations.SetEntry\x12I\n\x03\x61\x64\x64\x18\x02 \x03(\x0b\x32<.istio.networking.v1alpha3.Headers.HeaderOperations.AddEntry\x12\x0e\n\x06remove\x18\x03 \x03(\t\x1a*\n\x08SetEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a*\n\x08\x41\x64\x64\x45ntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x84\x01\n\x08TLSRoute\x12<\n\x05match\x18\x01 \x03(\x0b\x32-.istio.networking.v1alpha3.TLSMatchAttributes\x12:\n\x05route\x18\x02 \x03(\x0b\x32+.istio.networking.v1alpha3.RouteDestination\"\x83\x01\n\x08TCPRoute\x12;\n\x05match\x18\x01 \x03(\x0b\x32,.istio.networking.v1alpha3.L4MatchAttributes\x12:\n\x05route\x18\x02 \x03(\x0b\x32+.istio.networking.v1alpha3.RouteDestination\"\xc0\x04\n\x10HTTPMatchRequest\x12\x33\n\x03uri\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x36\n\x06scheme\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x36\n\x06method\x18\x03 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x39\n\tauthority\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12I\n\x07headers\x18\x05 \x03(\x0b\x32\x38.istio.networking.v1alpha3.HTTPMatchRequest.HeadersEntry\x12\x0c\n\x04port\x18\x06 \x01(\r\x12T\n\rsource_labels\x18\x07 \x03(\x0b\x32=.istio.networking.v1alpha3.HTTPMatchRequest.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x08 \x03(\t\x1aV\n\x0cHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\x35\n\x05value\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch:\x02\x38\x01\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xbc\x04\n\x14HTTPRouteDestination\x12;\n\x0b\x64\x65stination\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12\x0e\n\x06weight\x18\x02 \x01(\x05\x12#\n\x17remove_response_headers\x18\x03 \x03(\tB\x02\x18\x01\x12o\n\x17\x61ppend_response_headers\x18\x04 \x03(\x0b\x32J.istio.networking.v1alpha3.HTTPRouteDestination.AppendResponseHeadersEntryB\x02\x18\x01\x12\"\n\x16remove_request_headers\x18\x05 \x03(\tB\x02\x18\x01\x12m\n\x16\x61ppend_request_headers\x18\x06 \x03(\x0b\x32I.istio.networking.v1alpha3.HTTPRouteDestination.AppendRequestHeadersEntryB\x02\x18\x01\x12\x33\n\x07headers\x18\x07 \x01(\x0b\x32\".istio.networking.v1alpha3.Headers\x1a<\n\x1a\x41ppendResponseHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a;\n\x19\x41ppendRequestHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"_\n\x10RouteDestination\x12;\n\x0b\x64\x65stination\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12\x0e\n\x06weight\x18\x02 \x01(\x05\"\xf3\x01\n\x11L4MatchAttributes\x12\x1b\n\x13\x64\x65stination_subnets\x18\x01 \x03(\t\x12\x0c\n\x04port\x18\x02 \x01(\r\x12\x15\n\rsource_subnet\x18\x03 \x01(\t\x12U\n\rsource_labels\x18\x04 \x03(\x0b\x32>.istio.networking.v1alpha3.L4MatchAttributes.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x05 \x03(\t\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x88\x02\n\x12TLSMatchAttributes\x12\x11\n\tsni_hosts\x18\x01 \x03(\t\x12\x1b\n\x13\x64\x65stination_subnets\x18\x02 \x03(\t\x12\x0c\n\x04port\x18\x03 \x01(\r\x12\x15\n\rsource_subnet\x18\x04 \x01(\t\x12V\n\rsource_labels\x18\x05 \x03(\x0b\x32?.istio.networking.v1alpha3.TLSMatchAttributes.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x06 \x03(\t\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\".\n\x0cHTTPRedirect\x12\x0b\n\x03uri\x18\x01 \x01(\t\x12\x11\n\tauthority\x18\x02 \x01(\t\"-\n\x0bHTTPRewrite\x12\x0b\n\x03uri\x18\x01 \x01(\t\x12\x11\n\tauthority\x18\x02 \x01(\t\"O\n\x0bStringMatch\x12\x0f\n\x05\x65xact\x18\x01 \x01(\tH\x00\x12\x10\n\x06prefix\x18\x02 \x01(\tH\x00\x12\x0f\n\x05regex\x18\x03 \x01(\tH\x00\x42\x0c\n\nmatch_type\"c\n\tHTTPRetry\x12\x10\n\x08\x61ttempts\x18\x01 \x01(\x05\x12\x32\n\x0fper_try_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x10\n\x08retry_on\x18\x03 \x01(\t\"\xcb\x01\n\nCorsPolicy\x12\x14\n\x0c\x61llow_origin\x18\x01 \x03(\t\x12\x15\n\rallow_methods\x18\x02 \x03(\t\x12\x15\n\rallow_headers\x18\x03 \x03(\t\x12\x16\n\x0e\x65xpose_headers\x18\x04 \x03(\t\x12*\n\x07max_age\x18\x05 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x11\x61llow_credentials\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.BoolValue\"\x9a\x04\n\x12HTTPFaultInjection\x12\x42\n\x05\x64\x65lay\x18\x01 \x01(\x0b\x32\x33.istio.networking.v1alpha3.HTTPFaultInjection.Delay\x12\x42\n\x05\x61\x62ort\x18\x02 \x01(\x0b\x32\x33.istio.networking.v1alpha3.HTTPFaultInjection.Abort\x1a\xd1\x01\n\x05\x44\x65lay\x12\x13\n\x07percent\x18\x01 \x01(\x05\x42\x02\x18\x01\x12\x30\n\x0b\x66ixed_delay\x18\x02 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12\x36\n\x11\x65xponential_delay\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12\x36\n\npercentage\x18\x05 \x01(\x0b\x32\".istio.networking.v1alpha3.PercentB\x11\n\x0fhttp_delay_type\x1a\xa7\x01\n\x05\x41\x62ort\x12\x13\n\x07percent\x18\x01 \x01(\x05\x42\x02\x18\x01\x12\x15\n\x0bhttp_status\x18\x02 \x01(\x05H\x00\x12\x15\n\x0bgrpc_status\x18\x03 \x01(\tH\x00\x12\x15\n\x0bhttp2_error\x18\x04 \x01(\tH\x00\x12\x36\n\npercentage\x18\x05 \x01(\x0b\x32\".istio.networking.v1alpha3.PercentB\x0c\n\nerror_type\"8\n\x0cPortSelector\x12\x10\n\x06number\x18\x01 \x01(\rH\x00\x12\x0e\n\x04name\x18\x02 \x01(\tH\x00\x42\x06\n\x04port\"\x18\n\x07Percent\x12\r\n\x05value\x18\x01 \x01(\x01\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
   ,
-  dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,google_dot_protobuf_dot_wrappers__pb2.DESCRIPTOR,])
+  dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,google_dot_protobuf_dot_wrappers__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_network__scope__pb2.DESCRIPTOR,])
 
 
 
@@ -70,6 +71,13 @@
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='scope', full_name='istio.networking.v1alpha3.VirtualService.scope', index=5,
+      number=6, type=14, cpp_type=8, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
   ],
   extensions=[
   ],
@@ -82,8 +90,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=137,
-  serialized_end=338,
+  serialized_start=178,
+  serialized_end=434,
 )
 
 
@@ -127,8 +135,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=340,
-  serialized_end=438,
+  serialized_start=436,
+  serialized_end=534,
 )
 
 
@@ -165,8 +173,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1411,
-  serialized_end=1463,
+  serialized_start=1507,
+  serialized_end=1559,
 )
 
 _HTTPROUTE_APPENDRESPONSEHEADERSENTRY = _descriptor.Descriptor(
@@ -202,8 +210,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1465,
-  serialized_end=1525,
+  serialized_start=1561,
+  serialized_end=1621,
 )
 
 _HTTPROUTE_APPENDREQUESTHEADERSENTRY = _descriptor.Descriptor(
@@ -239,8 +247,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1527,
-  serialized_end=1586,
+  serialized_start=1623,
+  serialized_end=1682,
 )
 
 _HTTPROUTE = _descriptor.Descriptor(
@@ -374,8 +382,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=441,
-  serialized_end=1586,
+  serialized_start=537,
+  serialized_end=1682,
 )
 
 
@@ -412,8 +420,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1928,
-  serialized_end=1970,
+  serialized_start=2024,
+  serialized_end=2066,
 )
 
 _HEADERS_HEADEROPERATIONS_ADDENTRY = _descriptor.Descriptor(
@@ -449,8 +457,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1972,
-  serialized_end=2014,
+  serialized_start=2068,
+  serialized_end=2110,
 )
 
 _HEADERS_HEADEROPERATIONS = _descriptor.Descriptor(
@@ -493,8 +501,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1742,
-  serialized_end=2014,
+  serialized_start=1838,
+  serialized_end=2110,
 )
 
 _HEADERS = _descriptor.Descriptor(
@@ -530,8 +538,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1589,
-  serialized_end=2014,
+  serialized_start=1685,
+  serialized_end=2110,
 )
 
 
@@ -568,8 +576,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2017,
-  serialized_end=2149,
+  serialized_start=2113,
+  serialized_end=2245,
 )
 
 
@@ -606,8 +614,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2152,
-  serialized_end=2283,
+  serialized_start=2248,
+  serialized_end=2379,
 )
 
 
@@ -644,8 +652,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2723,
-  serialized_end=2809,
+  serialized_start=2819,
+  serialized_end=2905,
 )
 
 _HTTPMATCHREQUEST_SOURCELABELSENTRY = _descriptor.Descriptor(
@@ -681,8 +689,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2811,
-  serialized_end=2862,
+  serialized_start=2907,
+  serialized_end=2958,
 )
 
 _HTTPMATCHREQUEST = _descriptor.Descriptor(
@@ -760,8 +768,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2286,
-  serialized_end=2862,
+  serialized_start=2382,
+  serialized_end=2958,
 )
 
 
@@ -798,8 +806,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1465,
-  serialized_end=1525,
+  serialized_start=1561,
+  serialized_end=1621,
 )
 
 _HTTPROUTEDESTINATION_APPENDREQUESTHEADERSENTRY = _descriptor.Descriptor(
@@ -835,8 +843,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1527,
-  serialized_end=1586,
+  serialized_start=1623,
+  serialized_end=1682,
 )
 
 _HTTPROUTEDESTINATION = _descriptor.Descriptor(
@@ -907,8 +915,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2865,
-  serialized_end=3437,
+  serialized_start=2961,
+  serialized_end=3533,
 )
 
 
@@ -945,8 +953,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3439,
-  serialized_end=3534,
+  serialized_start=3535,
+  serialized_end=3630,
 )
 
 
@@ -983,8 +991,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2811,
-  serialized_end=2862,
+  serialized_start=2907,
+  serialized_end=2958,
 )
 
 _L4MATCHATTRIBUTES = _descriptor.Descriptor(
@@ -1041,8 +1049,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3537,
-  serialized_end=3780,
+  serialized_start=3633,
+  serialized_end=3876,
 )
 
 
@@ -1079,8 +1087,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2811,
-  serialized_end=2862,
+  serialized_start=2907,
+  serialized_end=2958,
 )
 
 _TLSMATCHATTRIBUTES = _descriptor.Descriptor(
@@ -1144,8 +1152,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3783,
-  serialized_end=4047,
+  serialized_start=3879,
+  serialized_end=4143,
 )
 
 
@@ -1182,8 +1190,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4049,
-  serialized_end=4095,
+  serialized_start=4145,
+  serialized_end=4191,
 )
 
 
@@ -1220,8 +1228,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4097,
-  serialized_end=4142,
+  serialized_start=4193,
+  serialized_end=4238,
 )
 
 
@@ -1268,8 +1276,8 @@
       name='match_type', full_name='istio.networking.v1alpha3.StringMatch.match_type',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=4144,
-  serialized_end=4223,
+  serialized_start=4240,
+  serialized_end=4319,
 )
 
 
@@ -1313,8 +1321,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4225,
-  serialized_end=4324,
+  serialized_start=4321,
+  serialized_end=4420,
 )
 
 
@@ -1379,8 +1387,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4327,
-  serialized_end=4530,
+  serialized_start=4423,
+  serialized_end=4626,
 )
 
 
@@ -1434,8 +1442,8 @@
       name='http_delay_type', full_name='istio.networking.v1alpha3.HTTPFaultInjection.Delay.http_delay_type',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=4692,
-  serialized_end=4901,
+  serialized_start=4788,
+  serialized_end=4997,
 )
 
 _HTTPFAULTINJECTION_ABORT = _descriptor.Descriptor(
@@ -1495,8 +1503,8 @@
       name='error_type', full_name='istio.networking.v1alpha3.HTTPFaultInjection.Abort.error_type',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=4904,
-  serialized_end=5071,
+  serialized_start=5000,
+  serialized_end=5167,
 )
 
 _HTTPFAULTINJECTION = _descriptor.Descriptor(
@@ -1532,8 +1540,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4533,
-  serialized_end=5071,
+  serialized_start=4629,
+  serialized_end=5167,
 )
 
 
@@ -1573,8 +1581,8 @@
       name='port', full_name='istio.networking.v1alpha3.PortSelector.port',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=5073,
-  serialized_end=5129,
+  serialized_start=5169,
+  serialized_end=5225,
 )
 
 
@@ -1604,13 +1612,14 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5131,
-  serialized_end=5155,
+  serialized_start=5227,
+  serialized_end=5251,
 )
 
 _VIRTUALSERVICE.fields_by_name['http'].message_type = _HTTPROUTE
 _VIRTUALSERVICE.fields_by_name['tls'].message_type = _TLSROUTE
 _VIRTUALSERVICE.fields_by_name['tcp'].message_type = _TCPROUTE
+_VIRTUALSERVICE.fields_by_name['scope'].enum_type = networking_dot_v1alpha3_dot_network__scope__pb2._CONFIGSCOPE
 _DESTINATION.fields_by_name['port'].message_type = _PORTSELECTOR
 _HTTPROUTE_APPENDHEADERSENTRY.containing_type = _HTTPROUTE
 _HTTPROUTE_APPENDRESPONSEHEADERSENTRY.containing_type = _HTTPROUTE

From dc7a70396a3adb92f5adce441bc998244673c9fa Mon Sep 17 00:00:00 2001
From: Shriram Rajagopalan <shriramr@vmware.com>
Date: Tue, 27 Nov 2018 16:29:59 -0500
Subject: [PATCH 07/11] default network scope

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>
---
 mesh/v1alpha1/config.pb.go                   | 254 ++++++++++---------
 mesh/v1alpha1/config.proto                   |   6 +-
 mesh/v1alpha1/istio.mesh.v1alpha1.pb.html    | 108 ++++----
 proto.lock                                   |   8 +-
 python/istio_api/mesh/v1alpha1/config_pb2.py |  74 +++---
 5 files changed, 226 insertions(+), 224 deletions(-)

diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go
index 9592b2427c..e667e8e49a 100644
--- a/mesh/v1alpha1/config.pb.go
+++ b/mesh/v1alpha1/config.pb.go
@@ -23,7 +23,7 @@ import proto "github.com/gogo/protobuf/proto"
 import fmt "fmt"
 import math "math"
 import google_protobuf "github.com/gogo/protobuf/types"
-import istio_networking_v1alpha31 "istio.io/api/networking/v1alpha3"
+import istio_networking_v1alpha32 "istio.io/api/networking/v1alpha3"
 
 import io "io"
 
@@ -152,33 +152,33 @@ func (MeshConfig_OutboundTrafficPolicy_Mode) EnumDescriptor() ([]byte, []int) {
 	return fileDescriptorConfig, []int{0, 0, 0}
 }
 
-type MeshConfig_NetworkScope_Mode int32
+type MeshConfig_DefaultNetworkScope_Mode int32
 
 const (
 	// Invalid mode
-	MeshConfig_NetworkScope_INVALID MeshConfig_NetworkScope_Mode = 0
+	MeshConfig_DefaultNetworkScope_INVALID MeshConfig_DefaultNetworkScope_Mode = 0
 	// Configure routes to services in all namespaces.
-	MeshConfig_NetworkScope_ALL_NAMESPACES MeshConfig_NetworkScope_Mode = 1
+	MeshConfig_DefaultNetworkScope_ALL_NAMESPACES MeshConfig_DefaultNetworkScope_Mode = 1
 	// Configure routes to services in the same namespace as the sidecar
 	// in addition to namespaces specified in sharedNamespaces.
-	MeshConfig_NetworkScope_CURRENT_NAMESPACE MeshConfig_NetworkScope_Mode = 2
+	MeshConfig_DefaultNetworkScope_CURRENT_NAMESPACE MeshConfig_DefaultNetworkScope_Mode = 2
 )
 
-var MeshConfig_NetworkScope_Mode_name = map[int32]string{
+var MeshConfig_DefaultNetworkScope_Mode_name = map[int32]string{
 	0: "INVALID",
 	1: "ALL_NAMESPACES",
 	2: "CURRENT_NAMESPACE",
 }
-var MeshConfig_NetworkScope_Mode_value = map[string]int32{
+var MeshConfig_DefaultNetworkScope_Mode_value = map[string]int32{
 	"INVALID":           0,
 	"ALL_NAMESPACES":    1,
 	"CURRENT_NAMESPACE": 2,
 }
 
-func (x MeshConfig_NetworkScope_Mode) String() string {
-	return proto.EnumName(MeshConfig_NetworkScope_Mode_name, int32(x))
+func (x MeshConfig_DefaultNetworkScope_Mode) String() string {
+	return proto.EnumName(MeshConfig_DefaultNetworkScope_Mode_name, int32(x))
 }
-func (MeshConfig_NetworkScope_Mode) EnumDescriptor() ([]byte, []int) {
+func (MeshConfig_DefaultNetworkScope_Mode) EnumDescriptor() ([]byte, []int) {
 	return fileDescriptorConfig, []int{0, 1, 0}
 }
 
@@ -219,7 +219,7 @@ type MeshConfig struct {
 	// Connection timeout used by Envoy. (MUST BE >=1ms)
 	ConnectTimeout *google_protobuf.Duration `protobuf:"bytes,6,opt,name=connect_timeout,json=connectTimeout" json:"connect_timeout,omitempty"`
 	// If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
-	TcpKeepalive *istio_networking_v1alpha31.ConnectionPoolSettings_TCPSettings_TcpKeepalive `protobuf:"bytes,28,opt,name=tcp_keepalive,json=tcpKeepalive" json:"tcp_keepalive,omitempty"`
+	TcpKeepalive *istio_networking_v1alpha32.ConnectionPoolSettings_TCPSettings_TcpKeepalive `protobuf:"bytes,28,opt,name=tcp_keepalive,json=tcpKeepalive" json:"tcp_keepalive,omitempty"`
 	// Class of ingress resources to be processed by Istio ingress
 	// controller.  This corresponds to the value of
 	// "kubernetes.io/ingress.class" annotation.
@@ -285,7 +285,7 @@ type MeshConfig struct {
 	// sidecars will be able to reach every service in the mesh. The default
 	// scope can be overriden by supplying a NetworkScope resource per
 	// namespace.
-	NetworkScope *MeshConfig_NetworkScope `protobuf:"bytes,29,opt,name=network_scope,json=networkScope" json:"network_scope,omitempty"`
+	DefaultNetworkScope *MeshConfig_DefaultNetworkScope `protobuf:"bytes,29,opt,name=default_network_scope,json=defaultNetworkScope" json:"default_network_scope,omitempty"`
 }
 
 func (m *MeshConfig) Reset()                    { *m = MeshConfig{} }
@@ -342,7 +342,7 @@ func (m *MeshConfig) GetConnectTimeout() *google_protobuf.Duration {
 	return nil
 }
 
-func (m *MeshConfig) GetTcpKeepalive() *istio_networking_v1alpha31.ConnectionPoolSettings_TCPSettings_TcpKeepalive {
+func (m *MeshConfig) GetTcpKeepalive() *istio_networking_v1alpha32.ConnectionPoolSettings_TCPSettings_TcpKeepalive {
 	if m != nil {
 		return m.TcpKeepalive
 	}
@@ -475,9 +475,9 @@ func (m *MeshConfig) GetTrustDomain() string {
 	return ""
 }
 
-func (m *MeshConfig) GetNetworkScope() *MeshConfig_NetworkScope {
+func (m *MeshConfig) GetDefaultNetworkScope() *MeshConfig_DefaultNetworkScope {
 	if m != nil {
-		return m.NetworkScope
+		return m.DefaultNetworkScope
 	}
 	return nil
 }
@@ -500,11 +500,11 @@ func (m *MeshConfig_OutboundTrafficPolicy) GetMode() MeshConfig_OutboundTrafficP
 	return MeshConfig_OutboundTrafficPolicy_REGISTRY_ONLY
 }
 
-// Network scope settings for the mesh. Network scope controls the reachability of
+// Default network scope settings for the mesh. Network scope controls the reachability of
 // sidecars to other services in the mesh.
-type MeshConfig_NetworkScope struct {
+type MeshConfig_DefaultNetworkScope struct {
 	// REQUIRED: The default scope associated with every sidecar in the mesh.
-	DefaultScope MeshConfig_NetworkScope_Mode `protobuf:"varint,1,opt,name=default_scope,json=defaultScope,proto3,enum=istio.mesh.v1alpha1.MeshConfig_NetworkScope_Mode" json:"default_scope,omitempty"`
+	DefaultScope MeshConfig_DefaultNetworkScope_Mode `protobuf:"varint,1,opt,name=default_scope,json=defaultScope,proto3,enum=istio.mesh.v1alpha1.MeshConfig_DefaultNetworkScope_Mode" json:"default_scope,omitempty"`
 	// Specifies one or more namespaces that should be accessible to all
 	// sidecars in the mesh (such as istio-system). This field has no
 	// effect when the default scope is set to ALL_NAMESPACES and a sidecar
@@ -517,19 +517,21 @@ type MeshConfig_NetworkScope struct {
 	SharedNamespaces []string `protobuf:"bytes,2,rep,name=shared_namespaces,json=sharedNamespaces" json:"shared_namespaces,omitempty"`
 }
 
-func (m *MeshConfig_NetworkScope) Reset()                    { *m = MeshConfig_NetworkScope{} }
-func (m *MeshConfig_NetworkScope) String() string            { return proto.CompactTextString(m) }
-func (*MeshConfig_NetworkScope) ProtoMessage()               {}
-func (*MeshConfig_NetworkScope) Descriptor() ([]byte, []int) { return fileDescriptorConfig, []int{0, 1} }
+func (m *MeshConfig_DefaultNetworkScope) Reset()         { *m = MeshConfig_DefaultNetworkScope{} }
+func (m *MeshConfig_DefaultNetworkScope) String() string { return proto.CompactTextString(m) }
+func (*MeshConfig_DefaultNetworkScope) ProtoMessage()    {}
+func (*MeshConfig_DefaultNetworkScope) Descriptor() ([]byte, []int) {
+	return fileDescriptorConfig, []int{0, 1}
+}
 
-func (m *MeshConfig_NetworkScope) GetDefaultScope() MeshConfig_NetworkScope_Mode {
+func (m *MeshConfig_DefaultNetworkScope) GetDefaultScope() MeshConfig_DefaultNetworkScope_Mode {
 	if m != nil {
 		return m.DefaultScope
 	}
-	return MeshConfig_NetworkScope_INVALID
+	return MeshConfig_DefaultNetworkScope_INVALID
 }
 
-func (m *MeshConfig_NetworkScope) GetSharedNamespaces() []string {
+func (m *MeshConfig_DefaultNetworkScope) GetSharedNamespaces() []string {
 	if m != nil {
 		return m.SharedNamespaces
 	}
@@ -547,7 +549,7 @@ type ConfigSource struct {
 	// Use the tls_settings to specify the tls mode to use. If the MCP server
 	// uses Istio MTLS and shares the root CA with Pilot, specify the TLS
 	// mode as ISTIO_MUTUAL.
-	TlsSettings *istio_networking_v1alpha31.TLSSettings `protobuf:"bytes,2,opt,name=tls_settings,json=tlsSettings" json:"tls_settings,omitempty"`
+	TlsSettings *istio_networking_v1alpha32.TLSSettings `protobuf:"bytes,2,opt,name=tls_settings,json=tlsSettings" json:"tls_settings,omitempty"`
 }
 
 func (m *ConfigSource) Reset()                    { *m = ConfigSource{} }
@@ -562,7 +564,7 @@ func (m *ConfigSource) GetAddress() string {
 	return ""
 }
 
-func (m *ConfigSource) GetTlsSettings() *istio_networking_v1alpha31.TLSSettings {
+func (m *ConfigSource) GetTlsSettings() *istio_networking_v1alpha32.TLSSettings {
 	if m != nil {
 		return m.TlsSettings
 	}
@@ -572,13 +574,13 @@ func (m *ConfigSource) GetTlsSettings() *istio_networking_v1alpha31.TLSSettings
 func init() {
 	proto.RegisterType((*MeshConfig)(nil), "istio.mesh.v1alpha1.MeshConfig")
 	proto.RegisterType((*MeshConfig_OutboundTrafficPolicy)(nil), "istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy")
-	proto.RegisterType((*MeshConfig_NetworkScope)(nil), "istio.mesh.v1alpha1.MeshConfig.NetworkScope")
+	proto.RegisterType((*MeshConfig_DefaultNetworkScope)(nil), "istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope")
 	proto.RegisterType((*ConfigSource)(nil), "istio.mesh.v1alpha1.ConfigSource")
 	proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_IngressControllerMode", MeshConfig_IngressControllerMode_name, MeshConfig_IngressControllerMode_value)
 	proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_AuthPolicy", MeshConfig_AuthPolicy_name, MeshConfig_AuthPolicy_value)
 	proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_AccessLogEncoding", MeshConfig_AccessLogEncoding_name, MeshConfig_AccessLogEncoding_value)
 	proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_OutboundTrafficPolicy_Mode", MeshConfig_OutboundTrafficPolicy_Mode_name, MeshConfig_OutboundTrafficPolicy_Mode_value)
-	proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_NetworkScope_Mode", MeshConfig_NetworkScope_Mode_name, MeshConfig_NetworkScope_Mode_value)
+	proto.RegisterEnum("istio.mesh.v1alpha1.MeshConfig_DefaultNetworkScope_Mode", MeshConfig_DefaultNetworkScope_Mode_name, MeshConfig_DefaultNetworkScope_Mode_value)
 }
 func (m *MeshConfig) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
@@ -820,13 +822,13 @@ func (m *MeshConfig) MarshalTo(dAtA []byte) (int, error) {
 		}
 		i += n6
 	}
-	if m.NetworkScope != nil {
+	if m.DefaultNetworkScope != nil {
 		dAtA[i] = 0xea
 		i++
 		dAtA[i] = 0x1
 		i++
-		i = encodeVarintConfig(dAtA, i, uint64(m.NetworkScope.Size()))
-		n7, err := m.NetworkScope.MarshalTo(dAtA[i:])
+		i = encodeVarintConfig(dAtA, i, uint64(m.DefaultNetworkScope.Size()))
+		n7, err := m.DefaultNetworkScope.MarshalTo(dAtA[i:])
 		if err != nil {
 			return 0, err
 		}
@@ -858,7 +860,7 @@ func (m *MeshConfig_OutboundTrafficPolicy) MarshalTo(dAtA []byte) (int, error) {
 	return i, nil
 }
 
-func (m *MeshConfig_NetworkScope) Marshal() (dAtA []byte, err error) {
+func (m *MeshConfig_DefaultNetworkScope) Marshal() (dAtA []byte, err error) {
 	size := m.Size()
 	dAtA = make([]byte, size)
 	n, err := m.MarshalTo(dAtA)
@@ -868,7 +870,7 @@ func (m *MeshConfig_NetworkScope) Marshal() (dAtA []byte, err error) {
 	return dAtA[:n], nil
 }
 
-func (m *MeshConfig_NetworkScope) MarshalTo(dAtA []byte) (int, error) {
+func (m *MeshConfig_DefaultNetworkScope) MarshalTo(dAtA []byte) (int, error) {
 	var i int
 	_ = i
 	var l int
@@ -1038,8 +1040,8 @@ func (m *MeshConfig) Size() (n int) {
 		l = m.TcpKeepalive.Size()
 		n += 2 + l + sovConfig(uint64(l))
 	}
-	if m.NetworkScope != nil {
-		l = m.NetworkScope.Size()
+	if m.DefaultNetworkScope != nil {
+		l = m.DefaultNetworkScope.Size()
 		n += 2 + l + sovConfig(uint64(l))
 	}
 	return n
@@ -1054,7 +1056,7 @@ func (m *MeshConfig_OutboundTrafficPolicy) Size() (n int) {
 	return n
 }
 
-func (m *MeshConfig_NetworkScope) Size() (n int) {
+func (m *MeshConfig_DefaultNetworkScope) Size() (n int) {
 	var l int
 	_ = l
 	if m.DefaultScope != 0 {
@@ -1804,7 +1806,7 @@ func (m *MeshConfig) Unmarshal(dAtA []byte) error {
 				return io.ErrUnexpectedEOF
 			}
 			if m.TcpKeepalive == nil {
-				m.TcpKeepalive = &istio_networking_v1alpha31.ConnectionPoolSettings_TCPSettings_TcpKeepalive{}
+				m.TcpKeepalive = &istio_networking_v1alpha32.ConnectionPoolSettings_TCPSettings_TcpKeepalive{}
 			}
 			if err := m.TcpKeepalive.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
@@ -1812,7 +1814,7 @@ func (m *MeshConfig) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 29:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field NetworkScope", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field DefaultNetworkScope", wireType)
 			}
 			var msglen int
 			for shift := uint(0); ; shift += 7 {
@@ -1836,10 +1838,10 @@ func (m *MeshConfig) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			if m.NetworkScope == nil {
-				m.NetworkScope = &MeshConfig_NetworkScope{}
+			if m.DefaultNetworkScope == nil {
+				m.DefaultNetworkScope = &MeshConfig_DefaultNetworkScope{}
 			}
-			if err := m.NetworkScope.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+			if err := m.DefaultNetworkScope.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
 			}
 			iNdEx = postIndex
@@ -1933,7 +1935,7 @@ func (m *MeshConfig_OutboundTrafficPolicy) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
-func (m *MeshConfig_NetworkScope) Unmarshal(dAtA []byte) error {
+func (m *MeshConfig_DefaultNetworkScope) Unmarshal(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
 	for iNdEx < l {
@@ -1956,10 +1958,10 @@ func (m *MeshConfig_NetworkScope) Unmarshal(dAtA []byte) error {
 		fieldNum := int32(wire >> 3)
 		wireType := int(wire & 0x7)
 		if wireType == 4 {
-			return fmt.Errorf("proto: NetworkScope: wiretype end group for non-group")
+			return fmt.Errorf("proto: DefaultNetworkScope: wiretype end group for non-group")
 		}
 		if fieldNum <= 0 {
-			return fmt.Errorf("proto: NetworkScope: illegal tag %d (wire type %d)", fieldNum, wire)
+			return fmt.Errorf("proto: DefaultNetworkScope: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
 		case 1:
@@ -1976,7 +1978,7 @@ func (m *MeshConfig_NetworkScope) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.DefaultScope |= (MeshConfig_NetworkScope_Mode(b) & 0x7F) << shift
+				m.DefaultScope |= (MeshConfig_DefaultNetworkScope_Mode(b) & 0x7F) << shift
 				if b < 0x80 {
 					break
 				}
@@ -2116,7 +2118,7 @@ func (m *ConfigSource) Unmarshal(dAtA []byte) error {
 				return io.ErrUnexpectedEOF
 			}
 			if m.TlsSettings == nil {
-				m.TlsSettings = &istio_networking_v1alpha31.TLSSettings{}
+				m.TlsSettings = &istio_networking_v1alpha32.TLSSettings{}
 			}
 			if err := m.TlsSettings.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
 				return err
@@ -2251,83 +2253,83 @@ var (
 func init() { proto.RegisterFile("mesh/v1alpha1/config.proto", fileDescriptorConfig) }
 
 var fileDescriptorConfig = []byte{
-	// 1240 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x56, 0xdd, 0x6e, 0xdb, 0xb6,
-	0x17, 0x8f, 0x9c, 0xb4, 0x49, 0x8f, 0x3f, 0x22, 0x33, 0x75, 0xab, 0xba, 0xfd, 0xe7, 0xef, 0x7a,
-	0x58, 0x6b, 0x74, 0x85, 0x8d, 0x26, 0xd8, 0xc5, 0x76, 0x31, 0xc0, 0x75, 0x9c, 0xd6, 0x99, 0x63,
-	0x7b, 0x92, 0x92, 0xad, 0xbb, 0x21, 0x14, 0x89, 0xb6, 0x89, 0xc8, 0xa2, 0x26, 0x52, 0x5d, 0xfb,
-	0x6c, 0x7b, 0x81, 0x5d, 0xec, 0x62, 0xc0, 0x5e, 0x60, 0xe8, 0x93, 0x0c, 0x24, 0xa5, 0xd8, 0x69,
-	0x8d, 0xa5, 0xd8, 0x9d, 0xf8, 0x3b, 0x5f, 0x3c, 0xbf, 0xf3, 0x41, 0x41, 0x7d, 0x41, 0xf8, 0xbc,
-	0xf3, 0xf6, 0x85, 0x17, 0xc6, 0x73, 0xef, 0x45, 0xc7, 0x67, 0xd1, 0x94, 0xce, 0xda, 0x71, 0xc2,
-	0x04, 0x43, 0x7b, 0x94, 0x0b, 0xca, 0xda, 0x52, 0xa3, 0x9d, 0x6b, 0xd4, 0xf7, 0x67, 0x8c, 0xcd,
-	0x42, 0xd2, 0x51, 0x2a, 0x17, 0xe9, 0xb4, 0x13, 0xa4, 0x89, 0x27, 0x28, 0x8b, 0xb4, 0x51, 0xfd,
-	0xc1, 0x75, 0x87, 0x71, 0xc2, 0xde, 0xbd, 0xcf, 0x44, 0xcf, 0x22, 0x22, 0x7e, 0x65, 0xc9, 0x25,
-	0x8d, 0x66, 0xb9, 0xc2, 0x61, 0x27, 0x20, 0x5c, 0xd0, 0x48, 0x79, 0xc0, 0x49, 0x1a, 0x12, 0xad,
-	0xdb, 0xfc, 0xa3, 0x0a, 0x70, 0x4a, 0xf8, 0xbc, 0xa7, 0x2e, 0x84, 0x9e, 0x03, 0x5a, 0xd0, 0x77,
-	0x24, 0xc1, 0xfe, 0x9c, 0xf8, 0x97, 0x98, 0x93, 0xe4, 0x2d, 0x49, 0x2c, 0xa3, 0x61, 0xb4, 0xee,
-	0xd8, 0xa6, 0x92, 0xf4, 0xa4, 0xc0, 0x51, 0x38, 0x6a, 0xc3, 0x9e, 0xd6, 0x4e, 0x48, 0xcc, 0x12,
-	0x91, 0xab, 0x17, 0x94, 0x7a, 0x55, 0x89, 0x6c, 0x25, 0xc9, 0xf4, 0x0f, 0xa0, 0x16, 0x50, 0xee,
-	0x5d, 0x84, 0x04, 0xc7, 0x2c, 0xa4, 0xfe, 0x7b, 0x1d, 0x86, 0x5b, 0x9b, 0x0d, 0xa3, 0xb5, 0x63,
-	0xef, 0x65, 0xc2, 0x89, 0x92, 0xa9, 0x40, 0x1c, 0x3d, 0x83, 0xaa, 0xca, 0x0d, 0x87, 0x94, 0x0b,
-	0x12, 0x61, 0xe9, 0xce, 0xda, 0x6a, 0x18, 0xad, 0x5b, 0xf6, 0xae, 0x12, 0x0c, 0x15, 0x3e, 0x61,
-	0x89, 0x40, 0x4f, 0x40, 0x43, 0x78, 0x2e, 0x44, 0xac, 0x35, 0x6f, 0x29, 0xcd, 0xb2, 0x82, 0x5f,
-	0x0b, 0x11, 0x2b, 0xbd, 0x97, 0xb0, 0xeb, 0xb3, 0x28, 0x22, 0xbe, 0xc0, 0x82, 0x2e, 0x08, 0x4b,
-	0x85, 0x75, 0xbb, 0x61, 0xb4, 0x8a, 0x07, 0x0f, 0xda, 0x9a, 0xf5, 0x76, 0xce, 0x7a, 0xfb, 0x28,
-	0x63, 0xdd, 0xae, 0x64, 0x16, 0xae, 0x36, 0x40, 0x5f, 0x40, 0x99, 0x46, 0xb3, 0x84, 0x70, 0x8e,
-	0xfd, 0xd0, 0xe3, 0xdc, 0xda, 0x56, 0x59, 0x97, 0x32, 0xb0, 0x27, 0x31, 0xf4, 0x14, 0x76, 0x73,
-	0x25, 0xc9, 0x0d, 0xf5, 0x89, 0xb5, 0xa3, 0xd4, 0x2a, 0x19, 0xec, 0x68, 0x14, 0x2d, 0xe0, 0xfe,
-	0x95, 0x37, 0x16, 0x89, 0x84, 0x85, 0x21, 0x49, 0xf0, 0x82, 0x05, 0xc4, 0xba, 0xd3, 0x30, 0x5a,
-	0x95, 0x83, 0xaf, 0xdb, 0x6b, 0x9a, 0xa4, 0xbd, 0xac, 0x5c, 0x7b, 0x90, 0xc5, 0xbd, 0xb2, 0x3e,
-	0x65, 0x01, 0xb1, 0x6b, 0x74, 0x1d, 0x8c, 0xc6, 0x50, 0xf4, 0x52, 0x31, 0xcf, 0xaa, 0x60, 0x81,
-	0x0a, 0xf1, 0xec, 0xa6, 0x10, 0xdd, 0x54, 0xcc, 0x75, 0x6d, 0x5e, 0x16, 0x2c, 0xc3, 0x06, 0xef,
-	0xea, 0x8c, 0x06, 0x50, 0x4d, 0x02, 0x8e, 0x13, 0x32, 0x4d, 0x08, 0x9f, 0xe3, 0x80, 0x84, 0xde,
-	0x7b, 0xab, 0x78, 0x03, 0xa7, 0xca, 0xcb, 0x6e, 0x12, 0x70, 0x5b, 0x9b, 0x1d, 0x49, 0x2b, 0xf4,
-	0x25, 0x54, 0x48, 0xa4, 0x7a, 0x44, 0x24, 0x9e, 0x4f, 0xa3, 0x99, 0x55, 0x52, 0xdd, 0x51, 0xd6,
-	0xa8, 0xab, 0x41, 0x59, 0x6b, 0xcf, 0xf7, 0x25, 0x61, 0x21, 0x9b, 0xe1, 0x29, 0x0d, 0x89, 0x55,
-	0x56, 0xd4, 0x96, 0x35, 0x3c, 0x64, 0xb3, 0x63, 0x1a, 0x12, 0xf4, 0x0a, 0x2a, 0x01, 0x99, 0x7a,
-	0x69, 0x28, 0xb0, 0x1e, 0x3a, 0xab, 0xa2, 0xae, 0xd5, 0x58, 0x9b, 0xed, 0x44, 0xf6, 0x89, 0x4e,
-	0xd7, 0x2e, 0x67, 0x76, 0xd9, 0x68, 0x3c, 0x85, 0xb2, 0x6e, 0x76, 0x2f, 0x08, 0x24, 0xa5, 0x96,
-	0x29, 0xc3, 0xa9, 0x1c, 0x4a, 0x4a, 0xd0, 0xd5, 0x38, 0xfa, 0x05, 0xee, 0xb3, 0x54, 0x5c, 0xb0,
-	0x34, 0x0a, 0x64, 0x0a, 0xd3, 0x29, 0xf5, 0x73, 0xa2, 0xab, 0x2a, 0xf4, 0x8d, 0xb5, 0x1c, 0x67,
-	0xe6, 0xae, 0xb6, 0x5e, 0xe1, 0xbc, 0xc6, 0xd6, 0x89, 0xd0, 0x11, 0xfc, 0x3f, 0xe3, 0xcc, 0x0f,
-	0x29, 0x89, 0x04, 0xe6, 0x34, 0xb8, 0x3e, 0x63, 0xd6, 0x9e, 0x22, 0xf1, 0xa1, 0x56, 0xeb, 0x29,
-	0x2d, 0x87, 0x06, 0xab, 0xb3, 0x86, 0x1a, 0x50, 0xe2, 0x01, 0xc7, 0x69, 0xc0, 0x71, 0xec, 0x89,
-	0xb9, 0x75, 0x57, 0xf1, 0x09, 0x3c, 0xe0, 0x67, 0x01, 0x9f, 0x78, 0x62, 0x2e, 0xcb, 0xcc, 0x3f,
-	0x29, 0x73, 0xed, 0xb3, 0xca, 0xcc, 0x3f, 0x2a, 0xf3, 0x6b, 0xa8, 0xe8, 0x7a, 0x60, 0xce, 0xd2,
-	0xc4, 0x27, 0xdc, 0xba, 0xd7, 0xd8, 0x6c, 0x15, 0x0f, 0x1e, 0xaf, 0x25, 0x47, 0x13, 0xe3, 0x28,
-	0x4d, 0xbb, 0xec, 0xaf, 0x9c, 0x38, 0x3a, 0x84, 0x7b, 0x59, 0xf2, 0xf2, 0x6e, 0x82, 0x5d, 0x92,
-	0x08, 0x2f, 0x58, 0x1a, 0x09, 0xeb, 0xbe, 0x5e, 0x2b, 0x5a, 0xea, 0x04, 0xdc, 0x95, 0xb2, 0x53,
-	0x29, 0x92, 0x6b, 0x65, 0xb5, 0x7d, 0x58, 0xb2, 0xf0, 0x84, 0x65, 0xa9, 0x84, 0x77, 0x97, 0x0d,
-	0xa4, 0x60, 0x19, 0x60, 0x95, 0x4a, 0x3c, 0xf5, 0x68, 0x88, 0x59, 0x4c, 0x22, 0xeb, 0x81, 0x0e,
-	0x10, 0x2f, 0x49, 0x3c, 0xf6, 0x68, 0x38, 0x8e, 0x49, 0x84, 0x1e, 0x43, 0x49, 0x24, 0x29, 0x17,
-	0x38, 0x60, 0x0b, 0x8f, 0x46, 0x56, 0x5d, 0xf9, 0x2e, 0x2a, 0xec, 0x48, 0x41, 0xc8, 0x83, 0xbd,
-	0x95, 0x3b, 0x90, 0xc8, 0x67, 0x81, 0x6c, 0xf7, 0x87, 0x6a, 0x1a, 0x5f, 0xdc, 0x38, 0x8d, 0xf9,
-	0x2d, 0xfb, 0x99, 0xa1, 0x5d, 0xf5, 0x3e, 0x86, 0x10, 0x83, 0xb2, 0xf0, 0x63, 0x7c, 0x49, 0x48,
-	0xec, 0x85, 0xf4, 0x2d, 0xb1, 0x1e, 0xa9, 0x62, 0x9d, 0x64, 0xce, 0x97, 0x0f, 0x45, 0x1e, 0xe2,
-	0x50, 0x52, 0x2d, 0xf7, 0x1c, 0x65, 0xd1, 0x84, 0xb1, 0xd0, 0x21, 0x42, 0xd0, 0x68, 0xc6, 0xdb,
-	0x6e, 0x6f, 0xb2, 0xfc, 0xf6, 0xe3, 0xef, 0x73, 0x8f, 0x76, 0x49, 0xac, 0x9c, 0xd0, 0x0f, 0x50,
-	0xce, 0x9c, 0x62, 0xee, 0xb3, 0x98, 0x58, 0xff, 0x53, 0x01, 0x9f, 0xdf, 0x94, 0xcd, 0x48, 0x1b,
-	0x39, 0xd2, 0xc6, 0x2e, 0x45, 0x2b, 0xa7, 0xfa, 0x6f, 0x06, 0xd4, 0xd6, 0x4e, 0x04, 0xb2, 0x61,
-	0x4b, 0xad, 0x48, 0x43, 0x31, 0xf6, 0xed, 0x7f, 0x1a, 0xab, 0xb6, 0x5c, 0x88, 0xaa, 0x45, 0x95,
-	0xaf, 0xe6, 0x08, 0xb6, 0xd4, 0x8a, 0xac, 0x41, 0xd9, 0xee, 0xbf, 0x1a, 0x38, 0xae, 0xfd, 0x06,
-	0x8f, 0x47, 0xc3, 0x37, 0xe6, 0x46, 0xbd, 0xb0, 0x63, 0xa0, 0x2a, 0xdc, 0xe9, 0x0e, 0x87, 0xe3,
-	0x1f, 0x71, 0x77, 0xf4, 0xc6, 0x34, 0x14, 0xf4, 0x08, 0xee, 0x9e, 0x0f, 0x6c, 0xf7, 0xac, 0x3b,
-	0xc4, 0x4e, 0xdf, 0x3e, 0x1f, 0xf4, 0xfa, 0xda, 0xa0, 0x20, 0xa5, 0xf5, 0xbf, 0x0c, 0x28, 0xad,
-	0x26, 0x87, 0xce, 0x21, 0x5f, 0x2c, 0x19, 0x43, 0xc6, 0xe7, 0xd5, 0x7b, 0xd5, 0x89, 0xba, 0xb4,
-	0x5d, 0xca, 0xfc, 0x68, 0xbf, 0x5f, 0x41, 0x95, 0xcf, 0xbd, 0x84, 0x04, 0x38, 0xf2, 0x16, 0x84,
-	0xc7, 0x9e, 0x9c, 0xa9, 0x42, 0x63, 0x53, 0xbe, 0xdc, 0x5a, 0x30, 0xba, 0xc2, 0x9b, 0xdf, 0x65,
-	0x59, 0x16, 0x61, 0x7b, 0x30, 0x3a, 0xef, 0x0e, 0x07, 0x47, 0xe6, 0x06, 0x42, 0x50, 0xe9, 0x0e,
-	0x87, 0x78, 0xd4, 0x3d, 0xed, 0x3b, 0x93, 0x6e, 0xaf, 0xef, 0x98, 0x06, 0xaa, 0x41, 0xb5, 0x77,
-	0x66, 0xdb, 0xfd, 0x91, 0xbb, 0xc4, 0xcd, 0x42, 0xf3, 0x1b, 0xa8, 0xad, 0x7d, 0x70, 0xd0, 0x36,
-	0x6c, 0x8e, 0x8f, 0x8f, 0xcd, 0x0d, 0xe9, 0xf9, 0xa8, 0x7f, 0xdc, 0x3d, 0x1b, 0xba, 0xa6, 0x81,
-	0x00, 0x6e, 0x3b, 0xae, 0x3d, 0xe8, 0xb9, 0x66, 0xa1, 0xf9, 0x04, 0x60, 0xf9, 0x90, 0xa0, 0x1d,
-	0xd8, 0x1a, 0x8d, 0x47, 0x7d, 0x73, 0x03, 0x55, 0x00, 0x4e, 0xcf, 0x14, 0x8b, 0xee, 0xd0, 0x31,
-	0x8d, 0xe6, 0x53, 0xa8, 0x7e, 0xd2, 0xe2, 0x52, 0xdd, 0xed, 0xff, 0xe4, 0x9a, 0x1b, 0xf2, 0xeb,
-	0xc4, 0x19, 0x8f, 0x4c, 0xe3, 0x64, 0x6b, 0x67, 0xd7, 0x34, 0x4f, 0xb6, 0x76, 0x90, 0xb9, 0xd7,
-	0xe4, 0x50, 0x5a, 0x5d, 0x15, 0xc8, 0x82, 0xed, 0x7c, 0x5d, 0xeb, 0x9f, 0x98, 0xfc, 0x88, 0x06,
-	0x50, 0x12, 0xa1, 0x7c, 0x96, 0x75, 0x4f, 0xab, 0x9f, 0x96, 0xe2, 0xc1, 0x93, 0x7f, 0x19, 0x0c,
-	0x77, 0xe8, 0xe4, 0x13, 0x60, 0x17, 0x45, 0xc8, 0xf3, 0xc3, 0xcb, 0xd6, 0xef, 0x1f, 0xf6, 0x8d,
-	0x3f, 0x3f, 0xec, 0x1b, 0x7f, 0x7f, 0xd8, 0x37, 0x7e, 0xae, 0x6b, 0x0f, 0x94, 0x75, 0xbc, 0x98,
-	0x76, 0xae, 0xfd, 0xa5, 0x5d, 0xdc, 0x56, 0xcb, 0xf1, 0xf0, 0x9f, 0x00, 0x00, 0x00, 0xff, 0xff,
-	0x11, 0x8c, 0xe2, 0xc6, 0x0e, 0x0a, 0x00, 0x00,
+	// 1245 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x56, 0xed, 0x6e, 0xdb, 0x36,
+	0x17, 0x8e, 0x92, 0xb4, 0x49, 0x8f, 0x3f, 0x22, 0xd3, 0x75, 0xab, 0xba, 0x7d, 0xf3, 0xba, 0x1e,
+	0xd6, 0x1a, 0xdd, 0x60, 0xa3, 0x09, 0x06, 0x6c, 0xfb, 0x31, 0xc0, 0xb5, 0x9d, 0xd6, 0x99, 0x63,
+	0x1b, 0x92, 0xd2, 0xad, 0x03, 0x06, 0x42, 0x91, 0x68, 0x9b, 0x88, 0x2c, 0x6a, 0x22, 0xd5, 0xb5,
+	0xd7, 0xb6, 0x1b, 0xd8, 0xcf, 0x5d, 0xc2, 0xd6, 0x2b, 0xd8, 0x25, 0x0c, 0x24, 0xa5, 0xd8, 0x6d,
+	0x8d, 0x65, 0xe8, 0x3f, 0xf1, 0x39, 0x5f, 0x3c, 0xcf, 0xf9, 0xa0, 0xa0, 0xbe, 0x24, 0x7c, 0xd1,
+	0x79, 0xfd, 0xd4, 0x0b, 0xe3, 0x85, 0xf7, 0xb4, 0xe3, 0xb3, 0x68, 0x46, 0xe7, 0xed, 0x38, 0x61,
+	0x82, 0xa1, 0x2a, 0xe5, 0x82, 0xb2, 0xb6, 0xd4, 0x68, 0xe7, 0x1a, 0xf5, 0xc3, 0x39, 0x63, 0xf3,
+	0x90, 0x74, 0x94, 0xca, 0x45, 0x3a, 0xeb, 0x04, 0x69, 0xe2, 0x09, 0xca, 0x22, 0x6d, 0x54, 0xbf,
+	0xf7, 0xbe, 0xc3, 0x38, 0x61, 0x6f, 0xde, 0x66, 0xa2, 0x27, 0x11, 0x11, 0xbf, 0xb2, 0xe4, 0x92,
+	0x46, 0xf3, 0x5c, 0xe1, 0xb8, 0x13, 0x10, 0x2e, 0x68, 0xa4, 0x3c, 0xe0, 0x24, 0x0d, 0x89, 0xd6,
+	0x6d, 0xfe, 0x5d, 0x01, 0x38, 0x23, 0x7c, 0xd1, 0x53, 0x17, 0x42, 0x5f, 0x02, 0x5a, 0xd2, 0x37,
+	0x24, 0xc1, 0xfe, 0x82, 0xf8, 0x97, 0x98, 0x93, 0xe4, 0x35, 0x49, 0x2c, 0xa3, 0x61, 0xb4, 0x6e,
+	0xd9, 0xa6, 0x92, 0xf4, 0xa4, 0xc0, 0x51, 0x38, 0x6a, 0x43, 0x55, 0x6b, 0x27, 0x24, 0x66, 0x89,
+	0xc8, 0xd5, 0xb7, 0x95, 0x7a, 0x45, 0x89, 0x6c, 0x25, 0xc9, 0xf4, 0x8f, 0xa0, 0x16, 0x50, 0xee,
+	0x5d, 0x84, 0x04, 0xc7, 0x2c, 0xa4, 0xfe, 0x5b, 0x1d, 0x86, 0x5b, 0x3b, 0x0d, 0xa3, 0xb5, 0x6f,
+	0x57, 0x33, 0xe1, 0x54, 0xc9, 0x54, 0x20, 0x8e, 0x9e, 0x40, 0x45, 0xe5, 0x86, 0x43, 0xca, 0x05,
+	0x89, 0xb0, 0x74, 0x67, 0xed, 0x36, 0x8c, 0xd6, 0x0d, 0xfb, 0x40, 0x09, 0x46, 0x0a, 0x9f, 0xb2,
+	0x44, 0xa0, 0x47, 0xa0, 0x21, 0xbc, 0x10, 0x22, 0xd6, 0x9a, 0x37, 0x94, 0x66, 0x49, 0xc1, 0x2f,
+	0x84, 0x88, 0x95, 0xde, 0x33, 0x38, 0xf0, 0x59, 0x14, 0x11, 0x5f, 0x60, 0x41, 0x97, 0x84, 0xa5,
+	0xc2, 0xba, 0xd9, 0x30, 0x5a, 0x85, 0xa3, 0x7b, 0x6d, 0xcd, 0x7a, 0x3b, 0x67, 0xbd, 0xdd, 0xcf,
+	0x58, 0xb7, 0xcb, 0x99, 0x85, 0xab, 0x0d, 0xd0, 0x67, 0x50, 0xa2, 0xd1, 0x3c, 0x21, 0x9c, 0x63,
+	0x3f, 0xf4, 0x38, 0xb7, 0xf6, 0x54, 0xd6, 0xc5, 0x0c, 0xec, 0x49, 0x0c, 0x3d, 0x86, 0x83, 0x5c,
+	0x49, 0x72, 0x43, 0x7d, 0x62, 0xed, 0x2b, 0xb5, 0x72, 0x06, 0x3b, 0x1a, 0x45, 0x4b, 0xb8, 0x7b,
+	0xe5, 0x8d, 0x45, 0x22, 0x61, 0x61, 0x48, 0x12, 0xbc, 0x64, 0x01, 0xb1, 0x6e, 0x35, 0x8c, 0x56,
+	0xf9, 0xe8, 0xab, 0xf6, 0x86, 0x26, 0x69, 0xaf, 0x2a, 0xd7, 0x1e, 0x66, 0x71, 0xaf, 0xac, 0xcf,
+	0x58, 0x40, 0xec, 0x1a, 0xdd, 0x04, 0xa3, 0x09, 0x14, 0xbc, 0x54, 0x2c, 0xb2, 0x2a, 0x58, 0xa0,
+	0x42, 0x3c, 0xb9, 0x2e, 0x44, 0x37, 0x15, 0x0b, 0x5d, 0x9b, 0x67, 0xdb, 0x96, 0x61, 0x83, 0x77,
+	0x75, 0x46, 0x43, 0xa8, 0x24, 0x01, 0xc7, 0x09, 0x99, 0x25, 0x84, 0x2f, 0x70, 0x40, 0x42, 0xef,
+	0xad, 0x55, 0xb8, 0x86, 0x53, 0xe5, 0xe5, 0x20, 0x09, 0xb8, 0xad, 0xcd, 0xfa, 0xd2, 0x0a, 0x7d,
+	0x0e, 0x65, 0x12, 0xa9, 0x1e, 0x11, 0x89, 0xe7, 0xd3, 0x68, 0x6e, 0x15, 0x55, 0x77, 0x94, 0x34,
+	0xea, 0x6a, 0x50, 0xd6, 0xda, 0xf3, 0x7d, 0x49, 0x58, 0xc8, 0xe6, 0x78, 0x46, 0x43, 0x62, 0x95,
+	0x14, 0xb5, 0x25, 0x0d, 0x8f, 0xd8, 0xfc, 0x84, 0x86, 0x04, 0x3d, 0x87, 0x72, 0x40, 0x66, 0x5e,
+	0x1a, 0x0a, 0xac, 0x87, 0xce, 0x2a, 0xab, 0x6b, 0x35, 0x36, 0x66, 0x3b, 0x95, 0x7d, 0xa2, 0xd3,
+	0xb5, 0x4b, 0x99, 0x5d, 0x36, 0x1a, 0x8f, 0xa1, 0xa4, 0x9b, 0xdd, 0x0b, 0x02, 0x49, 0xa9, 0x65,
+	0xca, 0x70, 0x2a, 0x87, 0xa2, 0x12, 0x74, 0x35, 0x8e, 0x7e, 0x81, 0xbb, 0x2c, 0x15, 0x17, 0x2c,
+	0x8d, 0x02, 0x99, 0xc2, 0x6c, 0x46, 0xfd, 0x9c, 0xe8, 0x8a, 0x0a, 0x7d, 0x6d, 0x2d, 0x27, 0x99,
+	0xb9, 0xab, 0xad, 0xd7, 0x38, 0xaf, 0xb1, 0x4d, 0x22, 0xd4, 0x87, 0xff, 0x67, 0x9c, 0xf9, 0x21,
+	0x25, 0x91, 0xc0, 0x9c, 0x06, 0xef, 0xcf, 0x98, 0x55, 0x55, 0x24, 0xde, 0xd7, 0x6a, 0x3d, 0xa5,
+	0xe5, 0xd0, 0x60, 0x7d, 0xd6, 0x50, 0x03, 0x8a, 0x3c, 0xe0, 0x38, 0x0d, 0x38, 0x8e, 0x3d, 0xb1,
+	0xb0, 0x6e, 0x2b, 0x3e, 0x81, 0x07, 0xfc, 0x3c, 0xe0, 0x53, 0x4f, 0x2c, 0x64, 0x99, 0xf9, 0x47,
+	0x65, 0xae, 0xfd, 0xa7, 0x32, 0xf3, 0x0f, 0xca, 0xfc, 0x02, 0xca, 0xba, 0x1e, 0x98, 0xb3, 0x34,
+	0xf1, 0x09, 0xb7, 0xee, 0x34, 0x76, 0x5a, 0x85, 0xa3, 0x87, 0x1b, 0xc9, 0xd1, 0xc4, 0x38, 0x4a,
+	0xd3, 0x2e, 0xf9, 0x6b, 0x27, 0x8e, 0x8e, 0xe1, 0x4e, 0x96, 0xbc, 0xbc, 0x9b, 0x60, 0x97, 0x24,
+	0xc2, 0x4b, 0x96, 0x46, 0xc2, 0xba, 0xab, 0xd7, 0x8a, 0x96, 0x3a, 0x01, 0x77, 0xa5, 0xec, 0x4c,
+	0x8a, 0xe4, 0x5a, 0x59, 0x6f, 0x1f, 0x96, 0x2c, 0x3d, 0x61, 0x59, 0x2a, 0xe1, 0x83, 0x55, 0x03,
+	0x29, 0x58, 0x06, 0x58, 0xa7, 0x12, 0xcf, 0x3c, 0x1a, 0x62, 0x16, 0x93, 0xc8, 0xba, 0xa7, 0x03,
+	0xc4, 0x2b, 0x12, 0x4f, 0x3c, 0x1a, 0x4e, 0x62, 0x12, 0xa1, 0x87, 0x50, 0x14, 0x49, 0xca, 0x05,
+	0x0e, 0xd8, 0xd2, 0xa3, 0x91, 0x55, 0x57, 0xbe, 0x0b, 0x0a, 0xeb, 0x2b, 0x08, 0x79, 0x50, 0x5d,
+	0xbb, 0x03, 0x89, 0x7c, 0x16, 0xc8, 0x76, 0xbf, 0xaf, 0xa6, 0xf1, 0xe9, 0xb5, 0xd3, 0x98, 0xdf,
+	0x72, 0x90, 0x19, 0xda, 0x15, 0xef, 0x43, 0x08, 0x31, 0x28, 0x09, 0x3f, 0xc6, 0x97, 0x84, 0xc4,
+	0x5e, 0x48, 0x5f, 0x13, 0xeb, 0x81, 0x2a, 0xd6, 0x69, 0xe6, 0x7c, 0xf5, 0x50, 0xe4, 0x21, 0x8e,
+	0x25, 0xd5, 0x72, 0xcf, 0x51, 0x16, 0x4d, 0x19, 0x0b, 0x1d, 0x22, 0x04, 0x8d, 0xe6, 0xbc, 0xed,
+	0xf6, 0xa6, 0xab, 0x6f, 0x3f, 0xfe, 0x3e, 0xf7, 0x68, 0x17, 0xc5, 0xda, 0x09, 0xcd, 0xa1, 0x96,
+	0x8f, 0x5b, 0xe6, 0x1c, 0x73, 0x9f, 0xc5, 0xc4, 0xfa, 0x9f, 0x0a, 0x7c, 0x7c, 0x5d, 0x56, 0x7d,
+	0x6d, 0x3c, 0xd6, 0xb6, 0x8e, 0x34, 0xb5, 0xab, 0xc1, 0xc7, 0x60, 0xfd, 0x37, 0x03, 0x6a, 0x1b,
+	0xe7, 0x04, 0xd9, 0xb0, 0xab, 0x16, 0xa7, 0xa1, 0x78, 0xfc, 0xf6, 0x93, 0x86, 0xad, 0x2d, 0xd7,
+	0xa4, 0x6a, 0x5c, 0xe5, 0xab, 0x39, 0x86, 0x5d, 0xb5, 0x38, 0x6b, 0x50, 0xb2, 0x07, 0xcf, 0x87,
+	0x8e, 0x6b, 0xbf, 0xc2, 0x93, 0xf1, 0xe8, 0x95, 0xb9, 0x55, 0xdf, 0xde, 0x37, 0x50, 0x05, 0x6e,
+	0x75, 0x47, 0xa3, 0xc9, 0x0f, 0xb8, 0x3b, 0x7e, 0x65, 0x1a, 0x0a, 0x7a, 0x00, 0xb7, 0x5f, 0x0e,
+	0x6d, 0xf7, 0xbc, 0x3b, 0xc2, 0xce, 0xc0, 0x7e, 0x39, 0xec, 0x0d, 0xb4, 0xc1, 0xb6, 0x94, 0xd6,
+	0xff, 0x32, 0xa0, 0xba, 0x21, 0x55, 0xf4, 0x33, 0xe4, 0x5b, 0x27, 0xa3, 0x4d, 0x27, 0xf1, 0xf5,
+	0x27, 0xd0, 0xa6, 0x52, 0xb0, 0x8b, 0x99, 0x3b, 0xed, 0xfe, 0x0b, 0xa8, 0xf0, 0x85, 0x97, 0x90,
+	0x00, 0x47, 0xde, 0x92, 0xf0, 0xd8, 0x93, 0x73, 0xb7, 0xdd, 0xd8, 0x91, 0xaf, 0xbb, 0x16, 0x8c,
+	0xaf, 0xf0, 0xe6, 0x77, 0x59, 0xce, 0x05, 0xd8, 0x1b, 0x8e, 0x5f, 0x76, 0x47, 0xc3, 0xbe, 0xb9,
+	0x85, 0x10, 0x94, 0xbb, 0xa3, 0x11, 0x1e, 0x77, 0xcf, 0x06, 0xce, 0xb4, 0xdb, 0x1b, 0x38, 0xa6,
+	0x81, 0x6a, 0x50, 0xe9, 0x9d, 0xdb, 0xf6, 0x60, 0xec, 0xae, 0x70, 0x73, 0xbb, 0xf9, 0x0d, 0xd4,
+	0x36, 0x3e, 0x4a, 0x68, 0x0f, 0x76, 0x26, 0x27, 0x27, 0xe6, 0x96, 0xf4, 0xdc, 0x1f, 0x9c, 0x74,
+	0xcf, 0x47, 0xae, 0x69, 0x20, 0x80, 0x9b, 0x8e, 0x6b, 0x0f, 0x7b, 0xae, 0xb9, 0xdd, 0x7c, 0x04,
+	0xb0, 0x7a, 0x6c, 0xd0, 0x3e, 0xec, 0x8e, 0x27, 0xe3, 0x81, 0xb9, 0x85, 0xca, 0x00, 0x67, 0xe7,
+	0x8a, 0x53, 0x77, 0xe4, 0x98, 0x46, 0xf3, 0x31, 0x54, 0x3e, 0x1a, 0x03, 0xa9, 0xee, 0x0e, 0x7e,
+	0x74, 0xcd, 0x2d, 0xf9, 0x75, 0xea, 0x4c, 0xc6, 0xa6, 0x71, 0xba, 0xbb, 0x7f, 0x60, 0x9a, 0xa7,
+	0xbb, 0xfb, 0xc8, 0xac, 0x36, 0x39, 0x14, 0xd7, 0xd7, 0x09, 0xb2, 0x60, 0x2f, 0x5f, 0xe9, 0xfa,
+	0x47, 0x27, 0x3f, 0xa2, 0x21, 0x14, 0x45, 0x28, 0x9f, 0x6e, 0xdd, 0xf7, 0xea, 0xc7, 0xa6, 0x70,
+	0xf4, 0xe8, 0x5f, 0x86, 0xc7, 0x1d, 0x39, 0xf9, 0x94, 0xd8, 0x05, 0x11, 0xf2, 0xfc, 0xf0, 0xac,
+	0xf5, 0xfb, 0xbb, 0x43, 0xe3, 0x8f, 0x77, 0x87, 0xc6, 0x9f, 0xef, 0x0e, 0x8d, 0x9f, 0xea, 0xda,
+	0x03, 0x65, 0x1d, 0x2f, 0xa6, 0x9d, 0xf7, 0xfe, 0xe4, 0x2e, 0x6e, 0xaa, 0x05, 0x7a, 0xfc, 0x4f,
+	0x00, 0x00, 0x00, 0xff, 0xff, 0xf5, 0x70, 0xd0, 0x21, 0x32, 0x0a, 0x00, 0x00,
 }
diff --git a/mesh/v1alpha1/config.proto b/mesh/v1alpha1/config.proto
index 7154f513b8..d468b2c0ec 100644
--- a/mesh/v1alpha1/config.proto
+++ b/mesh/v1alpha1/config.proto
@@ -199,9 +199,9 @@ message MeshConfig {
   // Fallback to old identity format(without trust domain) if not set.
   string trust_domain = 26;
 
-  // Network scope settings for the mesh. Network scope controls the reachability of
+  // Default network scope settings for the mesh. Network scope controls the reachability of
   // sidecars to other services in the mesh.
-  message NetworkScope {
+  message DefaultNetworkScope {
     enum Mode {
       // Invalid mode
       INVALID = 0;
@@ -234,7 +234,7 @@ message MeshConfig {
   // sidecars will be able to reach every service in the mesh. The default
   // scope can be overriden by supplying a NetworkScope resource per
   // namespace.
-  NetworkScope network_scope = 29;
+  DefaultNetworkScope default_network_scope = 29;
 
   // $hide_from_docs
   // Next available field number: 30
diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
index af0a9d9459..228c8e98c7 100644
--- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
+++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
@@ -305,9 +305,9 @@ <h2 id="MeshConfig">MeshConfig</h2>
 
 </td>
 </tr>
-<tr id="MeshConfig-network_scope">
-<td><code>networkScope</code></td>
-<td><code><a href="#MeshConfig-NetworkScope">MeshConfig.NetworkScope</a></code></td>
+<tr id="MeshConfig-default_network_scope">
+<td><code>defaultNetworkScope</code></td>
+<td><code><a href="#MeshConfig-DefaultNetworkScope">MeshConfig.DefaultNetworkScope</a></code></td>
 <td>
 <p>The default network scope associated with every sidecar in the mesh.
 Pilot will program the routes in the sidecars accordingly. If omitted,
@@ -343,51 +343,9 @@ <h2 id="MeshConfig-AccessLogEncoding">MeshConfig.AccessLogEncoding</h2>
 </tbody>
 </table>
 </section>
-<h2 id="MeshConfig-IngressControllerMode">MeshConfig.IngressControllerMode</h2>
-<section>
-<table class="enum-values">
-<thead>
-<tr>
-<th>Name</th>
-<th>Description</th>
-</tr>
-</thead>
-<tbody>
-<tr id="MeshConfig-IngressControllerMode-OFF">
-<td><code>OFF</code></td>
-<td>
-<p>Disables Istio ingress controller.</p>
-
-</td>
-</tr>
-<tr id="MeshConfig-IngressControllerMode-DEFAULT">
-<td><code>DEFAULT</code></td>
-<td>
-<p>Istio ingress controller will act on ingress resources that do not
-contain any annotation or whose annotations match the value
-specified in the ingress_class parameter described earlier. Use this
-mode if Istio ingress controller will be the default ingress
-controller for the entire kubernetes cluster.</p>
-
-</td>
-</tr>
-<tr id="MeshConfig-IngressControllerMode-STRICT">
-<td><code>STRICT</code></td>
-<td>
-<p>Istio ingress controller will only act on ingress resources whose
-annotations match the value specified in the ingress_class parameter
-described earlier. Use this mode if Istio ingress controller will be
-a secondary ingress controller (e.g., in addition to a
-cloud-provided ingress controller).</p>
-
-</td>
-</tr>
-</tbody>
-</table>
-</section>
-<h2 id="MeshConfig-NetworkScope">MeshConfig.NetworkScope</h2>
+<h2 id="MeshConfig-DefaultNetworkScope">MeshConfig.DefaultNetworkScope</h2>
 <section>
-<p>Network scope settings for the mesh. Network scope controls the reachability of
+<p>Default network scope settings for the mesh. Network scope controls the reachability of
 sidecars to other services in the mesh.</p>
 
 <table class="message-fields">
@@ -399,15 +357,15 @@ <h2 id="MeshConfig-NetworkScope">MeshConfig.NetworkScope</h2>
 </tr>
 </thead>
 <tbody>
-<tr id="MeshConfig-NetworkScope-default_scope">
+<tr id="MeshConfig-DefaultNetworkScope-default_scope">
 <td><code>defaultScope</code></td>
-<td><code><a href="#MeshConfig-NetworkScope-Mode">MeshConfig.NetworkScope.Mode</a></code></td>
+<td><code><a href="#MeshConfig-DefaultNetworkScope-Mode">MeshConfig.DefaultNetworkScope.Mode</a></code></td>
 <td>
 <p>REQUIRED: The default scope associated with every sidecar in the mesh.</p>
 
 </td>
 </tr>
-<tr id="MeshConfig-NetworkScope-shared_namespaces">
+<tr id="MeshConfig-DefaultNetworkScope-shared_namespaces">
 <td><code>sharedNamespaces</code></td>
 <td><code>string[]</code></td>
 <td>
@@ -426,7 +384,7 @@ <h2 id="MeshConfig-NetworkScope">MeshConfig.NetworkScope</h2>
 </tbody>
 </table>
 </section>
-<h2 id="MeshConfig-NetworkScope-Mode">MeshConfig.NetworkScope.Mode</h2>
+<h2 id="MeshConfig-DefaultNetworkScope-Mode">MeshConfig.DefaultNetworkScope.Mode</h2>
 <section>
 <table class="enum-values">
 <thead>
@@ -436,26 +394,68 @@ <h2 id="MeshConfig-NetworkScope-Mode">MeshConfig.NetworkScope.Mode</h2>
 </tr>
 </thead>
 <tbody>
-<tr id="MeshConfig-NetworkScope-Mode-INVALID">
+<tr id="MeshConfig-DefaultNetworkScope-Mode-INVALID">
 <td><code>INVALID</code></td>
 <td>
 <p>Invalid mode</p>
 
 </td>
 </tr>
-<tr id="MeshConfig-NetworkScope-Mode-ALL_NAMESPACES">
+<tr id="MeshConfig-DefaultNetworkScope-Mode-ALL_NAMESPACES">
 <td><code>ALL_NAMESPACES</code></td>
 <td>
 <p>Configure routes to services in all namespaces.</p>
 
 </td>
 </tr>
-<tr id="MeshConfig-NetworkScope-Mode-CURRENT_NAMESPACE">
+<tr id="MeshConfig-DefaultNetworkScope-Mode-CURRENT_NAMESPACE">
 <td><code>CURRENT_NAMESPACE</code></td>
 <td>
 <p>Configure routes to services in the same namespace as the sidecar
 in addition to namespaces specified in sharedNamespaces.</p>
 
+</td>
+</tr>
+</tbody>
+</table>
+</section>
+<h2 id="MeshConfig-IngressControllerMode">MeshConfig.IngressControllerMode</h2>
+<section>
+<table class="enum-values">
+<thead>
+<tr>
+<th>Name</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr id="MeshConfig-IngressControllerMode-OFF">
+<td><code>OFF</code></td>
+<td>
+<p>Disables Istio ingress controller.</p>
+
+</td>
+</tr>
+<tr id="MeshConfig-IngressControllerMode-DEFAULT">
+<td><code>DEFAULT</code></td>
+<td>
+<p>Istio ingress controller will act on ingress resources that do not
+contain any annotation or whose annotations match the value
+specified in the ingress_class parameter described earlier. Use this
+mode if Istio ingress controller will be the default ingress
+controller for the entire kubernetes cluster.</p>
+
+</td>
+</tr>
+<tr id="MeshConfig-IngressControllerMode-STRICT">
+<td><code>STRICT</code></td>
+<td>
+<p>Istio ingress controller will only act on ingress resources whose
+annotations match the value specified in the ingress_class parameter
+described earlier. Use this mode if Istio ingress controller will be
+a secondary ingress controller (e.g., in addition to a
+cloud-provided ingress controller).</p>
+
 </td>
 </tr>
 </tbody>
diff --git a/proto.lock b/proto.lock
index bf5e09b719..9565f80074 100644
--- a/proto.lock
+++ b/proto.lock
@@ -692,7 +692,7 @@
             ]
           },
           {
-            "name": "NetworkScope.Mode",
+            "name": "DefaultNetworkScope.Mode",
             "enum_fields": [
               {
                 "name": "INVALID",
@@ -846,8 +846,8 @@
               },
               {
                 "id": 29,
-                "name": "network_scope",
-                "type": "NetworkScope"
+                "name": "default_network_scope",
+                "type": "DefaultNetworkScope"
               }
             ],
             "reserved_ids": [
@@ -866,7 +866,7 @@
                 ]
               },
               {
-                "name": "NetworkScope",
+                "name": "DefaultNetworkScope",
                 "fields": [
                   {
                     "id": 1,
diff --git a/python/istio_api/mesh/v1alpha1/config_pb2.py b/python/istio_api/mesh/v1alpha1/config_pb2.py
index 6153605b1f..cc7412bd86 100644
--- a/python/istio_api/mesh/v1alpha1/config_pb2.py
+++ b/python/istio_api/mesh/v1alpha1/config_pb2.py
@@ -22,7 +22,7 @@
   name='mesh/v1alpha1/config.proto',
   package='istio.mesh.v1alpha1',
   syntax='proto3',
-  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xd8\r\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x1e\n\x16policy_check_fail_open\x18\x19 \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x61\n\rtcp_keepalive\x18\x1c \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepalive\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x38\n\x11rds_refresh_delay\x18\x0b \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12N\n\x13\x61\x63\x63\x65ss_log_encoding\x18\x1b \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.AccessLogEncoding\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\x19\n\rmixer_address\x18\x10 \x01(\tB\x02\x18\x01\x12Z\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicyB\x02\x18\x01\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x38\n\x11sds_refresh_delay\x18\x15 \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\x12\x14\n\x0ctrust_domain\x18\x1a \x01(\t\x12\x43\n\rnetwork_scope\x18\x1d \x01(\x0b\x32,.istio.mesh.v1alpha1.MeshConfig.NetworkScope\x1a\xb5\x01\n\x15OutboundTrafficPolicy\x12L\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.ModeB\x02\x18\x01\"N\n\x04Mode\x12\x15\n\rREGISTRY_ONLY\x10\x00\x1a\x02\x08\x01\x12\x11\n\tALLOW_ANY\x10\x01\x1a\x02\x08\x01\x12\x1c\n\x14VIRTUAL_SERVICE_ONLY\x10\x02\x1a\x02\x08\x01\x1a\xb3\x01\n\x0cNetworkScope\x12H\n\rdefault_scope\x18\x01 \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.NetworkScope.Mode\x12\x19\n\x11shared_namespaces\x18\x02 \x03(\t\">\n\x04Mode\x12\x0b\n\x07INVALID\x10\x00\x12\x12\n\x0e\x41LL_NAMESPACES\x10\x01\x12\x15\n\x11\x43URRENT_NAMESPACE\x10\x02\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\"\'\n\x11\x41\x63\x63\x65ssLogEncoding\x12\x08\n\x04TEXT\x10\x00\x12\x08\n\x04JSON\x10\x01J\x04\x08\x0f\x10\x10J\x04\x08\x12\x10\x13\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettingsB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
+  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xf5\r\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x1e\n\x16policy_check_fail_open\x18\x19 \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x61\n\rtcp_keepalive\x18\x1c \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepalive\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x38\n\x11rds_refresh_delay\x18\x0b \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12N\n\x13\x61\x63\x63\x65ss_log_encoding\x18\x1b \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.AccessLogEncoding\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\x19\n\rmixer_address\x18\x10 \x01(\tB\x02\x18\x01\x12Z\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicyB\x02\x18\x01\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x38\n\x11sds_refresh_delay\x18\x15 \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\x12\x14\n\x0ctrust_domain\x18\x1a \x01(\t\x12R\n\x15\x64\x65\x66\x61ult_network_scope\x18\x1d \x01(\x0b\x32\x33.istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope\x1a\xb5\x01\n\x15OutboundTrafficPolicy\x12L\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.ModeB\x02\x18\x01\"N\n\x04Mode\x12\x15\n\rREGISTRY_ONLY\x10\x00\x1a\x02\x08\x01\x12\x11\n\tALLOW_ANY\x10\x01\x1a\x02\x08\x01\x12\x1c\n\x14VIRTUAL_SERVICE_ONLY\x10\x02\x1a\x02\x08\x01\x1a\xc1\x01\n\x13\x44\x65\x66\x61ultNetworkScope\x12O\n\rdefault_scope\x18\x01 \x01(\x0e\x32\x38.istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope.Mode\x12\x19\n\x11shared_namespaces\x18\x02 \x03(\t\">\n\x04Mode\x12\x0b\n\x07INVALID\x10\x00\x12\x12\n\x0e\x41LL_NAMESPACES\x10\x01\x12\x15\n\x11\x43URRENT_NAMESPACE\x10\x02\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\"\'\n\x11\x41\x63\x63\x65ssLogEncoding\x12\x08\n\x04TEXT\x10\x00\x12\x08\n\x04JSON\x10\x01J\x04\x08\x0f\x10\x10J\x04\x08\x12\x10\x13\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettingsB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
   ,
   dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,mesh_dot_v1alpha1_dot_proxy__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_destination__rule__pb2.DESCRIPTOR,])
 
@@ -49,14 +49,14 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1495,
-  serialized_end=1573,
+  serialized_start=1510,
+  serialized_end=1588,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE)
 
-_MESHCONFIG_NETWORKSCOPE_MODE = _descriptor.EnumDescriptor(
+_MESHCONFIG_DEFAULTNETWORKSCOPE_MODE = _descriptor.EnumDescriptor(
   name='Mode',
-  full_name='istio.mesh.v1alpha1.MeshConfig.NetworkScope.Mode',
+  full_name='istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope.Mode',
   filename=None,
   file=DESCRIPTOR,
   values=[
@@ -75,10 +75,10 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1693,
-  serialized_end=1755,
+  serialized_start=1722,
+  serialized_end=1784,
 )
-_sym_db.RegisterEnumDescriptor(_MESHCONFIG_NETWORKSCOPE_MODE)
+_sym_db.RegisterEnumDescriptor(_MESHCONFIG_DEFAULTNETWORKSCOPE_MODE)
 
 _MESHCONFIG_INGRESSCONTROLLERMODE = _descriptor.EnumDescriptor(
   name='IngressControllerMode',
@@ -101,8 +101,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1757,
-  serialized_end=1814,
+  serialized_start=1786,
+  serialized_end=1843,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_INGRESSCONTROLLERMODE)
 
@@ -123,8 +123,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1816,
-  serialized_end=1854,
+  serialized_start=1845,
+  serialized_end=1883,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_AUTHPOLICY)
 
@@ -145,8 +145,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1856,
-  serialized_end=1895,
+  serialized_start=1885,
+  serialized_end=1924,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_ACCESSLOGENCODING)
 
@@ -178,26 +178,26 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1392,
-  serialized_end=1573,
+  serialized_start=1407,
+  serialized_end=1588,
 )
 
-_MESHCONFIG_NETWORKSCOPE = _descriptor.Descriptor(
-  name='NetworkScope',
-  full_name='istio.mesh.v1alpha1.MeshConfig.NetworkScope',
+_MESHCONFIG_DEFAULTNETWORKSCOPE = _descriptor.Descriptor(
+  name='DefaultNetworkScope',
+  full_name='istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope',
   filename=None,
   file=DESCRIPTOR,
   containing_type=None,
   fields=[
     _descriptor.FieldDescriptor(
-      name='default_scope', full_name='istio.mesh.v1alpha1.MeshConfig.NetworkScope.default_scope', index=0,
+      name='default_scope', full_name='istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope.default_scope', index=0,
       number=1, type=14, cpp_type=8, label=1,
       has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='shared_namespaces', full_name='istio.mesh.v1alpha1.MeshConfig.NetworkScope.shared_namespaces', index=1,
+      name='shared_namespaces', full_name='istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope.shared_namespaces', index=1,
       number=2, type=9, cpp_type=9, label=3,
       has_default_value=False, default_value=[],
       message_type=None, enum_type=None, containing_type=None,
@@ -208,7 +208,7 @@
   ],
   nested_types=[],
   enum_types=[
-    _MESHCONFIG_NETWORKSCOPE_MODE,
+    _MESHCONFIG_DEFAULTNETWORKSCOPE_MODE,
   ],
   options=None,
   is_extendable=False,
@@ -216,8 +216,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1576,
-  serialized_end=1755,
+  serialized_start=1591,
+  serialized_end=1784,
 )
 
 _MESHCONFIG = _descriptor.Descriptor(
@@ -410,7 +410,7 @@
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='network_scope', full_name='istio.mesh.v1alpha1.MeshConfig.network_scope', index=26,
+      name='default_network_scope', full_name='istio.mesh.v1alpha1.MeshConfig.default_network_scope', index=26,
       number=29, type=11, cpp_type=10, label=1,
       has_default_value=False, default_value=None,
       message_type=None, enum_type=None, containing_type=None,
@@ -419,7 +419,7 @@
   ],
   extensions=[
   ],
-  nested_types=[_MESHCONFIG_OUTBOUNDTRAFFICPOLICY, _MESHCONFIG_NETWORKSCOPE, ],
+  nested_types=[_MESHCONFIG_OUTBOUNDTRAFFICPOLICY, _MESHCONFIG_DEFAULTNETWORKSCOPE, ],
   enum_types=[
     _MESHCONFIG_INGRESSCONTROLLERMODE,
     _MESHCONFIG_AUTHPOLICY,
@@ -432,7 +432,7 @@
   oneofs=[
   ],
   serialized_start=155,
-  serialized_end=1907,
+  serialized_end=1936,
 )
 
 
@@ -469,16 +469,16 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1909,
-  serialized_end=2002,
+  serialized_start=1938,
+  serialized_end=2031,
 )
 
 _MESHCONFIG_OUTBOUNDTRAFFICPOLICY.fields_by_name['mode'].enum_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE
 _MESHCONFIG_OUTBOUNDTRAFFICPOLICY.containing_type = _MESHCONFIG
 _MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE.containing_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY
-_MESHCONFIG_NETWORKSCOPE.fields_by_name['default_scope'].enum_type = _MESHCONFIG_NETWORKSCOPE_MODE
-_MESHCONFIG_NETWORKSCOPE.containing_type = _MESHCONFIG
-_MESHCONFIG_NETWORKSCOPE_MODE.containing_type = _MESHCONFIG_NETWORKSCOPE
+_MESHCONFIG_DEFAULTNETWORKSCOPE.fields_by_name['default_scope'].enum_type = _MESHCONFIG_DEFAULTNETWORKSCOPE_MODE
+_MESHCONFIG_DEFAULTNETWORKSCOPE.containing_type = _MESHCONFIG
+_MESHCONFIG_DEFAULTNETWORKSCOPE_MODE.containing_type = _MESHCONFIG_DEFAULTNETWORKSCOPE
 _MESHCONFIG.fields_by_name['connect_timeout'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION
 _MESHCONFIG.fields_by_name['tcp_keepalive'].message_type = networking_dot_v1alpha3_dot_destination__rule__pb2._CONNECTIONPOOLSETTINGS_TCPSETTINGS_TCPKEEPALIVE
 _MESHCONFIG.fields_by_name['ingress_controller_mode'].enum_type = _MESHCONFIG_INGRESSCONTROLLERMODE
@@ -489,7 +489,7 @@
 _MESHCONFIG.fields_by_name['outbound_traffic_policy'].message_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY
 _MESHCONFIG.fields_by_name['sds_refresh_delay'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION
 _MESHCONFIG.fields_by_name['config_sources'].message_type = _CONFIGSOURCE
-_MESHCONFIG.fields_by_name['network_scope'].message_type = _MESHCONFIG_NETWORKSCOPE
+_MESHCONFIG.fields_by_name['default_network_scope'].message_type = _MESHCONFIG_DEFAULTNETWORKSCOPE
 _MESHCONFIG_INGRESSCONTROLLERMODE.containing_type = _MESHCONFIG
 _MESHCONFIG_AUTHPOLICY.containing_type = _MESHCONFIG
 _MESHCONFIG_ACCESSLOGENCODING.containing_type = _MESHCONFIG
@@ -507,10 +507,10 @@
     ))
   ,
 
-  NetworkScope = _reflection.GeneratedProtocolMessageType('NetworkScope', (_message.Message,), dict(
-    DESCRIPTOR = _MESHCONFIG_NETWORKSCOPE,
+  DefaultNetworkScope = _reflection.GeneratedProtocolMessageType('DefaultNetworkScope', (_message.Message,), dict(
+    DESCRIPTOR = _MESHCONFIG_DEFAULTNETWORKSCOPE,
     __module__ = 'mesh.v1alpha1.config_pb2'
-    # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.MeshConfig.NetworkScope)
+    # @@protoc_insertion_point(class_scope:istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope)
     ))
   ,
   DESCRIPTOR = _MESHCONFIG,
@@ -519,7 +519,7 @@
   ))
 _sym_db.RegisterMessage(MeshConfig)
 _sym_db.RegisterMessage(MeshConfig.OutboundTrafficPolicy)
-_sym_db.RegisterMessage(MeshConfig.NetworkScope)
+_sym_db.RegisterMessage(MeshConfig.DefaultNetworkScope)
 
 ConfigSource = _reflection.GeneratedProtocolMessageType('ConfigSource', (_message.Message,), dict(
   DESCRIPTOR = _CONFIGSOURCE,

From 6f516041a4a2402ae86c011875450fb3de97654f Mon Sep 17 00:00:00 2001
From: Shriram Rajagopalan <shriramr@vmware.com>
Date: Tue, 27 Nov 2018 16:42:02 -0500
Subject: [PATCH 08/11] doc updates

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>
---
 networking/v1alpha3/network_scope.proto | 86 +++++++++----------------
 1 file changed, 32 insertions(+), 54 deletions(-)

diff --git a/networking/v1alpha3/network_scope.proto b/networking/v1alpha3/network_scope.proto
index c3928c8c58..eaaa57059c 100644
--- a/networking/v1alpha3/network_scope.proto
+++ b/networking/v1alpha3/network_scope.proto
@@ -19,44 +19,41 @@ package istio.networking.v1alpha3;
 option go_package = "istio.io/api/networking/v1alpha3";
 
 // `NetworkScope` describes the set of services that a workload depends on
-// for its operation. In other words, it describes the properties of egress
-// traffic from a given workload. By default, the service mesh established
-// by Istio will have a full mesh connectivity - i.e. every workload will
-// have proxy configuration required to reach every other workload in the
-// mesh. However most connectivity graphs are sparse in practice. The
-// NetworkScope provides a way to prune the connectivity graph
-// (i.e. dependencies) associated with each workload.
+// for its operation. In other words, it describes the properties of
+// outgoing traffic from a given workload. By default, the service mesh
+// established by Istio will have a full mesh connectivity - i.e. every
+// workload will have proxy configuration required to reach every other
+// workload in the mesh. However most connectivity graphs are sparse in
+// practice. The NetworkScope provides a way to declare the service
+// dependencies associated with each workload such that the amount of
+// configuration sent to the sidecars can be scoped to the requisite
+// dependencies.
 //
 // Services and configuration in a mesh are organized into one or more
 // namespaces (e.g., a Kubernetes namespace or a CF org/space).  Workloads
-// in a namespace will be able to reach other workloads in the same
-// namespace. To declare dependencies on workloads in other namespaces, a
-// NetworkScope resource has to be specified in the current
-// namespace. *_Each namespace can have only one NetworkScope
-// resource_*. The behavior of the system is undefined if more than one
-// NetworkScope resource exists in a given namespace. The set of
-// dependencies specified in a NetworkScope resource will be used to
-// compute the [outbound] connectivity graph for every workload in the
-// namespace.
+// in a namespace have an implicit dependency on other workloads in the
+// same namespace. In addition, to declare dependencies on workloads in
+// other namespaces, a NetworkScope resource has to be specified in the
+// current namespace. *_Each namespace MUST have only one NetworkScope
+// resource named "default"_*. The behavior of the system is undefined if
+// more than one NetworkScope resource exists in a given namespace. The set
+// of dependencies specified in a NetworkScope resource will be used to
+// compute the sidecar configuration for every workload in the namespace.
 //
 // NOTE: If workloads in the mesh depend only on other workloads in the
-// same namespace, use the mesh global setting to specify the default
-// network scope as CURRENT_NAMESPACE. To facilitate incremental pruning of
-// the connectivity graph, the default network scope for the mesh is set to
-// ALL_NAMESPACES. In otherwords, every workload will be able to reach
-// every other workload. Specifying a NetworkScope resource in a namespace
-// will automatically prune the configuration for the workloads in that
-// namespace.
+// same namespace, use the mesh global setting (in values.yaml) to specify
+// the default network scope as CURRENT_NAMESPACE. To facilitate
+// incremental pruning of the the sidecar configuration, the default
+// network scope for the mesh is set to ALL_NAMESPACES. In other words,
+// every workload will be able to reach every other workload. Specifying a
+// NetworkScope resource in a namespace will automatically prune the
+// configuration for the workloads in that namespace.
 //
 // The following examples illustrate a few specific use cases of NetworkScope.
 //
 // The example below delcares a NetworkScope resource in the prod-us1
-// namespace. The workload with the `version: newlandingpage` label will be
-// able to reach all services declared in the egress namespace as well as
-// the landing.qa.foo.com service in the qa namespace. All other workloads
-// in the prod-us1 namespace will be able to reach the services in the
-// egress namespace only.
-//
+// namespace that specifies that workloads in the namespace will be able to
+// reach the services in the prod-apis namespace only.
 //
 // ```yaml
 // apiVersion: networking.istio.io/v1alpha3
@@ -66,14 +63,8 @@ option go_package = "istio.io/api/networking/v1alpha3";
 //   namespace: prod-us1
 // spec:
 //   dependencies:
-//   - sourceWorkloadLabels:
-//       version: newlandingpage
-//     imports:
-//     - namespace: qa
-//       host: landing.qa.foo.com
-//     - namespace: egress
 //   - imports:
-//     - namespace: egress
+//     - namespace: prod-apis
 // ```
 //
 // In a mesh where the default network scope is set to CURRENT_NAMESPACE
@@ -89,20 +80,16 @@ option go_package = "istio.io/api/networking/v1alpha3";
 //   namespace: metrics-collection
 // spec:
 //   dependencies:
-//   - sourceWorkloadLabels:
-//        app: metricsScraper
-//     imports:
+//   - imports:
 //     - namespace: '*'
 // ```
 //
 // The configuration above will allow workloads in the metrics-collection
-// namespace with the labels `app: metricsScraper` to access service in any
-// namespace while other workloads in the same namespace will be configured
-// for namespace local access as per the global default network scope
-// (CURRENT_NAMESPACE).
+// namespace to access service in any namespace while workloads in other
+// namespaces will be configured for namespace local access as per the
+// global default network scope (CURRENT_NAMESPACE).
 //
 message NetworkScope {
-
   // Import describes the set of namespaces whose exported services
   // (real/virtual) will be accessed by workloads in a given namespace. The
   // sidecars attached to the workloads will be configured with information
@@ -135,15 +122,6 @@ message NetworkScope {
   // Dependency describes a workload and the set of service dependencies
   // for the workload.
   message Dependency {
-    // One or more labels that indicate a specific set of pods/VMs on which
-    // this dependency configuration should be applied.  The scope of label
-    // search is platform dependent.  On Kubernetes, for example, the scope
-    // includes pods running in the namespace in which the NetworkScope
-    // resource is present.  If the sourceWorkloadLabels are omitted, the
-    // imports specified will be applicable to all workloads in the current
-    // configuration namespace.
-    map<string, string> source_workload_labels = 1;
-
     // REQUIRED: Import describes the set of namespaces whose exported
     // services will be accessed by the workloads selected by the
     // sourceWorkloadLabels. The sidecars attached to the workloads will be
@@ -157,7 +135,7 @@ message NetworkScope {
 
   // REQUIRED. The set of services that workloads in this namespace are
   // expected to talk to, in addition to other workloads in the same
-  // namespace. Dependencies describe the properties of egress traffic from
+  // namespace. Dependencies describe the properties of outbound traffic from
   // a given workload.
   repeated Dependency dependencies = 1;
 }

From d50216f5b2c7a06f83479536b7a9f07314123dd6 Mon Sep 17 00:00:00 2001
From: Shriram Rajagopalan <shriramr@vmware.com>
Date: Tue, 27 Nov 2018 20:16:17 -0500
Subject: [PATCH 09/11] updates

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>
---
 mesh/v1alpha1/config.pb.go                    | 252 ++++++++---------
 mesh/v1alpha1/config.proto                    |  54 ++--
 mesh/v1alpha1/istio.mesh.v1alpha1.pb.html     |  54 ++--
 .../istio.networking.v1alpha3.pb.html         |  95 +++----
 networking/v1alpha3/network_scope.pb.go       | 263 +++---------------
 networking/v1alpha3/network_scope.proto       |  20 +-
 proto.lock                                    |  22 +-
 python/istio_api/mesh/v1alpha1/config_pb2.py  |  40 ++-
 .../networking/v1alpha3/network_Scope_pb2.py  |  72 +----
 9 files changed, 293 insertions(+), 579 deletions(-)

diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go
index e667e8e49a..d15871e7a2 100644
--- a/mesh/v1alpha1/config.pb.go
+++ b/mesh/v1alpha1/config.pb.go
@@ -155,24 +155,22 @@ func (MeshConfig_OutboundTrafficPolicy_Mode) EnumDescriptor() ([]byte, []int) {
 type MeshConfig_DefaultNetworkScope_Mode int32
 
 const (
-	// Invalid mode
-	MeshConfig_DefaultNetworkScope_INVALID MeshConfig_DefaultNetworkScope_Mode = 0
-	// Configure routes to services in all namespaces.
-	MeshConfig_DefaultNetworkScope_ALL_NAMESPACES MeshConfig_DefaultNetworkScope_Mode = 1
-	// Configure routes to services in the same namespace as the sidecar
-	// in addition to namespaces specified in sharedNamespaces.
-	MeshConfig_DefaultNetworkScope_CURRENT_NAMESPACE MeshConfig_DefaultNetworkScope_Mode = 2
+	// Configure routes to services in all namespaces, i.e. import
+	// services from all namespaces.
+	MeshConfig_DefaultNetworkScope_ALL_NAMESPACES MeshConfig_DefaultNetworkScope_Mode = 0
+	// Only configure routes to services that are in the same namespace
+	// as the workload as well as services in namespaces specified in
+	// importNamespaces.
+	MeshConfig_DefaultNetworkScope_CURRENT_NAMESPACE MeshConfig_DefaultNetworkScope_Mode = 1
 )
 
 var MeshConfig_DefaultNetworkScope_Mode_name = map[int32]string{
-	0: "INVALID",
-	1: "ALL_NAMESPACES",
-	2: "CURRENT_NAMESPACE",
+	0: "ALL_NAMESPACES",
+	1: "CURRENT_NAMESPACE",
 }
 var MeshConfig_DefaultNetworkScope_Mode_value = map[string]int32{
-	"INVALID":           0,
-	"ALL_NAMESPACES":    1,
-	"CURRENT_NAMESPACE": 2,
+	"ALL_NAMESPACES":    0,
+	"CURRENT_NAMESPACE": 1,
 }
 
 func (x MeshConfig_DefaultNetworkScope_Mode) String() string {
@@ -280,11 +278,11 @@ type MeshConfig struct {
 	// Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
 	// Fallback to old identity format(without trust domain) if not set.
 	TrustDomain string `protobuf:"bytes,26,opt,name=trust_domain,json=trustDomain,proto3" json:"trust_domain,omitempty"`
-	// The default network scope associated with every sidecar in the mesh.
-	// Pilot will program the routes in the sidecars accordingly. If omitted,
-	// sidecars will be able to reach every service in the mesh. The default
-	// scope can be overriden by supplying a NetworkScope resource per
-	// namespace.
+	// The default network scope associated with every workload in the mesh.
+	// Pilot will program the routes in the sidecars and gateways
+	// accordingly. If omitted, sidecars will be configured to reach every
+	// service in the mesh. The default scope can be overriden by supplying a
+	// NetworkScope resource per namespace.
 	DefaultNetworkScope *MeshConfig_DefaultNetworkScope `protobuf:"bytes,29,opt,name=default_network_scope,json=defaultNetworkScope" json:"default_network_scope,omitempty"`
 }
 
@@ -500,21 +498,18 @@ func (m *MeshConfig_OutboundTrafficPolicy) GetMode() MeshConfig_OutboundTrafficP
 	return MeshConfig_OutboundTrafficPolicy_REGISTRY_ONLY
 }
 
-// Default network scope settings for the mesh. Network scope controls the reachability of
-// sidecars to other services in the mesh.
+// Default network scope settings for each workload in the mesh. Network
+// scope controls the reachability of workloads to other services in the
+// mesh.
 type MeshConfig_DefaultNetworkScope struct {
-	// REQUIRED: The default scope associated with every sidecar in the mesh.
-	DefaultScope MeshConfig_DefaultNetworkScope_Mode `protobuf:"varint,1,opt,name=default_scope,json=defaultScope,proto3,enum=istio.mesh.v1alpha1.MeshConfig_DefaultNetworkScope_Mode" json:"default_scope,omitempty"`
-	// Specifies one or more namespaces that should be accessible to all
-	// sidecars in the mesh (such as istio-system). This field has no
-	// effect when the default scope is set to ALL_NAMESPACES and a sidecar
-	// has no explicit NetworkScope resource attached to it. However when
-	// the sidecar has a NetworkScope resource attached to it (and the
-	// default scope is set to ALL_NAMESPACES or CURRENT_NAMESPACE),
-	// sidecar's network scope will include services/config objects
-	// specified in the NetworkScope object as well as services/config
-	// objects specified in the sharedNamespaces.
-	SharedNamespaces []string `protobuf:"bytes,2,rep,name=shared_namespaces,json=sharedNamespaces" json:"shared_namespaces,omitempty"`
+	// REQUIRED: The default import setting for every workload in the mesh.
+	ImportMode MeshConfig_DefaultNetworkScope_Mode `protobuf:"varint,1,opt,name=import_mode,json=importMode,proto3,enum=istio.mesh.v1alpha1.MeshConfig_DefaultNetworkScope_Mode" json:"import_mode,omitempty"`
+	// Specifies one or more namespaces that should be imported by default
+	// in all user defined NetworkScope resources in addition to the
+	// namespaces explicitly specified by the end user. Use this setting to
+	// automatically import services/resources from namespaces such as
+	// istio-system that all workloads in the mesh depend upon.
+	ImportNamespaces []string `protobuf:"bytes,2,rep,name=import_namespaces,json=importNamespaces" json:"import_namespaces,omitempty"`
 }
 
 func (m *MeshConfig_DefaultNetworkScope) Reset()         { *m = MeshConfig_DefaultNetworkScope{} }
@@ -524,16 +519,16 @@ func (*MeshConfig_DefaultNetworkScope) Descriptor() ([]byte, []int) {
 	return fileDescriptorConfig, []int{0, 1}
 }
 
-func (m *MeshConfig_DefaultNetworkScope) GetDefaultScope() MeshConfig_DefaultNetworkScope_Mode {
+func (m *MeshConfig_DefaultNetworkScope) GetImportMode() MeshConfig_DefaultNetworkScope_Mode {
 	if m != nil {
-		return m.DefaultScope
+		return m.ImportMode
 	}
-	return MeshConfig_DefaultNetworkScope_INVALID
+	return MeshConfig_DefaultNetworkScope_ALL_NAMESPACES
 }
 
-func (m *MeshConfig_DefaultNetworkScope) GetSharedNamespaces() []string {
+func (m *MeshConfig_DefaultNetworkScope) GetImportNamespaces() []string {
 	if m != nil {
-		return m.SharedNamespaces
+		return m.ImportNamespaces
 	}
 	return nil
 }
@@ -875,13 +870,13 @@ func (m *MeshConfig_DefaultNetworkScope) MarshalTo(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
-	if m.DefaultScope != 0 {
+	if m.ImportMode != 0 {
 		dAtA[i] = 0x8
 		i++
-		i = encodeVarintConfig(dAtA, i, uint64(m.DefaultScope))
+		i = encodeVarintConfig(dAtA, i, uint64(m.ImportMode))
 	}
-	if len(m.SharedNamespaces) > 0 {
-		for _, s := range m.SharedNamespaces {
+	if len(m.ImportNamespaces) > 0 {
+		for _, s := range m.ImportNamespaces {
 			dAtA[i] = 0x12
 			i++
 			l = len(s)
@@ -1059,11 +1054,11 @@ func (m *MeshConfig_OutboundTrafficPolicy) Size() (n int) {
 func (m *MeshConfig_DefaultNetworkScope) Size() (n int) {
 	var l int
 	_ = l
-	if m.DefaultScope != 0 {
-		n += 1 + sovConfig(uint64(m.DefaultScope))
+	if m.ImportMode != 0 {
+		n += 1 + sovConfig(uint64(m.ImportMode))
 	}
-	if len(m.SharedNamespaces) > 0 {
-		for _, s := range m.SharedNamespaces {
+	if len(m.ImportNamespaces) > 0 {
+		for _, s := range m.ImportNamespaces {
 			l = len(s)
 			n += 1 + l + sovConfig(uint64(l))
 		}
@@ -1966,9 +1961,9 @@ func (m *MeshConfig_DefaultNetworkScope) Unmarshal(dAtA []byte) error {
 		switch fieldNum {
 		case 1:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field DefaultScope", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ImportMode", wireType)
 			}
-			m.DefaultScope = 0
+			m.ImportMode = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowConfig
@@ -1978,14 +1973,14 @@ func (m *MeshConfig_DefaultNetworkScope) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.DefaultScope |= (MeshConfig_DefaultNetworkScope_Mode(b) & 0x7F) << shift
+				m.ImportMode |= (MeshConfig_DefaultNetworkScope_Mode(b) & 0x7F) << shift
 				if b < 0x80 {
 					break
 				}
 			}
 		case 2:
 			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SharedNamespaces", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ImportNamespaces", wireType)
 			}
 			var stringLen uint64
 			for shift := uint(0); ; shift += 7 {
@@ -2010,7 +2005,7 @@ func (m *MeshConfig_DefaultNetworkScope) Unmarshal(dAtA []byte) error {
 			if postIndex > l {
 				return io.ErrUnexpectedEOF
 			}
-			m.SharedNamespaces = append(m.SharedNamespaces, string(dAtA[iNdEx:postIndex]))
+			m.ImportNamespaces = append(m.ImportNamespaces, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
@@ -2253,83 +2248,82 @@ var (
 func init() { proto.RegisterFile("mesh/v1alpha1/config.proto", fileDescriptorConfig) }
 
 var fileDescriptorConfig = []byte{
-	// 1245 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x56, 0xed, 0x6e, 0xdb, 0x36,
-	0x17, 0x8e, 0x92, 0xb4, 0x49, 0x8f, 0x3f, 0x22, 0xd3, 0x75, 0xab, 0xba, 0x7d, 0xf3, 0xba, 0x1e,
-	0xd6, 0x1a, 0xdd, 0x60, 0xa3, 0x09, 0x06, 0x6c, 0xfb, 0x31, 0xc0, 0xb5, 0x9d, 0xd6, 0x99, 0x63,
-	0x1b, 0x92, 0xd2, 0xad, 0x03, 0x06, 0x42, 0x91, 0x68, 0x9b, 0x88, 0x2c, 0x6a, 0x22, 0xd5, 0xb5,
-	0xd7, 0xb6, 0x1b, 0xd8, 0xcf, 0x5d, 0xc2, 0xd6, 0x2b, 0xd8, 0x25, 0x0c, 0x24, 0xa5, 0xd8, 0x6d,
-	0x8d, 0x65, 0xe8, 0x3f, 0xf1, 0x39, 0x5f, 0x3c, 0xcf, 0xf9, 0xa0, 0xa0, 0xbe, 0x24, 0x7c, 0xd1,
-	0x79, 0xfd, 0xd4, 0x0b, 0xe3, 0x85, 0xf7, 0xb4, 0xe3, 0xb3, 0x68, 0x46, 0xe7, 0xed, 0x38, 0x61,
-	0x82, 0xa1, 0x2a, 0xe5, 0x82, 0xb2, 0xb6, 0xd4, 0x68, 0xe7, 0x1a, 0xf5, 0xc3, 0x39, 0x63, 0xf3,
-	0x90, 0x74, 0x94, 0xca, 0x45, 0x3a, 0xeb, 0x04, 0x69, 0xe2, 0x09, 0xca, 0x22, 0x6d, 0x54, 0xbf,
-	0xf7, 0xbe, 0xc3, 0x38, 0x61, 0x6f, 0xde, 0x66, 0xa2, 0x27, 0x11, 0x11, 0xbf, 0xb2, 0xe4, 0x92,
-	0x46, 0xf3, 0x5c, 0xe1, 0xb8, 0x13, 0x10, 0x2e, 0x68, 0xa4, 0x3c, 0xe0, 0x24, 0x0d, 0x89, 0xd6,
-	0x6d, 0xfe, 0x5d, 0x01, 0x38, 0x23, 0x7c, 0xd1, 0x53, 0x17, 0x42, 0x5f, 0x02, 0x5a, 0xd2, 0x37,
-	0x24, 0xc1, 0xfe, 0x82, 0xf8, 0x97, 0x98, 0x93, 0xe4, 0x35, 0x49, 0x2c, 0xa3, 0x61, 0xb4, 0x6e,
-	0xd9, 0xa6, 0x92, 0xf4, 0xa4, 0xc0, 0x51, 0x38, 0x6a, 0x43, 0x55, 0x6b, 0x27, 0x24, 0x66, 0x89,
-	0xc8, 0xd5, 0xb7, 0x95, 0x7a, 0x45, 0x89, 0x6c, 0x25, 0xc9, 0xf4, 0x8f, 0xa0, 0x16, 0x50, 0xee,
-	0x5d, 0x84, 0x04, 0xc7, 0x2c, 0xa4, 0xfe, 0x5b, 0x1d, 0x86, 0x5b, 0x3b, 0x0d, 0xa3, 0xb5, 0x6f,
-	0x57, 0x33, 0xe1, 0x54, 0xc9, 0x54, 0x20, 0x8e, 0x9e, 0x40, 0x45, 0xe5, 0x86, 0x43, 0xca, 0x05,
-	0x89, 0xb0, 0x74, 0x67, 0xed, 0x36, 0x8c, 0xd6, 0x0d, 0xfb, 0x40, 0x09, 0x46, 0x0a, 0x9f, 0xb2,
-	0x44, 0xa0, 0x47, 0xa0, 0x21, 0xbc, 0x10, 0x22, 0xd6, 0x9a, 0x37, 0x94, 0x66, 0x49, 0xc1, 0x2f,
-	0x84, 0x88, 0x95, 0xde, 0x33, 0x38, 0xf0, 0x59, 0x14, 0x11, 0x5f, 0x60, 0x41, 0x97, 0x84, 0xa5,
-	0xc2, 0xba, 0xd9, 0x30, 0x5a, 0x85, 0xa3, 0x7b, 0x6d, 0xcd, 0x7a, 0x3b, 0x67, 0xbd, 0xdd, 0xcf,
-	0x58, 0xb7, 0xcb, 0x99, 0x85, 0xab, 0x0d, 0xd0, 0x67, 0x50, 0xa2, 0xd1, 0x3c, 0x21, 0x9c, 0x63,
-	0x3f, 0xf4, 0x38, 0xb7, 0xf6, 0x54, 0xd6, 0xc5, 0x0c, 0xec, 0x49, 0x0c, 0x3d, 0x86, 0x83, 0x5c,
-	0x49, 0x72, 0x43, 0x7d, 0x62, 0xed, 0x2b, 0xb5, 0x72, 0x06, 0x3b, 0x1a, 0x45, 0x4b, 0xb8, 0x7b,
-	0xe5, 0x8d, 0x45, 0x22, 0x61, 0x61, 0x48, 0x12, 0xbc, 0x64, 0x01, 0xb1, 0x6e, 0x35, 0x8c, 0x56,
-	0xf9, 0xe8, 0xab, 0xf6, 0x86, 0x26, 0x69, 0xaf, 0x2a, 0xd7, 0x1e, 0x66, 0x71, 0xaf, 0xac, 0xcf,
-	0x58, 0x40, 0xec, 0x1a, 0xdd, 0x04, 0xa3, 0x09, 0x14, 0xbc, 0x54, 0x2c, 0xb2, 0x2a, 0x58, 0xa0,
-	0x42, 0x3c, 0xb9, 0x2e, 0x44, 0x37, 0x15, 0x0b, 0x5d, 0x9b, 0x67, 0xdb, 0x96, 0x61, 0x83, 0x77,
-	0x75, 0x46, 0x43, 0xa8, 0x24, 0x01, 0xc7, 0x09, 0x99, 0x25, 0x84, 0x2f, 0x70, 0x40, 0x42, 0xef,
-	0xad, 0x55, 0xb8, 0x86, 0x53, 0xe5, 0xe5, 0x20, 0x09, 0xb8, 0xad, 0xcd, 0xfa, 0xd2, 0x0a, 0x7d,
-	0x0e, 0x65, 0x12, 0xa9, 0x1e, 0x11, 0x89, 0xe7, 0xd3, 0x68, 0x6e, 0x15, 0x55, 0x77, 0x94, 0x34,
-	0xea, 0x6a, 0x50, 0xd6, 0xda, 0xf3, 0x7d, 0x49, 0x58, 0xc8, 0xe6, 0x78, 0x46, 0x43, 0x62, 0x95,
-	0x14, 0xb5, 0x25, 0x0d, 0x8f, 0xd8, 0xfc, 0x84, 0x86, 0x04, 0x3d, 0x87, 0x72, 0x40, 0x66, 0x5e,
-	0x1a, 0x0a, 0xac, 0x87, 0xce, 0x2a, 0xab, 0x6b, 0x35, 0x36, 0x66, 0x3b, 0x95, 0x7d, 0xa2, 0xd3,
-	0xb5, 0x4b, 0x99, 0x5d, 0x36, 0x1a, 0x8f, 0xa1, 0xa4, 0x9b, 0xdd, 0x0b, 0x02, 0x49, 0xa9, 0x65,
-	0xca, 0x70, 0x2a, 0x87, 0xa2, 0x12, 0x74, 0x35, 0x8e, 0x7e, 0x81, 0xbb, 0x2c, 0x15, 0x17, 0x2c,
-	0x8d, 0x02, 0x99, 0xc2, 0x6c, 0x46, 0xfd, 0x9c, 0xe8, 0x8a, 0x0a, 0x7d, 0x6d, 0x2d, 0x27, 0x99,
-	0xb9, 0xab, 0xad, 0xd7, 0x38, 0xaf, 0xb1, 0x4d, 0x22, 0xd4, 0x87, 0xff, 0x67, 0x9c, 0xf9, 0x21,
-	0x25, 0x91, 0xc0, 0x9c, 0x06, 0xef, 0xcf, 0x98, 0x55, 0x55, 0x24, 0xde, 0xd7, 0x6a, 0x3d, 0xa5,
-	0xe5, 0xd0, 0x60, 0x7d, 0xd6, 0x50, 0x03, 0x8a, 0x3c, 0xe0, 0x38, 0x0d, 0x38, 0x8e, 0x3d, 0xb1,
-	0xb0, 0x6e, 0x2b, 0x3e, 0x81, 0x07, 0xfc, 0x3c, 0xe0, 0x53, 0x4f, 0x2c, 0x64, 0x99, 0xf9, 0x47,
-	0x65, 0xae, 0xfd, 0xa7, 0x32, 0xf3, 0x0f, 0xca, 0xfc, 0x02, 0xca, 0xba, 0x1e, 0x98, 0xb3, 0x34,
-	0xf1, 0x09, 0xb7, 0xee, 0x34, 0x76, 0x5a, 0x85, 0xa3, 0x87, 0x1b, 0xc9, 0xd1, 0xc4, 0x38, 0x4a,
-	0xd3, 0x2e, 0xf9, 0x6b, 0x27, 0x8e, 0x8e, 0xe1, 0x4e, 0x96, 0xbc, 0xbc, 0x9b, 0x60, 0x97, 0x24,
-	0xc2, 0x4b, 0x96, 0x46, 0xc2, 0xba, 0xab, 0xd7, 0x8a, 0x96, 0x3a, 0x01, 0x77, 0xa5, 0xec, 0x4c,
-	0x8a, 0xe4, 0x5a, 0x59, 0x6f, 0x1f, 0x96, 0x2c, 0x3d, 0x61, 0x59, 0x2a, 0xe1, 0x83, 0x55, 0x03,
-	0x29, 0x58, 0x06, 0x58, 0xa7, 0x12, 0xcf, 0x3c, 0x1a, 0x62, 0x16, 0x93, 0xc8, 0xba, 0xa7, 0x03,
-	0xc4, 0x2b, 0x12, 0x4f, 0x3c, 0x1a, 0x4e, 0x62, 0x12, 0xa1, 0x87, 0x50, 0x14, 0x49, 0xca, 0x05,
-	0x0e, 0xd8, 0xd2, 0xa3, 0x91, 0x55, 0x57, 0xbe, 0x0b, 0x0a, 0xeb, 0x2b, 0x08, 0x79, 0x50, 0x5d,
-	0xbb, 0x03, 0x89, 0x7c, 0x16, 0xc8, 0x76, 0xbf, 0xaf, 0xa6, 0xf1, 0xe9, 0xb5, 0xd3, 0x98, 0xdf,
-	0x72, 0x90, 0x19, 0xda, 0x15, 0xef, 0x43, 0x08, 0x31, 0x28, 0x09, 0x3f, 0xc6, 0x97, 0x84, 0xc4,
-	0x5e, 0x48, 0x5f, 0x13, 0xeb, 0x81, 0x2a, 0xd6, 0x69, 0xe6, 0x7c, 0xf5, 0x50, 0xe4, 0x21, 0x8e,
-	0x25, 0xd5, 0x72, 0xcf, 0x51, 0x16, 0x4d, 0x19, 0x0b, 0x1d, 0x22, 0x04, 0x8d, 0xe6, 0xbc, 0xed,
-	0xf6, 0xa6, 0xab, 0x6f, 0x3f, 0xfe, 0x3e, 0xf7, 0x68, 0x17, 0xc5, 0xda, 0x09, 0xcd, 0xa1, 0x96,
-	0x8f, 0x5b, 0xe6, 0x1c, 0x73, 0x9f, 0xc5, 0xc4, 0xfa, 0x9f, 0x0a, 0x7c, 0x7c, 0x5d, 0x56, 0x7d,
-	0x6d, 0x3c, 0xd6, 0xb6, 0x8e, 0x34, 0xb5, 0xab, 0xc1, 0xc7, 0x60, 0xfd, 0x37, 0x03, 0x6a, 0x1b,
-	0xe7, 0x04, 0xd9, 0xb0, 0xab, 0x16, 0xa7, 0xa1, 0x78, 0xfc, 0xf6, 0x93, 0x86, 0xad, 0x2d, 0xd7,
-	0xa4, 0x6a, 0x5c, 0xe5, 0xab, 0x39, 0x86, 0x5d, 0xb5, 0x38, 0x6b, 0x50, 0xb2, 0x07, 0xcf, 0x87,
-	0x8e, 0x6b, 0xbf, 0xc2, 0x93, 0xf1, 0xe8, 0x95, 0xb9, 0x55, 0xdf, 0xde, 0x37, 0x50, 0x05, 0x6e,
-	0x75, 0x47, 0xa3, 0xc9, 0x0f, 0xb8, 0x3b, 0x7e, 0x65, 0x1a, 0x0a, 0x7a, 0x00, 0xb7, 0x5f, 0x0e,
-	0x6d, 0xf7, 0xbc, 0x3b, 0xc2, 0xce, 0xc0, 0x7e, 0x39, 0xec, 0x0d, 0xb4, 0xc1, 0xb6, 0x94, 0xd6,
-	0xff, 0x32, 0xa0, 0xba, 0x21, 0x55, 0xf4, 0x33, 0xe4, 0x5b, 0x27, 0xa3, 0x4d, 0x27, 0xf1, 0xf5,
-	0x27, 0xd0, 0xa6, 0x52, 0xb0, 0x8b, 0x99, 0x3b, 0xed, 0xfe, 0x0b, 0xa8, 0xf0, 0x85, 0x97, 0x90,
-	0x00, 0x47, 0xde, 0x92, 0xf0, 0xd8, 0x93, 0x73, 0xb7, 0xdd, 0xd8, 0x91, 0xaf, 0xbb, 0x16, 0x8c,
-	0xaf, 0xf0, 0xe6, 0x77, 0x59, 0xce, 0x05, 0xd8, 0x1b, 0x8e, 0x5f, 0x76, 0x47, 0xc3, 0xbe, 0xb9,
-	0x85, 0x10, 0x94, 0xbb, 0xa3, 0x11, 0x1e, 0x77, 0xcf, 0x06, 0xce, 0xb4, 0xdb, 0x1b, 0x38, 0xa6,
-	0x81, 0x6a, 0x50, 0xe9, 0x9d, 0xdb, 0xf6, 0x60, 0xec, 0xae, 0x70, 0x73, 0xbb, 0xf9, 0x0d, 0xd4,
-	0x36, 0x3e, 0x4a, 0x68, 0x0f, 0x76, 0x26, 0x27, 0x27, 0xe6, 0x96, 0xf4, 0xdc, 0x1f, 0x9c, 0x74,
-	0xcf, 0x47, 0xae, 0x69, 0x20, 0x80, 0x9b, 0x8e, 0x6b, 0x0f, 0x7b, 0xae, 0xb9, 0xdd, 0x7c, 0x04,
-	0xb0, 0x7a, 0x6c, 0xd0, 0x3e, 0xec, 0x8e, 0x27, 0xe3, 0x81, 0xb9, 0x85, 0xca, 0x00, 0x67, 0xe7,
-	0x8a, 0x53, 0x77, 0xe4, 0x98, 0x46, 0xf3, 0x31, 0x54, 0x3e, 0x1a, 0x03, 0xa9, 0xee, 0x0e, 0x7e,
-	0x74, 0xcd, 0x2d, 0xf9, 0x75, 0xea, 0x4c, 0xc6, 0xa6, 0x71, 0xba, 0xbb, 0x7f, 0x60, 0x9a, 0xa7,
-	0xbb, 0xfb, 0xc8, 0xac, 0x36, 0x39, 0x14, 0xd7, 0xd7, 0x09, 0xb2, 0x60, 0x2f, 0x5f, 0xe9, 0xfa,
-	0x47, 0x27, 0x3f, 0xa2, 0x21, 0x14, 0x45, 0x28, 0x9f, 0x6e, 0xdd, 0xf7, 0xea, 0xc7, 0xa6, 0x70,
-	0xf4, 0xe8, 0x5f, 0x86, 0xc7, 0x1d, 0x39, 0xf9, 0x94, 0xd8, 0x05, 0x11, 0xf2, 0xfc, 0xf0, 0xac,
-	0xf5, 0xfb, 0xbb, 0x43, 0xe3, 0x8f, 0x77, 0x87, 0xc6, 0x9f, 0xef, 0x0e, 0x8d, 0x9f, 0xea, 0xda,
-	0x03, 0x65, 0x1d, 0x2f, 0xa6, 0x9d, 0xf7, 0xfe, 0xe4, 0x2e, 0x6e, 0xaa, 0x05, 0x7a, 0xfc, 0x4f,
-	0x00, 0x00, 0x00, 0xff, 0xff, 0xf5, 0x70, 0xd0, 0x21, 0x32, 0x0a, 0x00, 0x00,
+	// 1228 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x56, 0xdd, 0x6e, 0xdb, 0xb6,
+	0x17, 0x8f, 0x92, 0xb4, 0x49, 0x8f, 0x3f, 0x22, 0xd3, 0x75, 0xab, 0xba, 0xfd, 0xe7, 0xef, 0x7a,
+	0x58, 0x6b, 0x74, 0x83, 0x8d, 0x24, 0x18, 0xb0, 0xed, 0xce, 0x75, 0x9c, 0xd6, 0x99, 0x63, 0x1b,
+	0x92, 0xd2, 0x2d, 0xbb, 0x21, 0x14, 0x89, 0xb6, 0x89, 0xc8, 0xa2, 0x26, 0x52, 0x5d, 0xfb, 0x6c,
+	0x7b, 0x81, 0x5d, 0xf6, 0x0d, 0x36, 0xf4, 0x49, 0x06, 0x92, 0x52, 0xec, 0x36, 0xc6, 0x32, 0xf4,
+	0x4e, 0xfc, 0x9d, 0x2f, 0x9e, 0xdf, 0xf9, 0xa0, 0xa0, 0xbe, 0x20, 0x7c, 0xde, 0x79, 0x7b, 0xe0,
+	0x85, 0xf1, 0xdc, 0x3b, 0xe8, 0xf8, 0x2c, 0x9a, 0xd2, 0x59, 0x3b, 0x4e, 0x98, 0x60, 0xa8, 0x4a,
+	0xb9, 0xa0, 0xac, 0x2d, 0x35, 0xda, 0xb9, 0x46, 0x7d, 0x7f, 0xc6, 0xd8, 0x2c, 0x24, 0x1d, 0xa5,
+	0x72, 0x99, 0x4e, 0x3b, 0x41, 0x9a, 0x78, 0x82, 0xb2, 0x48, 0x1b, 0xd5, 0x1f, 0x7d, 0xea, 0x30,
+	0x4e, 0xd8, 0xbb, 0xf7, 0x99, 0xe8, 0x45, 0x44, 0xc4, 0xef, 0x2c, 0xb9, 0xa2, 0xd1, 0x2c, 0x57,
+	0x38, 0xea, 0x04, 0x84, 0x0b, 0x1a, 0x29, 0x0f, 0x38, 0x49, 0x43, 0xa2, 0x75, 0x9b, 0x7f, 0x55,
+	0x00, 0xce, 0x08, 0x9f, 0xf7, 0xd4, 0x85, 0xd0, 0xb7, 0x80, 0x16, 0xf4, 0x1d, 0x49, 0xb0, 0x3f,
+	0x27, 0xfe, 0x15, 0xe6, 0x24, 0x79, 0x4b, 0x12, 0xcb, 0x68, 0x18, 0xad, 0x7b, 0xb6, 0xa9, 0x24,
+	0x3d, 0x29, 0x70, 0x14, 0x8e, 0xda, 0x50, 0xd5, 0xda, 0x09, 0x89, 0x59, 0x22, 0x72, 0xf5, 0x4d,
+	0xa5, 0x5e, 0x51, 0x22, 0x5b, 0x49, 0x32, 0xfd, 0x43, 0xa8, 0x05, 0x94, 0x7b, 0x97, 0x21, 0xc1,
+	0x31, 0x0b, 0xa9, 0xff, 0x5e, 0x87, 0xe1, 0xd6, 0x56, 0xc3, 0x68, 0xed, 0xda, 0xd5, 0x4c, 0x38,
+	0x51, 0x32, 0x15, 0x88, 0xa3, 0x17, 0x50, 0x51, 0xb9, 0xe1, 0x90, 0x72, 0x41, 0x22, 0x2c, 0xdd,
+	0x59, 0xdb, 0x0d, 0xa3, 0x75, 0xc7, 0xde, 0x53, 0x82, 0xa1, 0xc2, 0x27, 0x2c, 0x11, 0xe8, 0x19,
+	0x68, 0x08, 0xcf, 0x85, 0x88, 0xb5, 0xe6, 0x1d, 0xa5, 0x59, 0x52, 0xf0, 0x6b, 0x21, 0x62, 0xa5,
+	0xf7, 0x12, 0xf6, 0x7c, 0x16, 0x45, 0xc4, 0x17, 0x58, 0xd0, 0x05, 0x61, 0xa9, 0xb0, 0xee, 0x36,
+	0x8c, 0x56, 0xe1, 0xf0, 0x51, 0x5b, 0xb3, 0xde, 0xce, 0x59, 0x6f, 0x1f, 0x67, 0xac, 0xdb, 0xe5,
+	0xcc, 0xc2, 0xd5, 0x06, 0xe8, 0x2b, 0x28, 0xd1, 0x68, 0x96, 0x10, 0xce, 0xb1, 0x1f, 0x7a, 0x9c,
+	0x5b, 0x3b, 0x2a, 0xeb, 0x62, 0x06, 0xf6, 0x24, 0x86, 0x9e, 0xc3, 0x5e, 0xae, 0x24, 0xb9, 0xa1,
+	0x3e, 0xb1, 0x76, 0x95, 0x5a, 0x39, 0x83, 0x1d, 0x8d, 0xa2, 0x05, 0x3c, 0xbc, 0xf6, 0xc6, 0x22,
+	0x91, 0xb0, 0x30, 0x24, 0x09, 0x5e, 0xb0, 0x80, 0x58, 0xf7, 0x1a, 0x46, 0xab, 0x7c, 0xf8, 0x5d,
+	0x7b, 0x4d, 0x93, 0xb4, 0x97, 0x95, 0x6b, 0x0f, 0xb2, 0xb8, 0xd7, 0xd6, 0x67, 0x2c, 0x20, 0x76,
+	0x8d, 0xae, 0x83, 0xd1, 0x18, 0x0a, 0x5e, 0x2a, 0xe6, 0x59, 0x15, 0x2c, 0x50, 0x21, 0x5e, 0xdc,
+	0x16, 0xa2, 0x9b, 0x8a, 0xb9, 0xae, 0xcd, 0xcb, 0x4d, 0xcb, 0xb0, 0xc1, 0xbb, 0x3e, 0xa3, 0x01,
+	0x54, 0x92, 0x80, 0xe3, 0x84, 0x4c, 0x13, 0xc2, 0xe7, 0x38, 0x20, 0xa1, 0xf7, 0xde, 0x2a, 0xdc,
+	0xc2, 0xa9, 0xf2, 0xb2, 0x97, 0x04, 0xdc, 0xd6, 0x66, 0xc7, 0xd2, 0x0a, 0x7d, 0x0d, 0x65, 0x12,
+	0xa9, 0x1e, 0x11, 0x89, 0xe7, 0xd3, 0x68, 0x66, 0x15, 0x55, 0x77, 0x94, 0x34, 0xea, 0x6a, 0x50,
+	0xd6, 0xda, 0xf3, 0x7d, 0x49, 0x58, 0xc8, 0x66, 0x78, 0x4a, 0x43, 0x62, 0x95, 0x14, 0xb5, 0x25,
+	0x0d, 0x0f, 0xd9, 0xec, 0x84, 0x86, 0x04, 0xbd, 0x82, 0x72, 0x40, 0xa6, 0x5e, 0x1a, 0x0a, 0xac,
+	0x87, 0xce, 0x2a, 0xab, 0x6b, 0x35, 0xd6, 0x66, 0x3b, 0x91, 0x7d, 0xa2, 0xd3, 0xb5, 0x4b, 0x99,
+	0x5d, 0x36, 0x1a, 0xcf, 0xa1, 0xa4, 0x9b, 0xdd, 0x0b, 0x02, 0x49, 0xa9, 0x65, 0xca, 0x70, 0x2a,
+	0x87, 0xa2, 0x12, 0x74, 0x35, 0x8e, 0x7e, 0x83, 0x87, 0x2c, 0x15, 0x97, 0x2c, 0x8d, 0x02, 0x99,
+	0xc2, 0x74, 0x4a, 0xfd, 0x9c, 0xe8, 0x8a, 0x0a, 0x7d, 0x6b, 0x2d, 0xc7, 0x99, 0xb9, 0xab, 0xad,
+	0x57, 0x38, 0xaf, 0xb1, 0x75, 0x22, 0x74, 0x0c, 0xff, 0xcf, 0x38, 0xf3, 0x43, 0x4a, 0x22, 0x81,
+	0x39, 0x0d, 0x3e, 0x9d, 0x31, 0xab, 0xaa, 0x48, 0x7c, 0xac, 0xd5, 0x7a, 0x4a, 0xcb, 0xa1, 0xc1,
+	0xea, 0xac, 0xa1, 0x06, 0x14, 0x79, 0xc0, 0x71, 0x1a, 0x70, 0x1c, 0x7b, 0x62, 0x6e, 0xdd, 0x57,
+	0x7c, 0x02, 0x0f, 0xf8, 0x79, 0xc0, 0x27, 0x9e, 0x98, 0xcb, 0x32, 0xf3, 0x1b, 0x65, 0xae, 0xfd,
+	0xa7, 0x32, 0xf3, 0xcf, 0xca, 0xfc, 0x1a, 0xca, 0xba, 0x1e, 0x98, 0xb3, 0x34, 0xf1, 0x09, 0xb7,
+	0x1e, 0x34, 0xb6, 0x5a, 0x85, 0xc3, 0xa7, 0x6b, 0xc9, 0xd1, 0xc4, 0x38, 0x4a, 0xd3, 0x2e, 0xf9,
+	0x2b, 0x27, 0x8e, 0x8e, 0xe0, 0x41, 0x96, 0xbc, 0xbc, 0x9b, 0x60, 0x57, 0x24, 0xc2, 0x0b, 0x96,
+	0x46, 0xc2, 0x7a, 0xa8, 0xd7, 0x8a, 0x96, 0x3a, 0x01, 0x77, 0xa5, 0xec, 0x4c, 0x8a, 0xe4, 0x5a,
+	0x59, 0x6d, 0x1f, 0x96, 0x2c, 0x3c, 0x61, 0x59, 0x2a, 0xe1, 0xbd, 0x65, 0x03, 0x29, 0x58, 0x06,
+	0x58, 0xa5, 0x12, 0x4f, 0x3d, 0x1a, 0x62, 0x16, 0x93, 0xc8, 0x7a, 0xa4, 0x03, 0xc4, 0x4b, 0x12,
+	0x4f, 0x3c, 0x1a, 0x8e, 0x63, 0x12, 0xa1, 0xa7, 0x50, 0x14, 0x49, 0xca, 0x05, 0x0e, 0xd8, 0xc2,
+	0xa3, 0x91, 0x55, 0x57, 0xbe, 0x0b, 0x0a, 0x3b, 0x56, 0x10, 0xf2, 0xa0, 0xba, 0x72, 0x07, 0x12,
+	0xf9, 0x2c, 0x90, 0xed, 0xfe, 0x58, 0x4d, 0xe3, 0xc1, 0xad, 0xd3, 0x98, 0xdf, 0xb2, 0x9f, 0x19,
+	0xda, 0x15, 0xef, 0x73, 0x08, 0x31, 0x28, 0x09, 0x3f, 0xc6, 0x57, 0x84, 0xc4, 0x5e, 0x48, 0xdf,
+	0x12, 0xeb, 0x89, 0x2a, 0xd6, 0x69, 0xe6, 0x7c, 0xf9, 0x50, 0xe4, 0x21, 0x8e, 0x24, 0xd5, 0x72,
+	0xcf, 0x51, 0x16, 0x4d, 0x18, 0x0b, 0x1d, 0x22, 0x04, 0x8d, 0x66, 0xbc, 0xed, 0xf6, 0x26, 0xcb,
+	0x6f, 0x3f, 0xfe, 0x29, 0xf7, 0x68, 0x17, 0xc5, 0xca, 0x09, 0xcd, 0xa0, 0x96, 0x8f, 0x5b, 0xe6,
+	0x1c, 0x73, 0x9f, 0xc5, 0xc4, 0xfa, 0x9f, 0x0a, 0x7c, 0x74, 0x5b, 0x56, 0xc7, 0xda, 0x78, 0xa4,
+	0x6d, 0x1d, 0x69, 0x6a, 0x57, 0x83, 0x9b, 0x60, 0xfd, 0x0f, 0x03, 0x6a, 0x6b, 0xe7, 0x04, 0xd9,
+	0xb0, 0xad, 0x16, 0xa7, 0xa1, 0x78, 0xfc, 0xf1, 0x8b, 0x86, 0xad, 0x2d, 0xd7, 0xa4, 0x6a, 0x5c,
+	0xe5, 0xab, 0x39, 0x82, 0x6d, 0xb5, 0x38, 0x6b, 0x50, 0xb2, 0xfb, 0xaf, 0x06, 0x8e, 0x6b, 0x5f,
+	0xe0, 0xf1, 0x68, 0x78, 0x61, 0x6e, 0xd4, 0x37, 0x77, 0x0d, 0x54, 0x81, 0x7b, 0xdd, 0xe1, 0x70,
+	0xfc, 0x33, 0xee, 0x8e, 0x2e, 0x4c, 0x43, 0x41, 0x4f, 0xe0, 0xfe, 0x9b, 0x81, 0xed, 0x9e, 0x77,
+	0x87, 0xd8, 0xe9, 0xdb, 0x6f, 0x06, 0xbd, 0xbe, 0x36, 0xd8, 0x94, 0xd2, 0xfa, 0x07, 0x03, 0xaa,
+	0x6b, 0x52, 0x45, 0x17, 0x50, 0xa0, 0x0b, 0xf5, 0x96, 0xae, 0xa4, 0xf0, 0xfd, 0x17, 0x90, 0xa6,
+	0x12, 0xb0, 0x41, 0x3b, 0x53, 0x57, 0xff, 0x06, 0x2a, 0x99, 0xeb, 0xc8, 0x5b, 0x10, 0x1e, 0x7b,
+	0x72, 0xe6, 0x36, 0x1b, 0x5b, 0xf2, 0x65, 0xd7, 0x82, 0xd1, 0x35, 0xde, 0x3c, 0xc8, 0xf2, 0x45,
+	0x50, 0xee, 0x0e, 0x87, 0x78, 0xd4, 0x3d, 0xeb, 0x3b, 0x93, 0x6e, 0xaf, 0xef, 0x98, 0x1b, 0xa8,
+	0x06, 0x95, 0xde, 0xb9, 0x6d, 0xf7, 0x47, 0xee, 0x12, 0x37, 0x8d, 0xe6, 0x0f, 0x50, 0x5b, 0xfb,
+	0x06, 0xa1, 0x1d, 0xd8, 0x1a, 0x9f, 0x9c, 0x98, 0x1b, 0xa8, 0x00, 0x3b, 0xc7, 0xfd, 0x93, 0xee,
+	0xf9, 0xd0, 0x35, 0x0d, 0x04, 0x70, 0xd7, 0x71, 0xed, 0x41, 0xcf, 0x35, 0x37, 0x9b, 0xcf, 0x00,
+	0x96, 0x6f, 0x0b, 0xda, 0x85, 0xed, 0xd1, 0x78, 0xd4, 0x37, 0x37, 0x50, 0x19, 0xe0, 0xec, 0x5c,
+	0x51, 0xe8, 0x0e, 0x1d, 0xd3, 0x68, 0x3e, 0x87, 0xca, 0x8d, 0xae, 0x97, 0xea, 0x6e, 0xff, 0x17,
+	0xd7, 0xdc, 0x90, 0x5f, 0xa7, 0xce, 0x78, 0x64, 0x1a, 0xa7, 0xdb, 0xbb, 0x7b, 0xa6, 0x79, 0xba,
+	0xbd, 0x8b, 0xcc, 0x6a, 0x93, 0x43, 0x71, 0x75, 0x7b, 0x20, 0x0b, 0x76, 0xf2, 0x0d, 0xae, 0xff,
+	0x6b, 0xf2, 0x23, 0x1a, 0x40, 0x51, 0x84, 0xf2, 0xa5, 0xd6, 0x6d, 0xae, 0xfe, 0x63, 0x0a, 0x87,
+	0xcf, 0xfe, 0x65, 0x56, 0xdc, 0xa1, 0x93, 0x0f, 0x85, 0x5d, 0x10, 0x21, 0xcf, 0x0f, 0x2f, 0x5b,
+	0x7f, 0x7e, 0xdc, 0x37, 0x3e, 0x7c, 0xdc, 0x37, 0xfe, 0xfe, 0xb8, 0x6f, 0xfc, 0x5a, 0xd7, 0x1e,
+	0x28, 0xeb, 0x78, 0x31, 0xed, 0x7c, 0xf2, 0xe3, 0x76, 0x79, 0x57, 0xed, 0xcb, 0xa3, 0x7f, 0x02,
+	0x00, 0x00, 0xff, 0xff, 0x63, 0xce, 0x0d, 0x91, 0x21, 0x0a, 0x00, 0x00,
 }
diff --git a/mesh/v1alpha1/config.proto b/mesh/v1alpha1/config.proto
index d468b2c0ec..f09b789ed1 100644
--- a/mesh/v1alpha1/config.proto
+++ b/mesh/v1alpha1/config.proto
@@ -199,41 +199,37 @@ message MeshConfig {
   // Fallback to old identity format(without trust domain) if not set.
   string trust_domain = 26;
 
-  // Default network scope settings for the mesh. Network scope controls the reachability of
-  // sidecars to other services in the mesh.
+  // Default network scope settings for each workload in the mesh. Network
+  // scope controls the reachability of workloads to other services in the
+  // mesh.
   message DefaultNetworkScope {
     enum Mode {
-      // Invalid mode
-      INVALID = 0;
-
-      // Configure routes to services in all namespaces.
-      ALL_NAMESPACES = 1;
-
-      // Configure routes to services in the same namespace as the sidecar
-      // in addition to namespaces specified in sharedNamespaces.
-      CURRENT_NAMESPACE = 2;
+      // Configure routes to services in all namespaces, i.e. import
+      // services from all namespaces.
+      ALL_NAMESPACES = 0;
+
+      // Only configure routes to services that are in the same namespace
+      // as the workload as well as services in namespaces specified in
+      // importNamespaces.
+      CURRENT_NAMESPACE = 1;
     }
 
-    // REQUIRED: The default scope associated with every sidecar in the mesh.
-    Mode default_scope = 1;
-
-    // Specifies one or more namespaces that should be accessible to all
-    // sidecars in the mesh (such as istio-system). This field has no
-    // effect when the default scope is set to ALL_NAMESPACES and a sidecar
-    // has no explicit NetworkScope resource attached to it. However when
-    // the sidecar has a NetworkScope resource attached to it (and the
-    // default scope is set to ALL_NAMESPACES or CURRENT_NAMESPACE),
-    // sidecar's network scope will include services/config objects
-    // specified in the NetworkScope object as well as services/config
-    // objects specified in the sharedNamespaces.
-    repeated string shared_namespaces = 2;
+    // REQUIRED: The default import setting for every workload in the mesh.
+    Mode import_mode = 1;
+
+    // Specifies one or more namespaces that should be imported by default
+    // in all user defined NetworkScope resources in addition to the
+    // namespaces explicitly specified by the end user. Use this setting to
+    // automatically import services/resources from namespaces such as
+    // istio-system that all workloads in the mesh depend upon.
+    repeated string import_namespaces = 2;
   }
 
-  // The default network scope associated with every sidecar in the mesh.
-  // Pilot will program the routes in the sidecars accordingly. If omitted,
-  // sidecars will be able to reach every service in the mesh. The default
-  // scope can be overriden by supplying a NetworkScope resource per
-  // namespace.
+  // The default network scope associated with every workload in the mesh.
+  // Pilot will program the routes in the sidecars and gateways
+  // accordingly. If omitted, sidecars will be configured to reach every
+  // service in the mesh. The default scope can be overriden by supplying a
+  // NetworkScope resource per namespace.
   DefaultNetworkScope default_network_scope = 29;
 
   // $hide_from_docs
diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
index 228c8e98c7..17876816aa 100644
--- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
+++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
@@ -309,11 +309,11 @@ <h2 id="MeshConfig">MeshConfig</h2>
 <td><code>defaultNetworkScope</code></td>
 <td><code><a href="#MeshConfig-DefaultNetworkScope">MeshConfig.DefaultNetworkScope</a></code></td>
 <td>
-<p>The default network scope associated with every sidecar in the mesh.
-Pilot will program the routes in the sidecars accordingly. If omitted,
-sidecars will be able to reach every service in the mesh. The default
-scope can be overriden by supplying a NetworkScope resource per
-namespace.</p>
+<p>The default network scope associated with every workload in the mesh.
+Pilot will program the routes in the sidecars and gateways
+accordingly. If omitted, sidecars will be configured to reach every
+service in the mesh. The default scope can be overriden by supplying a
+NetworkScope resource per namespace.</p>
 
 </td>
 </tr>
@@ -345,8 +345,9 @@ <h2 id="MeshConfig-AccessLogEncoding">MeshConfig.AccessLogEncoding</h2>
 </section>
 <h2 id="MeshConfig-DefaultNetworkScope">MeshConfig.DefaultNetworkScope</h2>
 <section>
-<p>Default network scope settings for the mesh. Network scope controls the reachability of
-sidecars to other services in the mesh.</p>
+<p>Default network scope settings for each workload in the mesh. Network
+scope controls the reachability of workloads to other services in the
+mesh.</p>
 
 <table class="message-fields">
 <thead>
@@ -357,27 +358,23 @@ <h2 id="MeshConfig-DefaultNetworkScope">MeshConfig.DefaultNetworkScope</h2>
 </tr>
 </thead>
 <tbody>
-<tr id="MeshConfig-DefaultNetworkScope-default_scope">
-<td><code>defaultScope</code></td>
+<tr id="MeshConfig-DefaultNetworkScope-import_mode">
+<td><code>importMode</code></td>
 <td><code><a href="#MeshConfig-DefaultNetworkScope-Mode">MeshConfig.DefaultNetworkScope.Mode</a></code></td>
 <td>
-<p>REQUIRED: The default scope associated with every sidecar in the mesh.</p>
+<p>REQUIRED: The default import setting for every workload in the mesh.</p>
 
 </td>
 </tr>
-<tr id="MeshConfig-DefaultNetworkScope-shared_namespaces">
-<td><code>sharedNamespaces</code></td>
+<tr id="MeshConfig-DefaultNetworkScope-import_namespaces">
+<td><code>importNamespaces</code></td>
 <td><code>string[]</code></td>
 <td>
-<p>Specifies one or more namespaces that should be accessible to all
-sidecars in the mesh (such as istio-system). This field has no
-effect when the default scope is set to ALL<em>NAMESPACES and a sidecar
-has no explicit NetworkScope resource attached to it. However when
-the sidecar has a NetworkScope resource attached to it (and the
-default scope is set to ALL</em>NAMESPACES or CURRENT_NAMESPACE),
-sidecar&rsquo;s network scope will include services/config objects
-specified in the NetworkScope object as well as services/config
-objects specified in the sharedNamespaces.</p>
+<p>Specifies one or more namespaces that should be imported by default
+in all user defined NetworkScope resources in addition to the
+namespaces explicitly specified by the end user. Use this setting to
+automatically import services/resources from namespaces such as
+istio-system that all workloads in the mesh depend upon.</p>
 
 </td>
 </tr>
@@ -394,25 +391,20 @@ <h2 id="MeshConfig-DefaultNetworkScope-Mode">MeshConfig.DefaultNetworkScope.Mode
 </tr>
 </thead>
 <tbody>
-<tr id="MeshConfig-DefaultNetworkScope-Mode-INVALID">
-<td><code>INVALID</code></td>
-<td>
-<p>Invalid mode</p>
-
-</td>
-</tr>
 <tr id="MeshConfig-DefaultNetworkScope-Mode-ALL_NAMESPACES">
 <td><code>ALL_NAMESPACES</code></td>
 <td>
-<p>Configure routes to services in all namespaces.</p>
+<p>Configure routes to services in all namespaces, i.e. import
+services from all namespaces.</p>
 
 </td>
 </tr>
 <tr id="MeshConfig-DefaultNetworkScope-Mode-CURRENT_NAMESPACE">
 <td><code>CURRENT_NAMESPACE</code></td>
 <td>
-<p>Configure routes to services in the same namespace as the sidecar
-in addition to namespaces specified in sharedNamespaces.</p>
+<p>Only configure routes to services that are in the same namespace
+as the workload as well as services in namespaces specified in
+importNamespaces.</p>
 
 </td>
 </tr>
diff --git a/networking/v1alpha3/istio.networking.v1alpha3.pb.html b/networking/v1alpha3/istio.networking.v1alpha3.pb.html
index 91b8ba78f1..908c879d90 100644
--- a/networking/v1alpha3/istio.networking.v1alpha3.pb.html
+++ b/networking/v1alpha3/istio.networking.v1alpha3.pb.html
@@ -2394,43 +2394,43 @@ <h2 id="LoadBalancerSettings-SimpleLB">LoadBalancerSettings.SimpleLB</h2>
 <h2 id="NetworkScope">NetworkScope</h2>
 <section>
 <p><code>NetworkScope</code> describes the set of services that a workload depends on
-for its operation. In other words, it describes the properties of egress
-traffic from a given workload. By default, the service mesh established
-by Istio will have a full mesh connectivity - i.e. every workload will
-have proxy configuration required to reach every other workload in the
-mesh. However most connectivity graphs are sparse in practice. The
-NetworkScope provides a way to prune the connectivity graph
-(i.e. dependencies) associated with each workload.</p>
+for its operation. In other words, it describes the properties of
+outgoing traffic from a given workload. By default, the service mesh
+established by Istio will have a full mesh connectivity - i.e. every
+workload will have proxy configuration required to reach every other
+workload in the mesh. However most connectivity graphs are sparse in
+practice. The NetworkScope provides a way to declare the service
+dependencies associated with each workload such that the amount of
+configuration sent to the sidecars can be scoped to the requisite
+dependencies.</p>
 
 <p>Services and configuration in a mesh are organized into one or more
 namespaces (e.g., a Kubernetes namespace or a CF org/space).  Workloads
-in a namespace will be able to reach other workloads in the same
-namespace. To declare dependencies on workloads in other namespaces, a
-NetworkScope resource has to be specified in the current
-namespace. <em><em>Each namespace can have only one NetworkScope
-resource</em></em>. The behavior of the system is undefined if more than one
-NetworkScope resource exists in a given namespace. The set of
-dependencies specified in a NetworkScope resource will be used to
-compute the [outbound] connectivity graph for every workload in the
-namespace.</p>
-
-<p>NOTE: If workloads in the mesh depend only on other workloads in the
-same namespace, use the mesh global setting to specify the default
-network scope as CURRENT<em>NAMESPACE. To facilitate incremental pruning of
-the connectivity graph, the default network scope for the mesh is set to
-ALL</em>NAMESPACES. In otherwords, every workload will be able to reach
-every other workload. Specifying a NetworkScope resource in a namespace
-will automatically prune the configuration for the workloads in that
+in a namespace have an implicit dependency on other workloads in the
+same namespace. In addition, to declare dependencies on workloads in
+other namespaces, a NetworkScope resource has to be specified in the
+current namespace. <em><em>Each namespace MUST have only one NetworkScope
+resource named &ldquo;default&rdquo;</em></em>. The behavior of the system is undefined if
+more than one NetworkScope resource exists in a given namespace. The set
+of dependencies specified in a NetworkScope resource will be used to
+compute the sidecar configuration for every workload in the namespace.</p>
+
+<p>NOTE 1: If workloads in the mesh depend only on other workloads in the
+same namespace, set defaultNetworkScope.importMode to CURRENT_NAMESPACE
+in the mesh global config map (in values.yaml).</p>
+
+<p>NOTE 2: To facilitate incremental pruning of the the sidecar
+configuration, the default import mode for the mesh is set to
+ALL_NAMESPACES. In other words, every workload will be able to reach
+every other workload. Adding a NetworkScope resource in a namespace will
+automatically prune the configuration for the workloads in that
 namespace.</p>
 
 <p>The following examples illustrate a few specific use cases of NetworkScope.</p>
 
 <p>The example below delcares a NetworkScope resource in the prod-us1
-namespace. The workload with the <code>version: newlandingpage</code> label will be
-able to reach all services declared in the egress namespace as well as
-the landing.qa.foo.com service in the qa namespace. All other workloads
-in the prod-us1 namespace will be able to reach the services in the
-egress namespace only.</p>
+namespace that specifies that workloads in the namespace will be able to
+reach the services in the prod-apis namespace only.</p>
 
 <pre><code class="language-yaml">apiVersion: networking.istio.io/v1alpha3
 kind: NetworkScope
@@ -2439,14 +2439,8 @@ <h2 id="NetworkScope">NetworkScope</h2>
   namespace: prod-us1
 spec:
   dependencies:
-  - sourceWorkloadLabels:
-      version: newlandingpage
-    imports:
-    - namespace: qa
-      host: landing.qa.foo.com
-    - namespace: egress
   - imports:
-    - namespace: egress
+    - namespace: prod-apis
 </code></pre>
 
 <p>In a mesh where the default network scope is set to CURRENT_NAMESPACE
@@ -2461,17 +2455,14 @@ <h2 id="NetworkScope">NetworkScope</h2>
   namespace: metrics-collection
 spec:
   dependencies:
-  - sourceWorkloadLabels:
-       app: metricsScraper
-    imports:
+  - imports:
     - namespace: '*'
 </code></pre>
 
 <p>The configuration above will allow workloads in the metrics-collection
-namespace with the labels <code>app: metricsScraper</code> to access service in any
-namespace while other workloads in the same namespace will be configured
-for namespace local access as per the global default network scope
-(CURRENT_NAMESPACE).</p>
+namespace to access service in any namespace while workloads in other
+namespaces will be configured for namespace local access as per the
+global default network scope (CURRENT_NAMESPACE).</p>
 
 <table class="message-fields">
 <thead>
@@ -2488,7 +2479,7 @@ <h2 id="NetworkScope">NetworkScope</h2>
 <td>
 <p>REQUIRED. The set of services that workloads in this namespace are
 expected to talk to, in addition to other workloads in the same
-namespace. Dependencies describe the properties of egress traffic from
+namespace. Dependencies describe the properties of outbound traffic from
 a given workload.</p>
 
 </td>
@@ -2510,20 +2501,6 @@ <h2 id="NetworkScope-Dependency">NetworkScope.Dependency</h2>
 </tr>
 </thead>
 <tbody>
-<tr id="NetworkScope-Dependency-source_workload_labels">
-<td><code>sourceWorkloadLabels</code></td>
-<td><code>map&lt;string,&nbsp;string&gt;</code></td>
-<td>
-<p>One or more labels that indicate a specific set of pods/VMs on which
-this dependency configuration should be applied.  The scope of label
-search is platform dependent.  On Kubernetes, for example, the scope
-includes pods running in the namespace in which the NetworkScope
-resource is present.  If the sourceWorkloadLabels are omitted, the
-imports specified will be applicable to all workloads in the current
-configuration namespace.</p>
-
-</td>
-</tr>
 <tr id="NetworkScope-Dependency-imports">
 <td><code>imports</code></td>
 <td><code><a href="#NetworkScope-Import">NetworkScope.Import[]</a></code></td>
@@ -2534,7 +2511,7 @@ <h2 id="NetworkScope-Dependency">NetworkScope.Dependency</h2>
 configured with information required to reach other services in the
 same namespace and the imported services. In addition to the
 explicitly specified namespaces, namespaces specified in the global
-mesh config (through NetworkScope.sharedNamespaces) will also be
+mesh config (through defaultNetworkScope.importNamespaces) will also be
 imported.</p>
 
 </td>
diff --git a/networking/v1alpha3/network_scope.pb.go b/networking/v1alpha3/network_scope.pb.go
index d04b604135..868ced0ded 100644
--- a/networking/v1alpha3/network_scope.pb.go
+++ b/networking/v1alpha3/network_scope.pb.go
@@ -41,44 +41,43 @@ func (x ConfigScope) String() string {
 func (ConfigScope) EnumDescriptor() ([]byte, []int) { return fileDescriptorNetworkScope, []int{0} }
 
 // `NetworkScope` describes the set of services that a workload depends on
-// for its operation. In other words, it describes the properties of egress
-// traffic from a given workload. By default, the service mesh established
-// by Istio will have a full mesh connectivity - i.e. every workload will
-// have proxy configuration required to reach every other workload in the
-// mesh. However most connectivity graphs are sparse in practice. The
-// NetworkScope provides a way to prune the connectivity graph
-// (i.e. dependencies) associated with each workload.
+// for its operation. In other words, it describes the properties of
+// outgoing traffic from a given workload. By default, the service mesh
+// established by Istio will have a full mesh connectivity - i.e. every
+// workload will have proxy configuration required to reach every other
+// workload in the mesh. However most connectivity graphs are sparse in
+// practice. The NetworkScope provides a way to declare the service
+// dependencies associated with each workload such that the amount of
+// configuration sent to the sidecars can be scoped to the requisite
+// dependencies.
 //
 // Services and configuration in a mesh are organized into one or more
 // namespaces (e.g., a Kubernetes namespace or a CF org/space).  Workloads
-// in a namespace will be able to reach other workloads in the same
-// namespace. To declare dependencies on workloads in other namespaces, a
-// NetworkScope resource has to be specified in the current
-// namespace. *_Each namespace can have only one NetworkScope
-// resource_*. The behavior of the system is undefined if more than one
-// NetworkScope resource exists in a given namespace. The set of
-// dependencies specified in a NetworkScope resource will be used to
-// compute the [outbound] connectivity graph for every workload in the
-// namespace.
+// in a namespace have an implicit dependency on other workloads in the
+// same namespace. In addition, to declare dependencies on workloads in
+// other namespaces, a NetworkScope resource has to be specified in the
+// current namespace. *_Each namespace MUST have only one NetworkScope
+// resource named "default"_*. The behavior of the system is undefined if
+// more than one NetworkScope resource exists in a given namespace. The set
+// of dependencies specified in a NetworkScope resource will be used to
+// compute the sidecar configuration for every workload in the namespace.
+//
+// NOTE 1: If workloads in the mesh depend only on other workloads in the
+// same namespace, set defaultNetworkScope.importMode to CURRENT_NAMESPACE
+// in the mesh global config map (in values.yaml).
 //
-// NOTE: If workloads in the mesh depend only on other workloads in the
-// same namespace, use the mesh global setting to specify the default
-// network scope as CURRENT_NAMESPACE. To facilitate incremental pruning of
-// the connectivity graph, the default network scope for the mesh is set to
-// ALL_NAMESPACES. In otherwords, every workload will be able to reach
-// every other workload. Specifying a NetworkScope resource in a namespace
-// will automatically prune the configuration for the workloads in that
+// NOTE 2: To facilitate incremental pruning of the the sidecar
+// configuration, the default import mode for the mesh is set to
+// ALL_NAMESPACES. In other words, every workload will be able to reach
+// every other workload. Adding a NetworkScope resource in a namespace will
+// automatically prune the configuration for the workloads in that
 // namespace.
 //
 // The following examples illustrate a few specific use cases of NetworkScope.
 //
 // The example below delcares a NetworkScope resource in the prod-us1
-// namespace. The workload with the `version: newlandingpage` label will be
-// able to reach all services declared in the egress namespace as well as
-// the landing.qa.foo.com service in the qa namespace. All other workloads
-// in the prod-us1 namespace will be able to reach the services in the
-// egress namespace only.
-//
+// namespace that specifies that workloads in the namespace will be able to
+// reach the services in the prod-apis namespace only.
 //
 // ```yaml
 // apiVersion: networking.istio.io/v1alpha3
@@ -88,14 +87,8 @@ func (ConfigScope) EnumDescriptor() ([]byte, []int) { return fileDescriptorNetwo
 //   namespace: prod-us1
 // spec:
 //   dependencies:
-//   - sourceWorkloadLabels:
-//       version: newlandingpage
-//     imports:
-//     - namespace: qa
-//       host: landing.qa.foo.com
-//     - namespace: egress
 //   - imports:
-//     - namespace: egress
+//     - namespace: prod-apis
 // ```
 //
 // In a mesh where the default network scope is set to CURRENT_NAMESPACE
@@ -111,22 +104,19 @@ func (ConfigScope) EnumDescriptor() ([]byte, []int) { return fileDescriptorNetwo
 //   namespace: metrics-collection
 // spec:
 //   dependencies:
-//   - sourceWorkloadLabels:
-//        app: metricsScraper
-//     imports:
+//   - imports:
 //     - namespace: '*'
 // ```
 //
 // The configuration above will allow workloads in the metrics-collection
-// namespace with the labels `app: metricsScraper` to access service in any
-// namespace while other workloads in the same namespace will be configured
-// for namespace local access as per the global default network scope
-// (CURRENT_NAMESPACE).
+// namespace to access service in any namespace while workloads in other
+// namespaces will be configured for namespace local access as per the
+// global default network scope (CURRENT_NAMESPACE).
 //
 type NetworkScope struct {
 	// REQUIRED. The set of services that workloads in this namespace are
 	// expected to talk to, in addition to other workloads in the same
-	// namespace. Dependencies describe the properties of egress traffic from
+	// namespace. Dependencies describe the properties of outbound traffic from
 	// a given workload.
 	Dependencies []*NetworkScope_Dependency `protobuf:"bytes,1,rep,name=dependencies" json:"dependencies,omitempty"`
 }
@@ -195,21 +185,13 @@ func (m *NetworkScope_Import) GetHost() string {
 // Dependency describes a workload and the set of service dependencies
 // for the workload.
 type NetworkScope_Dependency struct {
-	// One or more labels that indicate a specific set of pods/VMs on which
-	// this dependency configuration should be applied.  The scope of label
-	// search is platform dependent.  On Kubernetes, for example, the scope
-	// includes pods running in the namespace in which the NetworkScope
-	// resource is present.  If the sourceWorkloadLabels are omitted, the
-	// imports specified will be applicable to all workloads in the current
-	// configuration namespace.
-	SourceWorkloadLabels map[string]string `protobuf:"bytes,1,rep,name=source_workload_labels,json=sourceWorkloadLabels" json:"source_workload_labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 	// REQUIRED: Import describes the set of namespaces whose exported
 	// services will be accessed by the workloads selected by the
 	// sourceWorkloadLabels. The sidecars attached to the workloads will be
 	// configured with information required to reach other services in the
 	// same namespace and the imported services. In addition to the
 	// explicitly specified namespaces, namespaces specified in the global
-	// mesh config (through NetworkScope.sharedNamespaces) will also be
+	// mesh config (through defaultNetworkScope.importNamespaces) will also be
 	// imported.
 	Imports []*NetworkScope_Import `protobuf:"bytes,2,rep,name=imports" json:"imports,omitempty"`
 }
@@ -221,13 +203,6 @@ func (*NetworkScope_Dependency) Descriptor() ([]byte, []int) {
 	return fileDescriptorNetworkScope, []int{0, 1}
 }
 
-func (m *NetworkScope_Dependency) GetSourceWorkloadLabels() map[string]string {
-	if m != nil {
-		return m.SourceWorkloadLabels
-	}
-	return nil
-}
-
 func (m *NetworkScope_Dependency) GetImports() []*NetworkScope_Import {
 	if m != nil {
 		return m.Imports
@@ -316,23 +291,6 @@ func (m *NetworkScope_Dependency) MarshalTo(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
-	if len(m.SourceWorkloadLabels) > 0 {
-		for k, _ := range m.SourceWorkloadLabels {
-			dAtA[i] = 0xa
-			i++
-			v := m.SourceWorkloadLabels[k]
-			mapSize := 1 + len(k) + sovNetworkScope(uint64(len(k))) + 1 + len(v) + sovNetworkScope(uint64(len(v)))
-			i = encodeVarintNetworkScope(dAtA, i, uint64(mapSize))
-			dAtA[i] = 0xa
-			i++
-			i = encodeVarintNetworkScope(dAtA, i, uint64(len(k)))
-			i += copy(dAtA[i:], k)
-			dAtA[i] = 0x12
-			i++
-			i = encodeVarintNetworkScope(dAtA, i, uint64(len(v)))
-			i += copy(dAtA[i:], v)
-		}
-	}
 	if len(m.Imports) > 0 {
 		for _, msg := range m.Imports {
 			dAtA[i] = 0x12
@@ -386,14 +344,6 @@ func (m *NetworkScope_Import) Size() (n int) {
 func (m *NetworkScope_Dependency) Size() (n int) {
 	var l int
 	_ = l
-	if len(m.SourceWorkloadLabels) > 0 {
-		for k, v := range m.SourceWorkloadLabels {
-			_ = k
-			_ = v
-			mapEntrySize := 1 + len(k) + sovNetworkScope(uint64(len(k))) + 1 + len(v) + sovNetworkScope(uint64(len(v)))
-			n += mapEntrySize + 1 + sovNetworkScope(uint64(mapEntrySize))
-		}
-	}
 	if len(m.Imports) > 0 {
 		for _, e := range m.Imports {
 			l = e.Size()
@@ -634,124 +584,6 @@ func (m *NetworkScope_Dependency) Unmarshal(dAtA []byte) error {
 			return fmt.Errorf("proto: Dependency: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
-		case 1:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field SourceWorkloadLabels", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowNetworkScope
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= (int(b) & 0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthNetworkScope
-			}
-			postIndex := iNdEx + msglen
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if m.SourceWorkloadLabels == nil {
-				m.SourceWorkloadLabels = make(map[string]string)
-			}
-			var mapkey string
-			var mapvalue string
-			for iNdEx < postIndex {
-				entryPreIndex := iNdEx
-				var wire uint64
-				for shift := uint(0); ; shift += 7 {
-					if shift >= 64 {
-						return ErrIntOverflowNetworkScope
-					}
-					if iNdEx >= l {
-						return io.ErrUnexpectedEOF
-					}
-					b := dAtA[iNdEx]
-					iNdEx++
-					wire |= (uint64(b) & 0x7F) << shift
-					if b < 0x80 {
-						break
-					}
-				}
-				fieldNum := int32(wire >> 3)
-				if fieldNum == 1 {
-					var stringLenmapkey uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowNetworkScope
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapkey |= (uint64(b) & 0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapkey := int(stringLenmapkey)
-					if intStringLenmapkey < 0 {
-						return ErrInvalidLengthNetworkScope
-					}
-					postStringIndexmapkey := iNdEx + intStringLenmapkey
-					if postStringIndexmapkey > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
-					iNdEx = postStringIndexmapkey
-				} else if fieldNum == 2 {
-					var stringLenmapvalue uint64
-					for shift := uint(0); ; shift += 7 {
-						if shift >= 64 {
-							return ErrIntOverflowNetworkScope
-						}
-						if iNdEx >= l {
-							return io.ErrUnexpectedEOF
-						}
-						b := dAtA[iNdEx]
-						iNdEx++
-						stringLenmapvalue |= (uint64(b) & 0x7F) << shift
-						if b < 0x80 {
-							break
-						}
-					}
-					intStringLenmapvalue := int(stringLenmapvalue)
-					if intStringLenmapvalue < 0 {
-						return ErrInvalidLengthNetworkScope
-					}
-					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
-					if postStringIndexmapvalue > l {
-						return io.ErrUnexpectedEOF
-					}
-					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
-					iNdEx = postStringIndexmapvalue
-				} else {
-					iNdEx = entryPreIndex
-					skippy, err := skipNetworkScope(dAtA[iNdEx:])
-					if err != nil {
-						return err
-					}
-					if skippy < 0 {
-						return ErrInvalidLengthNetworkScope
-					}
-					if (iNdEx + skippy) > postIndex {
-						return io.ErrUnexpectedEOF
-					}
-					iNdEx += skippy
-				}
-			}
-			m.SourceWorkloadLabels[mapkey] = mapvalue
-			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Imports", wireType)
@@ -912,27 +744,22 @@ var (
 func init() { proto.RegisterFile("networking/v1alpha3/network_scope.proto", fileDescriptorNetworkScope) }
 
 var fileDescriptorNetworkScope = []byte{
-	// 352 bytes of a gzipped FileDescriptorProto
+	// 266 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x52, 0xcf, 0x4b, 0x2d, 0x29,
 	0xcf, 0x2f, 0xca, 0xce, 0xcc, 0x4b, 0xd7, 0x2f, 0x33, 0x4c, 0xcc, 0x29, 0xc8, 0x48, 0x34, 0xd6,
 	0x87, 0x8a, 0xc5, 0x17, 0x27, 0xe7, 0x17, 0xa4, 0xea, 0x15, 0x14, 0xe5, 0x97, 0xe4, 0x0b, 0x49,
-	0x66, 0x16, 0x97, 0x64, 0xe6, 0xeb, 0x21, 0x94, 0xeb, 0xc1, 0x94, 0x2b, 0x9d, 0x64, 0xe6, 0xe2,
+	0x66, 0x16, 0x97, 0x64, 0xe6, 0xeb, 0x21, 0x94, 0xeb, 0xc1, 0x94, 0x2b, 0xfd, 0x62, 0xe4, 0xe2,
 	0xf1, 0x83, 0x88, 0x07, 0x83, 0x74, 0x08, 0x85, 0x71, 0xf1, 0xa4, 0xa4, 0x16, 0xa4, 0xe6, 0xa5,
 	0xa4, 0xe6, 0x25, 0x67, 0xa6, 0x16, 0x4b, 0x30, 0x2a, 0x30, 0x6b, 0x70, 0x1b, 0x19, 0xe9, 0xe1,
 	0x34, 0x42, 0x0f, 0x59, 0xbb, 0x9e, 0x0b, 0x4c, 0x6f, 0x65, 0x10, 0x8a, 0x39, 0x52, 0x56, 0x5c,
 	0x6c, 0x9e, 0xb9, 0x05, 0xf9, 0x45, 0x25, 0x42, 0x32, 0x5c, 0x9c, 0x79, 0x89, 0xb9, 0xa9, 0xc5,
 	0x05, 0x89, 0xc9, 0xa9, 0x12, 0x8c, 0x0a, 0x8c, 0x1a, 0x9c, 0x41, 0x08, 0x01, 0x21, 0x21, 0x2e,
-	0x96, 0x8c, 0xfc, 0xe2, 0x12, 0x09, 0x26, 0xb0, 0x04, 0x98, 0x2d, 0xb5, 0x84, 0x89, 0x8b, 0x0b,
-	0x61, 0xb0, 0x50, 0x13, 0x23, 0x97, 0x58, 0x71, 0x7e, 0x69, 0x51, 0x72, 0x6a, 0x3c, 0xc8, 0xe2,
-	0x9c, 0xfc, 0xc4, 0x94, 0xf8, 0x9c, 0xc4, 0xa4, 0xd4, 0x1c, 0x98, 0x6b, 0x7d, 0x48, 0x77, 0xad,
-	0x5e, 0x30, 0xd8, 0xc0, 0x70, 0xa8, 0x79, 0x3e, 0x60, 0xe3, 0x5c, 0xf3, 0x4a, 0x8a, 0x2a, 0x83,
-	0x44, 0x8a, 0xb1, 0x48, 0x09, 0x79, 0x70, 0xb1, 0x67, 0x82, 0xfd, 0x53, 0x2c, 0xc1, 0x04, 0xb6,
-	0x54, 0x8f, 0x58, 0x4b, 0x21, 0xc1, 0x10, 0x04, 0xd3, 0x2e, 0xe5, 0xce, 0x25, 0x89, 0xd3, 0x72,
-	0x21, 0x01, 0x2e, 0xe6, 0xec, 0xd4, 0x4a, 0x68, 0x30, 0x81, 0x98, 0x42, 0x22, 0x5c, 0xac, 0x65,
-	0x89, 0x39, 0xa5, 0xa9, 0xd0, 0x10, 0x82, 0x70, 0xac, 0x98, 0x2c, 0x18, 0xb5, 0xd4, 0xb8, 0xb8,
-	0x9d, 0xf3, 0xf3, 0xd2, 0x32, 0xd3, 0x21, 0x31, 0xc9, 0xc5, 0xc5, 0x16, 0x10, 0xea, 0xe4, 0xe3,
-	0xe9, 0x2c, 0xc0, 0x20, 0xc4, 0xcd, 0xc5, 0x1e, 0x10, 0xe4, 0x19, 0xe6, 0x18, 0xe2, 0x2a, 0xc0,
-	0xe8, 0xa4, 0x77, 0xe2, 0x91, 0x1c, 0xe3, 0x85, 0x47, 0x72, 0x8c, 0x0f, 0x1e, 0xc9, 0x31, 0x46,
-	0x29, 0x40, 0x9c, 0x9d, 0x99, 0xaf, 0x9f, 0x58, 0x90, 0xa9, 0x8f, 0x25, 0x49, 0x25, 0xb1, 0x81,
-	0x53, 0x91, 0x31, 0x20, 0x00, 0x00, 0xff, 0xff, 0x64, 0xd5, 0x9b, 0x1f, 0x70, 0x02, 0x00, 0x00,
+	0x96, 0x8c, 0xfc, 0xe2, 0x12, 0x09, 0x26, 0xb0, 0x04, 0x98, 0x2d, 0x15, 0xc6, 0xc5, 0x85, 0x30,
+	0x57, 0xc8, 0x83, 0x8b, 0x3d, 0x13, 0x6c, 0x52, 0xb1, 0x04, 0x13, 0xd8, 0x71, 0x7a, 0xc4, 0x3a,
+	0x0e, 0xe2, 0x80, 0x20, 0x98, 0x76, 0x2d, 0x35, 0x2e, 0x6e, 0xe7, 0xfc, 0xbc, 0xb4, 0xcc, 0x74,
+	0x88, 0xd7, 0xb9, 0xb8, 0xd8, 0x02, 0x42, 0x9d, 0x7c, 0x3c, 0x9d, 0x05, 0x18, 0x84, 0xb8, 0xb9,
+	0xd8, 0x03, 0x82, 0x3c, 0xc3, 0x1c, 0x43, 0x5c, 0x05, 0x18, 0x9d, 0xf4, 0x4e, 0x3c, 0x92, 0x63,
+	0xbc, 0xf0, 0x48, 0x8e, 0xf1, 0xc1, 0x23, 0x39, 0xc6, 0x28, 0x05, 0x88, 0x6d, 0x99, 0xf9, 0xfa,
+	0x89, 0x05, 0x99, 0xfa, 0x58, 0xe2, 0x20, 0x89, 0x0d, 0x1c, 0xec, 0xc6, 0x80, 0x00, 0x00, 0x00,
+	0xff, 0xff, 0x7a, 0xa8, 0x8e, 0x07, 0xa1, 0x01, 0x00, 0x00,
 }
diff --git a/networking/v1alpha3/network_scope.proto b/networking/v1alpha3/network_scope.proto
index eaaa57059c..4f34ef313d 100644
--- a/networking/v1alpha3/network_scope.proto
+++ b/networking/v1alpha3/network_scope.proto
@@ -40,14 +40,16 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // of dependencies specified in a NetworkScope resource will be used to
 // compute the sidecar configuration for every workload in the namespace.
 //
-// NOTE: If workloads in the mesh depend only on other workloads in the
-// same namespace, use the mesh global setting (in values.yaml) to specify
-// the default network scope as CURRENT_NAMESPACE. To facilitate
-// incremental pruning of the the sidecar configuration, the default
-// network scope for the mesh is set to ALL_NAMESPACES. In other words,
-// every workload will be able to reach every other workload. Specifying a
-// NetworkScope resource in a namespace will automatically prune the
-// configuration for the workloads in that namespace.
+// NOTE 1: If workloads in the mesh depend only on other workloads in the
+// same namespace, set defaultNetworkScope.importMode to CURRENT_NAMESPACE
+// in the mesh global config map (in values.yaml).
+//
+// NOTE 2: To facilitate incremental pruning of the the sidecar
+// configuration, the default import mode for the mesh is set to
+// ALL_NAMESPACES. In other words, every workload will be able to reach
+// every other workload. Adding a NetworkScope resource in a namespace will
+// automatically prune the configuration for the workloads in that
+// namespace.
 //
 // The following examples illustrate a few specific use cases of NetworkScope.
 //
@@ -128,7 +130,7 @@ message NetworkScope {
     // configured with information required to reach other services in the
     // same namespace and the imported services. In addition to the
     // explicitly specified namespaces, namespaces specified in the global
-    // mesh config (through NetworkScope.sharedNamespaces) will also be
+    // mesh config (through defaultNetworkScope.importNamespaces) will also be
     // imported.
     repeated Import imports = 2;
   };
diff --git a/proto.lock b/proto.lock
index 9565f80074..2b3eb84c3b 100644
--- a/proto.lock
+++ b/proto.lock
@@ -694,17 +694,13 @@
           {
             "name": "DefaultNetworkScope.Mode",
             "enum_fields": [
-              {
-                "name": "INVALID",
-                "integer": 0
-              },
               {
                 "name": "ALL_NAMESPACES",
-                "integer": 1
+                "integer": 0
               },
               {
                 "name": "CURRENT_NAMESPACE",
-                "integer": 2
+                "integer": 1
               }
             ]
           }
@@ -870,12 +866,12 @@
                 "fields": [
                   {
                     "id": 1,
-                    "name": "default_scope",
+                    "name": "import_mode",
                     "type": "Mode"
                   },
                   {
                     "id": 2,
-                    "name": "shared_namespaces",
+                    "name": "import_namespaces",
                     "type": "string",
                     "is_repeated": true
                   }
@@ -3202,16 +3198,6 @@
                     "type": "Import",
                     "is_repeated": true
                   }
-                ],
-                "maps": [
-                  {
-                    "key_type": "string",
-                    "field": {
-                      "id": 1,
-                      "name": "source_workload_labels",
-                      "type": "string"
-                    }
-                  }
                 ]
               }
             ]
diff --git a/python/istio_api/mesh/v1alpha1/config_pb2.py b/python/istio_api/mesh/v1alpha1/config_pb2.py
index cc7412bd86..01cb073f21 100644
--- a/python/istio_api/mesh/v1alpha1/config_pb2.py
+++ b/python/istio_api/mesh/v1alpha1/config_pb2.py
@@ -22,7 +22,7 @@
   name='mesh/v1alpha1/config.proto',
   package='istio.mesh.v1alpha1',
   syntax='proto3',
-  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xf5\r\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x1e\n\x16policy_check_fail_open\x18\x19 \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x61\n\rtcp_keepalive\x18\x1c \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepalive\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x38\n\x11rds_refresh_delay\x18\x0b \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12N\n\x13\x61\x63\x63\x65ss_log_encoding\x18\x1b \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.AccessLogEncoding\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\x19\n\rmixer_address\x18\x10 \x01(\tB\x02\x18\x01\x12Z\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicyB\x02\x18\x01\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x38\n\x11sds_refresh_delay\x18\x15 \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\x12\x14\n\x0ctrust_domain\x18\x1a \x01(\t\x12R\n\x15\x64\x65\x66\x61ult_network_scope\x18\x1d \x01(\x0b\x32\x33.istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope\x1a\xb5\x01\n\x15OutboundTrafficPolicy\x12L\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.ModeB\x02\x18\x01\"N\n\x04Mode\x12\x15\n\rREGISTRY_ONLY\x10\x00\x1a\x02\x08\x01\x12\x11\n\tALLOW_ANY\x10\x01\x1a\x02\x08\x01\x12\x1c\n\x14VIRTUAL_SERVICE_ONLY\x10\x02\x1a\x02\x08\x01\x1a\xc1\x01\n\x13\x44\x65\x66\x61ultNetworkScope\x12O\n\rdefault_scope\x18\x01 \x01(\x0e\x32\x38.istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope.Mode\x12\x19\n\x11shared_namespaces\x18\x02 \x03(\t\">\n\x04Mode\x12\x0b\n\x07INVALID\x10\x00\x12\x12\n\x0e\x41LL_NAMESPACES\x10\x01\x12\x15\n\x11\x43URRENT_NAMESPACE\x10\x02\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\"\'\n\x11\x41\x63\x63\x65ssLogEncoding\x12\x08\n\x04TEXT\x10\x00\x12\x08\n\x04JSON\x10\x01J\x04\x08\x0f\x10\x10J\x04\x08\x12\x10\x13\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettingsB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
+  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xe6\r\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x1e\n\x16policy_check_fail_open\x18\x19 \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x61\n\rtcp_keepalive\x18\x1c \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepalive\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x38\n\x11rds_refresh_delay\x18\x0b \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12N\n\x13\x61\x63\x63\x65ss_log_encoding\x18\x1b \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.AccessLogEncoding\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\x19\n\rmixer_address\x18\x10 \x01(\tB\x02\x18\x01\x12Z\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicyB\x02\x18\x01\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x38\n\x11sds_refresh_delay\x18\x15 \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\x12\x14\n\x0ctrust_domain\x18\x1a \x01(\t\x12R\n\x15\x64\x65\x66\x61ult_network_scope\x18\x1d \x01(\x0b\x32\x33.istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope\x1a\xb5\x01\n\x15OutboundTrafficPolicy\x12L\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.ModeB\x02\x18\x01\"N\n\x04Mode\x12\x15\n\rREGISTRY_ONLY\x10\x00\x1a\x02\x08\x01\x12\x11\n\tALLOW_ANY\x10\x01\x1a\x02\x08\x01\x12\x1c\n\x14VIRTUAL_SERVICE_ONLY\x10\x02\x1a\x02\x08\x01\x1a\xb2\x01\n\x13\x44\x65\x66\x61ultNetworkScope\x12M\n\x0bimport_mode\x18\x01 \x01(\x0e\x32\x38.istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope.Mode\x12\x19\n\x11import_namespaces\x18\x02 \x03(\t\"1\n\x04Mode\x12\x12\n\x0e\x41LL_NAMESPACES\x10\x00\x12\x15\n\x11\x43URRENT_NAMESPACE\x10\x01\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\"\'\n\x11\x41\x63\x63\x65ssLogEncoding\x12\x08\n\x04TEXT\x10\x00\x12\x08\n\x04JSON\x10\x01J\x04\x08\x0f\x10\x10J\x04\x08\x12\x10\x13\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettingsB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
   ,
   dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,mesh_dot_v1alpha1_dot_proxy__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_destination__rule__pb2.DESCRIPTOR,])
 
@@ -61,22 +61,18 @@
   file=DESCRIPTOR,
   values=[
     _descriptor.EnumValueDescriptor(
-      name='INVALID', index=0, number=0,
+      name='ALL_NAMESPACES', index=0, number=0,
       options=None,
       type=None),
     _descriptor.EnumValueDescriptor(
-      name='ALL_NAMESPACES', index=1, number=1,
-      options=None,
-      type=None),
-    _descriptor.EnumValueDescriptor(
-      name='CURRENT_NAMESPACE', index=2, number=2,
+      name='CURRENT_NAMESPACE', index=1, number=1,
       options=None,
       type=None),
   ],
   containing_type=None,
   options=None,
-  serialized_start=1722,
-  serialized_end=1784,
+  serialized_start=1720,
+  serialized_end=1769,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_DEFAULTNETWORKSCOPE_MODE)
 
@@ -101,8 +97,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1786,
-  serialized_end=1843,
+  serialized_start=1771,
+  serialized_end=1828,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_INGRESSCONTROLLERMODE)
 
@@ -123,8 +119,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1845,
-  serialized_end=1883,
+  serialized_start=1830,
+  serialized_end=1868,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_AUTHPOLICY)
 
@@ -145,8 +141,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1885,
-  serialized_end=1924,
+  serialized_start=1870,
+  serialized_end=1909,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_ACCESSLOGENCODING)
 
@@ -190,14 +186,14 @@
   containing_type=None,
   fields=[
     _descriptor.FieldDescriptor(
-      name='default_scope', full_name='istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope.default_scope', index=0,
+      name='import_mode', full_name='istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope.import_mode', index=0,
       number=1, type=14, cpp_type=8, label=1,
       has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='shared_namespaces', full_name='istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope.shared_namespaces', index=1,
+      name='import_namespaces', full_name='istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope.import_namespaces', index=1,
       number=2, type=9, cpp_type=9, label=3,
       has_default_value=False, default_value=[],
       message_type=None, enum_type=None, containing_type=None,
@@ -217,7 +213,7 @@
   oneofs=[
   ],
   serialized_start=1591,
-  serialized_end=1784,
+  serialized_end=1769,
 )
 
 _MESHCONFIG = _descriptor.Descriptor(
@@ -432,7 +428,7 @@
   oneofs=[
   ],
   serialized_start=155,
-  serialized_end=1936,
+  serialized_end=1921,
 )
 
 
@@ -469,14 +465,14 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1938,
-  serialized_end=2031,
+  serialized_start=1923,
+  serialized_end=2016,
 )
 
 _MESHCONFIG_OUTBOUNDTRAFFICPOLICY.fields_by_name['mode'].enum_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE
 _MESHCONFIG_OUTBOUNDTRAFFICPOLICY.containing_type = _MESHCONFIG
 _MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE.containing_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY
-_MESHCONFIG_DEFAULTNETWORKSCOPE.fields_by_name['default_scope'].enum_type = _MESHCONFIG_DEFAULTNETWORKSCOPE_MODE
+_MESHCONFIG_DEFAULTNETWORKSCOPE.fields_by_name['import_mode'].enum_type = _MESHCONFIG_DEFAULTNETWORKSCOPE_MODE
 _MESHCONFIG_DEFAULTNETWORKSCOPE.containing_type = _MESHCONFIG
 _MESHCONFIG_DEFAULTNETWORKSCOPE_MODE.containing_type = _MESHCONFIG_DEFAULTNETWORKSCOPE
 _MESHCONFIG.fields_by_name['connect_timeout'].message_type = google_dot_protobuf_dot_duration__pb2._DURATION
diff --git a/python/istio_api/networking/v1alpha3/network_Scope_pb2.py b/python/istio_api/networking/v1alpha3/network_Scope_pb2.py
index 2fd1a36238..62d0fdbb76 100644
--- a/python/istio_api/networking/v1alpha3/network_Scope_pb2.py
+++ b/python/istio_api/networking/v1alpha3/network_Scope_pb2.py
@@ -20,7 +20,7 @@
   name='networking/v1alpha3/network_scope.proto',
   package='istio.networking.v1alpha3',
   syntax='proto3',
-  serialized_pb=_b('\n\'networking/v1alpha3/network_scope.proto\x12\x19istio.networking.v1alpha3\"\xfe\x02\n\x0cNetworkScope\x12H\n\x0c\x64\x65pendencies\x18\x01 \x03(\x0b\x32\x32.istio.networking.v1alpha3.NetworkScope.Dependency\x1a)\n\x06Import\x12\x11\n\tnamespace\x18\x01 \x01(\t\x12\x0c\n\x04host\x18\x02 \x01(\t\x1a\xf8\x01\n\nDependency\x12l\n\x16source_workload_labels\x18\x01 \x03(\x0b\x32L.istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry\x12?\n\x07imports\x18\x02 \x03(\x0b\x32..istio.networking.v1alpha3.NetworkScope.Import\x1a;\n\x19SourceWorkloadLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01*&\n\x0b\x43onfigScope\x12\n\n\x06PUBLIC\x10\x00\x12\x0b\n\x07PRIVATE\x10\x01\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
+  serialized_pb=_b('\n\'networking/v1alpha3/network_scope.proto\x12\x19istio.networking.v1alpha3\"\xd2\x01\n\x0cNetworkScope\x12H\n\x0c\x64\x65pendencies\x18\x01 \x03(\x0b\x32\x32.istio.networking.v1alpha3.NetworkScope.Dependency\x1a)\n\x06Import\x12\x11\n\tnamespace\x18\x01 \x01(\t\x12\x0c\n\x04host\x18\x02 \x01(\t\x1aM\n\nDependency\x12?\n\x07imports\x18\x02 \x03(\x0b\x32..istio.networking.v1alpha3.NetworkScope.Import*&\n\x0b\x43onfigScope\x12\n\n\x06PUBLIC\x10\x00\x12\x0b\n\x07PRIVATE\x10\x01\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
 )
 
 _CONFIGSCOPE = _descriptor.EnumDescriptor(
@@ -40,8 +40,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=455,
-  serialized_end=493,
+  serialized_start=283,
+  serialized_end=321,
 )
 _sym_db.RegisterEnumDescriptor(_CONFIGSCOPE)
 
@@ -88,43 +88,6 @@
   serialized_end=202,
 )
 
-_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY = _descriptor.Descriptor(
-  name='SourceWorkloadLabelsEntry',
-  full_name='istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry',
-  filename=None,
-  file=DESCRIPTOR,
-  containing_type=None,
-  fields=[
-    _descriptor.FieldDescriptor(
-      name='key', full_name='istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry.key', index=0,
-      number=1, type=9, cpp_type=9, label=1,
-      has_default_value=False, default_value=_b("").decode('utf-8'),
-      message_type=None, enum_type=None, containing_type=None,
-      is_extension=False, extension_scope=None,
-      options=None, file=DESCRIPTOR),
-    _descriptor.FieldDescriptor(
-      name='value', full_name='istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry.value', index=1,
-      number=2, type=9, cpp_type=9, label=1,
-      has_default_value=False, default_value=_b("").decode('utf-8'),
-      message_type=None, enum_type=None, containing_type=None,
-      is_extension=False, extension_scope=None,
-      options=None, file=DESCRIPTOR),
-  ],
-  extensions=[
-  ],
-  nested_types=[],
-  enum_types=[
-  ],
-  options=_descriptor._ParseOptions(descriptor_pb2.MessageOptions(), _b('8\001')),
-  is_extendable=False,
-  syntax='proto3',
-  extension_ranges=[],
-  oneofs=[
-  ],
-  serialized_start=394,
-  serialized_end=453,
-)
-
 _NETWORKSCOPE_DEPENDENCY = _descriptor.Descriptor(
   name='Dependency',
   full_name='istio.networking.v1alpha3.NetworkScope.Dependency',
@@ -133,14 +96,7 @@
   containing_type=None,
   fields=[
     _descriptor.FieldDescriptor(
-      name='source_workload_labels', full_name='istio.networking.v1alpha3.NetworkScope.Dependency.source_workload_labels', index=0,
-      number=1, type=11, cpp_type=10, label=3,
-      has_default_value=False, default_value=[],
-      message_type=None, enum_type=None, containing_type=None,
-      is_extension=False, extension_scope=None,
-      options=None, file=DESCRIPTOR),
-    _descriptor.FieldDescriptor(
-      name='imports', full_name='istio.networking.v1alpha3.NetworkScope.Dependency.imports', index=1,
+      name='imports', full_name='istio.networking.v1alpha3.NetworkScope.Dependency.imports', index=0,
       number=2, type=11, cpp_type=10, label=3,
       has_default_value=False, default_value=[],
       message_type=None, enum_type=None, containing_type=None,
@@ -149,7 +105,7 @@
   ],
   extensions=[
   ],
-  nested_types=[_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY, ],
+  nested_types=[],
   enum_types=[
   ],
   options=None,
@@ -158,8 +114,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=205,
-  serialized_end=453,
+  serialized_start=204,
+  serialized_end=281,
 )
 
 _NETWORKSCOPE = _descriptor.Descriptor(
@@ -189,12 +145,10 @@
   oneofs=[
   ],
   serialized_start=71,
-  serialized_end=453,
+  serialized_end=281,
 )
 
 _NETWORKSCOPE_IMPORT.containing_type = _NETWORKSCOPE
-_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY.containing_type = _NETWORKSCOPE_DEPENDENCY
-_NETWORKSCOPE_DEPENDENCY.fields_by_name['source_workload_labels'].message_type = _NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY
 _NETWORKSCOPE_DEPENDENCY.fields_by_name['imports'].message_type = _NETWORKSCOPE_IMPORT
 _NETWORKSCOPE_DEPENDENCY.containing_type = _NETWORKSCOPE
 _NETWORKSCOPE.fields_by_name['dependencies'].message_type = _NETWORKSCOPE_DEPENDENCY
@@ -212,13 +166,6 @@
   ,
 
   Dependency = _reflection.GeneratedProtocolMessageType('Dependency', (_message.Message,), dict(
-
-    SourceWorkloadLabelsEntry = _reflection.GeneratedProtocolMessageType('SourceWorkloadLabelsEntry', (_message.Message,), dict(
-      DESCRIPTOR = _NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY,
-      __module__ = 'networking.v1alpha3.network_scope_pb2'
-      # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry)
-      ))
-    ,
     DESCRIPTOR = _NETWORKSCOPE_DEPENDENCY,
     __module__ = 'networking.v1alpha3.network_scope_pb2'
     # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.NetworkScope.Dependency)
@@ -231,11 +178,8 @@
 _sym_db.RegisterMessage(NetworkScope)
 _sym_db.RegisterMessage(NetworkScope.Import)
 _sym_db.RegisterMessage(NetworkScope.Dependency)
-_sym_db.RegisterMessage(NetworkScope.Dependency.SourceWorkloadLabelsEntry)
 
 
 DESCRIPTOR.has_options = True
 DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z istio.io/api/networking/v1alpha3'))
-_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY.has_options = True
-_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY._options = _descriptor._ParseOptions(descriptor_pb2.MessageOptions(), _b('8\001'))
 # @@protoc_insertion_point(module_scope)

From 76f1f7818ef4bf9f841ba787abe8526135c90ec9 Mon Sep 17 00:00:00 2001
From: Shriram Rajagopalan <shriramr@vmware.com>
Date: Tue, 27 Nov 2018 20:17:43 -0500
Subject: [PATCH 10/11] rename

---
 .../v1alpha3/{network_Scope_pb2.py => network_scope_pb2.py}       | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename python/istio_api/networking/v1alpha3/{network_Scope_pb2.py => network_scope_pb2.py} (100%)

diff --git a/python/istio_api/networking/v1alpha3/network_Scope_pb2.py b/python/istio_api/networking/v1alpha3/network_scope_pb2.py
similarity index 100%
rename from python/istio_api/networking/v1alpha3/network_Scope_pb2.py
rename to python/istio_api/networking/v1alpha3/network_scope_pb2.py

From a453392c3f014eddf81ddd1f2132cf866c713317 Mon Sep 17 00:00:00 2001
From: Shriram Rajagopalan <shriramr@vmware.com>
Date: Wed, 28 Nov 2018 14:33:32 -0500
Subject: [PATCH 11/11] nits and final updates

Signed-off-by: Shriram Rajagopalan <shriramr@vmware.com>
---
 mesh/v1alpha1/config.pb.go                    | 160 +++++------
 mesh/v1alpha1/config.proto                    |   2 +-
 mesh/v1alpha1/istio.mesh.v1alpha1.pb.html     |   4 +-
 networking/v1alpha3/destination_rule.pb.go    | 217 ++++++++-------
 networking/v1alpha3/destination_rule.proto    |   7 +
 .../istio.networking.v1alpha3.pb.html         |  32 ++-
 networking/v1alpha3/network_scope.pb.go       | 196 +++++++++++++-
 networking/v1alpha3/network_scope.proto       |  23 +-
 networking/v1alpha3/service_entry.pb.go       |  88 +++----
 networking/v1alpha3/service_entry.proto       |   2 +-
 networking/v1alpha3/virtual_service.pb.go     | 249 +++++++++---------
 networking/v1alpha3/virtual_service.proto     |   4 +-
 proto.lock                                    |  21 +-
 python/istio_api/mesh/v1alpha1/config_pb2.py  |  26 +-
 .../v1alpha3/destination_rule_pb2.py          |  77 +++---
 .../networking/v1alpha3/network_scope_pb2.py  |  72 ++++-
 .../networking/v1alpha3/service_entry_pb2.py  |  28 +-
 .../v1alpha3/virtual_service_pb2.py           | 136 +++++-----
 18 files changed, 836 insertions(+), 508 deletions(-)

diff --git a/mesh/v1alpha1/config.pb.go b/mesh/v1alpha1/config.pb.go
index d15871e7a2..7ae7af46e6 100644
--- a/mesh/v1alpha1/config.pb.go
+++ b/mesh/v1alpha1/config.pb.go
@@ -161,16 +161,16 @@ const (
 	// Only configure routes to services that are in the same namespace
 	// as the workload as well as services in namespaces specified in
 	// importNamespaces.
-	MeshConfig_DefaultNetworkScope_CURRENT_NAMESPACE MeshConfig_DefaultNetworkScope_Mode = 1
+	MeshConfig_DefaultNetworkScope_SAME_NAMESPACE MeshConfig_DefaultNetworkScope_Mode = 1
 )
 
 var MeshConfig_DefaultNetworkScope_Mode_name = map[int32]string{
 	0: "ALL_NAMESPACES",
-	1: "CURRENT_NAMESPACE",
+	1: "SAME_NAMESPACE",
 }
 var MeshConfig_DefaultNetworkScope_Mode_value = map[string]int32{
-	"ALL_NAMESPACES":    0,
-	"CURRENT_NAMESPACE": 1,
+	"ALL_NAMESPACES": 0,
+	"SAME_NAMESPACE": 1,
 }
 
 func (x MeshConfig_DefaultNetworkScope_Mode) String() string {
@@ -2248,82 +2248,82 @@ var (
 func init() { proto.RegisterFile("mesh/v1alpha1/config.proto", fileDescriptorConfig) }
 
 var fileDescriptorConfig = []byte{
-	// 1228 bytes of a gzipped FileDescriptorProto
+	// 1226 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x56, 0xdd, 0x6e, 0xdb, 0xb6,
-	0x17, 0x8f, 0x92, 0xb4, 0x49, 0x8f, 0x3f, 0x22, 0xd3, 0x75, 0xab, 0xba, 0xfd, 0xe7, 0xef, 0x7a,
-	0x58, 0x6b, 0x74, 0x83, 0x8d, 0x24, 0x18, 0xb0, 0xed, 0xce, 0x75, 0x9c, 0xd6, 0x99, 0x63, 0x1b,
+	0x17, 0x8f, 0x92, 0xb4, 0x49, 0x8f, 0x3f, 0x22, 0xd3, 0x75, 0xab, 0xba, 0xfd, 0xe7, 0xef, 0x66,
+	0x58, 0x6b, 0x74, 0x83, 0x8c, 0x26, 0x18, 0xb0, 0xed, 0xce, 0x75, 0x9c, 0xd6, 0x99, 0x63, 0x1b,
 	0x92, 0xd2, 0x2d, 0xbb, 0x21, 0x14, 0x89, 0xb6, 0x89, 0xc8, 0xa2, 0x26, 0x52, 0x5d, 0xfb, 0x6c,
-	0x7b, 0x81, 0x5d, 0xf6, 0x0d, 0x36, 0xf4, 0x49, 0x06, 0x92, 0x52, 0xec, 0x36, 0xc6, 0x32, 0xf4,
-	0x4e, 0xfc, 0x9d, 0x2f, 0x9e, 0xdf, 0xf9, 0xa0, 0xa0, 0xbe, 0x20, 0x7c, 0xde, 0x79, 0x7b, 0xe0,
-	0x85, 0xf1, 0xdc, 0x3b, 0xe8, 0xf8, 0x2c, 0x9a, 0xd2, 0x59, 0x3b, 0x4e, 0x98, 0x60, 0xa8, 0x4a,
-	0xb9, 0xa0, 0xac, 0x2d, 0x35, 0xda, 0xb9, 0x46, 0x7d, 0x7f, 0xc6, 0xd8, 0x2c, 0x24, 0x1d, 0xa5,
-	0x72, 0x99, 0x4e, 0x3b, 0x41, 0x9a, 0x78, 0x82, 0xb2, 0x48, 0x1b, 0xd5, 0x1f, 0x7d, 0xea, 0x30,
-	0x4e, 0xd8, 0xbb, 0xf7, 0x99, 0xe8, 0x45, 0x44, 0xc4, 0xef, 0x2c, 0xb9, 0xa2, 0xd1, 0x2c, 0x57,
-	0x38, 0xea, 0x04, 0x84, 0x0b, 0x1a, 0x29, 0x0f, 0x38, 0x49, 0x43, 0xa2, 0x75, 0x9b, 0x7f, 0x55,
-	0x00, 0xce, 0x08, 0x9f, 0xf7, 0xd4, 0x85, 0xd0, 0xb7, 0x80, 0x16, 0xf4, 0x1d, 0x49, 0xb0, 0x3f,
-	0x27, 0xfe, 0x15, 0xe6, 0x24, 0x79, 0x4b, 0x12, 0xcb, 0x68, 0x18, 0xad, 0x7b, 0xb6, 0xa9, 0x24,
-	0x3d, 0x29, 0x70, 0x14, 0x8e, 0xda, 0x50, 0xd5, 0xda, 0x09, 0x89, 0x59, 0x22, 0x72, 0xf5, 0x4d,
-	0xa5, 0x5e, 0x51, 0x22, 0x5b, 0x49, 0x32, 0xfd, 0x43, 0xa8, 0x05, 0x94, 0x7b, 0x97, 0x21, 0xc1,
-	0x31, 0x0b, 0xa9, 0xff, 0x5e, 0x87, 0xe1, 0xd6, 0x56, 0xc3, 0x68, 0xed, 0xda, 0xd5, 0x4c, 0x38,
-	0x51, 0x32, 0x15, 0x88, 0xa3, 0x17, 0x50, 0x51, 0xb9, 0xe1, 0x90, 0x72, 0x41, 0x22, 0x2c, 0xdd,
-	0x59, 0xdb, 0x0d, 0xa3, 0x75, 0xc7, 0xde, 0x53, 0x82, 0xa1, 0xc2, 0x27, 0x2c, 0x11, 0xe8, 0x19,
-	0x68, 0x08, 0xcf, 0x85, 0x88, 0xb5, 0xe6, 0x1d, 0xa5, 0x59, 0x52, 0xf0, 0x6b, 0x21, 0x62, 0xa5,
-	0xf7, 0x12, 0xf6, 0x7c, 0x16, 0x45, 0xc4, 0x17, 0x58, 0xd0, 0x05, 0x61, 0xa9, 0xb0, 0xee, 0x36,
-	0x8c, 0x56, 0xe1, 0xf0, 0x51, 0x5b, 0xb3, 0xde, 0xce, 0x59, 0x6f, 0x1f, 0x67, 0xac, 0xdb, 0xe5,
-	0xcc, 0xc2, 0xd5, 0x06, 0xe8, 0x2b, 0x28, 0xd1, 0x68, 0x96, 0x10, 0xce, 0xb1, 0x1f, 0x7a, 0x9c,
-	0x5b, 0x3b, 0x2a, 0xeb, 0x62, 0x06, 0xf6, 0x24, 0x86, 0x9e, 0xc3, 0x5e, 0xae, 0x24, 0xb9, 0xa1,
-	0x3e, 0xb1, 0x76, 0x95, 0x5a, 0x39, 0x83, 0x1d, 0x8d, 0xa2, 0x05, 0x3c, 0xbc, 0xf6, 0xc6, 0x22,
-	0x91, 0xb0, 0x30, 0x24, 0x09, 0x5e, 0xb0, 0x80, 0x58, 0xf7, 0x1a, 0x46, 0xab, 0x7c, 0xf8, 0x5d,
-	0x7b, 0x4d, 0x93, 0xb4, 0x97, 0x95, 0x6b, 0x0f, 0xb2, 0xb8, 0xd7, 0xd6, 0x67, 0x2c, 0x20, 0x76,
-	0x8d, 0xae, 0x83, 0xd1, 0x18, 0x0a, 0x5e, 0x2a, 0xe6, 0x59, 0x15, 0x2c, 0x50, 0x21, 0x5e, 0xdc,
-	0x16, 0xa2, 0x9b, 0x8a, 0xb9, 0xae, 0xcd, 0xcb, 0x4d, 0xcb, 0xb0, 0xc1, 0xbb, 0x3e, 0xa3, 0x01,
-	0x54, 0x92, 0x80, 0xe3, 0x84, 0x4c, 0x13, 0xc2, 0xe7, 0x38, 0x20, 0xa1, 0xf7, 0xde, 0x2a, 0xdc,
-	0xc2, 0xa9, 0xf2, 0xb2, 0x97, 0x04, 0xdc, 0xd6, 0x66, 0xc7, 0xd2, 0x0a, 0x7d, 0x0d, 0x65, 0x12,
-	0xa9, 0x1e, 0x11, 0x89, 0xe7, 0xd3, 0x68, 0x66, 0x15, 0x55, 0x77, 0x94, 0x34, 0xea, 0x6a, 0x50,
-	0xd6, 0xda, 0xf3, 0x7d, 0x49, 0x58, 0xc8, 0x66, 0x78, 0x4a, 0x43, 0x62, 0x95, 0x14, 0xb5, 0x25,
-	0x0d, 0x0f, 0xd9, 0xec, 0x84, 0x86, 0x04, 0xbd, 0x82, 0x72, 0x40, 0xa6, 0x5e, 0x1a, 0x0a, 0xac,
-	0x87, 0xce, 0x2a, 0xab, 0x6b, 0x35, 0xd6, 0x66, 0x3b, 0x91, 0x7d, 0xa2, 0xd3, 0xb5, 0x4b, 0x99,
-	0x5d, 0x36, 0x1a, 0xcf, 0xa1, 0xa4, 0x9b, 0xdd, 0x0b, 0x02, 0x49, 0xa9, 0x65, 0xca, 0x70, 0x2a,
-	0x87, 0xa2, 0x12, 0x74, 0x35, 0x8e, 0x7e, 0x83, 0x87, 0x2c, 0x15, 0x97, 0x2c, 0x8d, 0x02, 0x99,
-	0xc2, 0x74, 0x4a, 0xfd, 0x9c, 0xe8, 0x8a, 0x0a, 0x7d, 0x6b, 0x2d, 0xc7, 0x99, 0xb9, 0xab, 0xad,
-	0x57, 0x38, 0xaf, 0xb1, 0x75, 0x22, 0x74, 0x0c, 0xff, 0xcf, 0x38, 0xf3, 0x43, 0x4a, 0x22, 0x81,
-	0x39, 0x0d, 0x3e, 0x9d, 0x31, 0xab, 0xaa, 0x48, 0x7c, 0xac, 0xd5, 0x7a, 0x4a, 0xcb, 0xa1, 0xc1,
-	0xea, 0xac, 0xa1, 0x06, 0x14, 0x79, 0xc0, 0x71, 0x1a, 0x70, 0x1c, 0x7b, 0x62, 0x6e, 0xdd, 0x57,
-	0x7c, 0x02, 0x0f, 0xf8, 0x79, 0xc0, 0x27, 0x9e, 0x98, 0xcb, 0x32, 0xf3, 0x1b, 0x65, 0xae, 0xfd,
-	0xa7, 0x32, 0xf3, 0xcf, 0xca, 0xfc, 0x1a, 0xca, 0xba, 0x1e, 0x98, 0xb3, 0x34, 0xf1, 0x09, 0xb7,
-	0x1e, 0x34, 0xb6, 0x5a, 0x85, 0xc3, 0xa7, 0x6b, 0xc9, 0xd1, 0xc4, 0x38, 0x4a, 0xd3, 0x2e, 0xf9,
-	0x2b, 0x27, 0x8e, 0x8e, 0xe0, 0x41, 0x96, 0xbc, 0xbc, 0x9b, 0x60, 0x57, 0x24, 0xc2, 0x0b, 0x96,
-	0x46, 0xc2, 0x7a, 0xa8, 0xd7, 0x8a, 0x96, 0x3a, 0x01, 0x77, 0xa5, 0xec, 0x4c, 0x8a, 0xe4, 0x5a,
-	0x59, 0x6d, 0x1f, 0x96, 0x2c, 0x3c, 0x61, 0x59, 0x2a, 0xe1, 0xbd, 0x65, 0x03, 0x29, 0x58, 0x06,
-	0x58, 0xa5, 0x12, 0x4f, 0x3d, 0x1a, 0x62, 0x16, 0x93, 0xc8, 0x7a, 0xa4, 0x03, 0xc4, 0x4b, 0x12,
-	0x4f, 0x3c, 0x1a, 0x8e, 0x63, 0x12, 0xa1, 0xa7, 0x50, 0x14, 0x49, 0xca, 0x05, 0x0e, 0xd8, 0xc2,
-	0xa3, 0x91, 0x55, 0x57, 0xbe, 0x0b, 0x0a, 0x3b, 0x56, 0x10, 0xf2, 0xa0, 0xba, 0x72, 0x07, 0x12,
-	0xf9, 0x2c, 0x90, 0xed, 0xfe, 0x58, 0x4d, 0xe3, 0xc1, 0xad, 0xd3, 0x98, 0xdf, 0xb2, 0x9f, 0x19,
-	0xda, 0x15, 0xef, 0x73, 0x08, 0x31, 0x28, 0x09, 0x3f, 0xc6, 0x57, 0x84, 0xc4, 0x5e, 0x48, 0xdf,
-	0x12, 0xeb, 0x89, 0x2a, 0xd6, 0x69, 0xe6, 0x7c, 0xf9, 0x50, 0xe4, 0x21, 0x8e, 0x24, 0xd5, 0x72,
-	0xcf, 0x51, 0x16, 0x4d, 0x18, 0x0b, 0x1d, 0x22, 0x04, 0x8d, 0x66, 0xbc, 0xed, 0xf6, 0x26, 0xcb,
-	0x6f, 0x3f, 0xfe, 0x29, 0xf7, 0x68, 0x17, 0xc5, 0xca, 0x09, 0xcd, 0xa0, 0x96, 0x8f, 0x5b, 0xe6,
-	0x1c, 0x73, 0x9f, 0xc5, 0xc4, 0xfa, 0x9f, 0x0a, 0x7c, 0x74, 0x5b, 0x56, 0xc7, 0xda, 0x78, 0xa4,
-	0x6d, 0x1d, 0x69, 0x6a, 0x57, 0x83, 0x9b, 0x60, 0xfd, 0x0f, 0x03, 0x6a, 0x6b, 0xe7, 0x04, 0xd9,
-	0xb0, 0xad, 0x16, 0xa7, 0xa1, 0x78, 0xfc, 0xf1, 0x8b, 0x86, 0xad, 0x2d, 0xd7, 0xa4, 0x6a, 0x5c,
-	0xe5, 0xab, 0x39, 0x82, 0x6d, 0xb5, 0x38, 0x6b, 0x50, 0xb2, 0xfb, 0xaf, 0x06, 0x8e, 0x6b, 0x5f,
-	0xe0, 0xf1, 0x68, 0x78, 0x61, 0x6e, 0xd4, 0x37, 0x77, 0x0d, 0x54, 0x81, 0x7b, 0xdd, 0xe1, 0x70,
-	0xfc, 0x33, 0xee, 0x8e, 0x2e, 0x4c, 0x43, 0x41, 0x4f, 0xe0, 0xfe, 0x9b, 0x81, 0xed, 0x9e, 0x77,
-	0x87, 0xd8, 0xe9, 0xdb, 0x6f, 0x06, 0xbd, 0xbe, 0x36, 0xd8, 0x94, 0xd2, 0xfa, 0x07, 0x03, 0xaa,
-	0x6b, 0x52, 0x45, 0x17, 0x50, 0xa0, 0x0b, 0xf5, 0x96, 0xae, 0xa4, 0xf0, 0xfd, 0x17, 0x90, 0xa6,
-	0x12, 0xb0, 0x41, 0x3b, 0x53, 0x57, 0xff, 0x06, 0x2a, 0x99, 0xeb, 0xc8, 0x5b, 0x10, 0x1e, 0x7b,
-	0x72, 0xe6, 0x36, 0x1b, 0x5b, 0xf2, 0x65, 0xd7, 0x82, 0xd1, 0x35, 0xde, 0x3c, 0xc8, 0xf2, 0x45,
-	0x50, 0xee, 0x0e, 0x87, 0x78, 0xd4, 0x3d, 0xeb, 0x3b, 0x93, 0x6e, 0xaf, 0xef, 0x98, 0x1b, 0xa8,
-	0x06, 0x95, 0xde, 0xb9, 0x6d, 0xf7, 0x47, 0xee, 0x12, 0x37, 0x8d, 0xe6, 0x0f, 0x50, 0x5b, 0xfb,
-	0x06, 0xa1, 0x1d, 0xd8, 0x1a, 0x9f, 0x9c, 0x98, 0x1b, 0xa8, 0x00, 0x3b, 0xc7, 0xfd, 0x93, 0xee,
-	0xf9, 0xd0, 0x35, 0x0d, 0x04, 0x70, 0xd7, 0x71, 0xed, 0x41, 0xcf, 0x35, 0x37, 0x9b, 0xcf, 0x00,
-	0x96, 0x6f, 0x0b, 0xda, 0x85, 0xed, 0xd1, 0x78, 0xd4, 0x37, 0x37, 0x50, 0x19, 0xe0, 0xec, 0x5c,
-	0x51, 0xe8, 0x0e, 0x1d, 0xd3, 0x68, 0x3e, 0x87, 0xca, 0x8d, 0xae, 0x97, 0xea, 0x6e, 0xff, 0x17,
-	0xd7, 0xdc, 0x90, 0x5f, 0xa7, 0xce, 0x78, 0x64, 0x1a, 0xa7, 0xdb, 0xbb, 0x7b, 0xa6, 0x79, 0xba,
-	0xbd, 0x8b, 0xcc, 0x6a, 0x93, 0x43, 0x71, 0x75, 0x7b, 0x20, 0x0b, 0x76, 0xf2, 0x0d, 0xae, 0xff,
-	0x6b, 0xf2, 0x23, 0x1a, 0x40, 0x51, 0x84, 0xf2, 0xa5, 0xd6, 0x6d, 0xae, 0xfe, 0x63, 0x0a, 0x87,
-	0xcf, 0xfe, 0x65, 0x56, 0xdc, 0xa1, 0x93, 0x0f, 0x85, 0x5d, 0x10, 0x21, 0xcf, 0x0f, 0x2f, 0x5b,
-	0x7f, 0x7e, 0xdc, 0x37, 0x3e, 0x7c, 0xdc, 0x37, 0xfe, 0xfe, 0xb8, 0x6f, 0xfc, 0x5a, 0xd7, 0x1e,
-	0x28, 0xeb, 0x78, 0x31, 0xed, 0x7c, 0xf2, 0xe3, 0x76, 0x79, 0x57, 0xed, 0xcb, 0xa3, 0x7f, 0x02,
-	0x00, 0x00, 0xff, 0xff, 0x63, 0xce, 0x0d, 0x91, 0x21, 0x0a, 0x00, 0x00,
+	0x7b, 0x81, 0xdd, 0x0c, 0xd8, 0x03, 0xec, 0x62, 0xe8, 0x93, 0x0c, 0x24, 0xa5, 0xd8, 0x6d, 0x8d,
+	0x65, 0xe8, 0x9d, 0xf8, 0x3b, 0x5f, 0x3c, 0xbf, 0xf3, 0x41, 0x41, 0x73, 0x41, 0xf8, 0xbc, 0xf3,
+	0xe6, 0xb9, 0x1f, 0x25, 0x73, 0xff, 0x79, 0x27, 0x60, 0xf1, 0x94, 0xce, 0xec, 0x24, 0x65, 0x82,
+	0xa1, 0x3a, 0xe5, 0x82, 0x32, 0x5b, 0x6a, 0xd8, 0x85, 0x46, 0x73, 0x7f, 0xc6, 0xd8, 0x2c, 0x22,
+	0x1d, 0xa5, 0x72, 0x99, 0x4d, 0x3b, 0x61, 0x96, 0xfa, 0x82, 0xb2, 0x58, 0x1b, 0x35, 0x1f, 0x7c,
+	0xe8, 0x30, 0x49, 0xd9, 0xdb, 0x77, 0xb9, 0xe8, 0x59, 0x4c, 0xc4, 0xaf, 0x2c, 0xbd, 0xa2, 0xf1,
+	0xac, 0x50, 0x38, 0xea, 0x84, 0x84, 0x0b, 0x1a, 0x2b, 0x0f, 0x38, 0xcd, 0x22, 0xa2, 0x75, 0x0f,
+	0xfe, 0xaa, 0x01, 0x9c, 0x11, 0x3e, 0xef, 0xa9, 0x0b, 0xa1, 0xaf, 0x01, 0x2d, 0xe8, 0x5b, 0x92,
+	0xe2, 0x60, 0x4e, 0x82, 0x2b, 0xcc, 0x49, 0xfa, 0x86, 0xa4, 0x96, 0xd1, 0x32, 0xda, 0x77, 0x1c,
+	0x53, 0x49, 0x7a, 0x52, 0xe0, 0x2a, 0x1c, 0xd9, 0x50, 0xd7, 0xda, 0x29, 0x49, 0x58, 0x2a, 0x0a,
+	0xf5, 0x4d, 0xa5, 0x5e, 0x53, 0x22, 0x47, 0x49, 0x72, 0xfd, 0x43, 0x68, 0x84, 0x94, 0xfb, 0x97,
+	0x11, 0xc1, 0x09, 0x8b, 0x68, 0xf0, 0x4e, 0x87, 0xe1, 0xd6, 0x56, 0xcb, 0x68, 0xef, 0x3a, 0xf5,
+	0x5c, 0x38, 0x51, 0x32, 0x15, 0x88, 0xa3, 0x67, 0x50, 0x53, 0xb9, 0xe1, 0x88, 0x72, 0x41, 0x62,
+	0x2c, 0xdd, 0x59, 0xdb, 0x2d, 0xa3, 0x7d, 0xcb, 0xd9, 0x53, 0x82, 0xa1, 0xc2, 0x27, 0x2c, 0x15,
+	0xe8, 0x09, 0x68, 0x08, 0xcf, 0x85, 0x48, 0xb4, 0xe6, 0x2d, 0xa5, 0x59, 0x51, 0xf0, 0x2b, 0x21,
+	0x12, 0xa5, 0xf7, 0x02, 0xf6, 0x02, 0x16, 0xc7, 0x24, 0x10, 0x58, 0xd0, 0x05, 0x61, 0x99, 0xb0,
+	0x6e, 0xb7, 0x8c, 0x76, 0xe9, 0xf0, 0x81, 0xad, 0x59, 0xb7, 0x0b, 0xd6, 0xed, 0xe3, 0x9c, 0x75,
+	0xa7, 0x9a, 0x5b, 0x78, 0xda, 0x00, 0x7d, 0x01, 0x15, 0x1a, 0xcf, 0x52, 0xc2, 0x39, 0x0e, 0x22,
+	0x9f, 0x73, 0x6b, 0x47, 0x65, 0x5d, 0xce, 0xc1, 0x9e, 0xc4, 0xd0, 0x53, 0xd8, 0x2b, 0x94, 0x24,
+	0x37, 0x34, 0x20, 0xd6, 0xae, 0x52, 0xab, 0xe6, 0xb0, 0xab, 0x51, 0xb4, 0x80, 0xfb, 0xd7, 0xde,
+	0x58, 0x2c, 0x52, 0x16, 0x45, 0x24, 0xc5, 0x0b, 0x16, 0x12, 0xeb, 0x4e, 0xcb, 0x68, 0x57, 0x0f,
+	0xbf, 0xb1, 0xd7, 0x34, 0x89, 0xbd, 0xac, 0x9c, 0x3d, 0xc8, 0xe3, 0x5e, 0x5b, 0x9f, 0xb1, 0x90,
+	0x38, 0x0d, 0xba, 0x0e, 0x46, 0x63, 0x28, 0xf9, 0x99, 0x98, 0xe7, 0x55, 0xb0, 0x40, 0x85, 0x78,
+	0x76, 0x53, 0x88, 0x6e, 0x26, 0xe6, 0xba, 0x36, 0x2f, 0x36, 0x2d, 0xc3, 0x01, 0xff, 0xfa, 0x8c,
+	0x06, 0x50, 0x4b, 0x43, 0x8e, 0x53, 0x32, 0x4d, 0x09, 0x9f, 0xe3, 0x90, 0x44, 0xfe, 0x3b, 0xab,
+	0x74, 0x03, 0xa7, 0xca, 0xcb, 0x5e, 0x1a, 0x72, 0x47, 0x9b, 0x1d, 0x4b, 0x2b, 0xf4, 0x25, 0x54,
+	0x49, 0xac, 0x7a, 0x44, 0xa4, 0x7e, 0x40, 0xe3, 0x99, 0x55, 0x56, 0xdd, 0x51, 0xd1, 0xa8, 0xa7,
+	0x41, 0x59, 0x6b, 0x3f, 0x08, 0x24, 0x61, 0x11, 0x9b, 0xe1, 0x29, 0x8d, 0x88, 0x55, 0x51, 0xd4,
+	0x56, 0x34, 0x3c, 0x64, 0xb3, 0x13, 0x1a, 0x11, 0xf4, 0x12, 0xaa, 0x21, 0x99, 0xfa, 0x59, 0x24,
+	0xb0, 0x1e, 0x3a, 0xab, 0xaa, 0xae, 0xd5, 0x5a, 0x9b, 0xed, 0x44, 0xf6, 0x89, 0x4e, 0xd7, 0xa9,
+	0xe4, 0x76, 0xf9, 0x68, 0x3c, 0x85, 0x8a, 0x6e, 0x76, 0x3f, 0x0c, 0x25, 0xa5, 0x96, 0x29, 0xc3,
+	0xa9, 0x1c, 0xca, 0x4a, 0xd0, 0xd5, 0x38, 0xfa, 0x05, 0xee, 0xb3, 0x4c, 0x5c, 0xb2, 0x2c, 0x0e,
+	0x65, 0x0a, 0xd3, 0x29, 0x0d, 0x0a, 0xa2, 0x6b, 0x2a, 0xf4, 0x8d, 0xb5, 0x1c, 0xe7, 0xe6, 0x9e,
+	0xb6, 0x5e, 0xe1, 0xbc, 0xc1, 0xd6, 0x89, 0xd0, 0x31, 0xfc, 0x3f, 0xe7, 0x2c, 0x88, 0x28, 0x89,
+	0x05, 0xe6, 0x34, 0xfc, 0x70, 0xc6, 0xac, 0xba, 0x22, 0xf1, 0xa1, 0x56, 0xeb, 0x29, 0x2d, 0x97,
+	0x86, 0xab, 0xb3, 0x86, 0x5a, 0x50, 0xe6, 0x21, 0xc7, 0x59, 0xc8, 0x71, 0xe2, 0x8b, 0xb9, 0x75,
+	0x57, 0xf1, 0x09, 0x3c, 0xe4, 0xe7, 0x21, 0x9f, 0xf8, 0x62, 0x2e, 0xcb, 0xcc, 0x3f, 0x29, 0x73,
+	0xe3, 0x3f, 0x95, 0x99, 0x7f, 0x54, 0xe6, 0x57, 0x50, 0xd5, 0xf5, 0xc0, 0x9c, 0x65, 0x69, 0x40,
+	0xb8, 0x75, 0xaf, 0xb5, 0xd5, 0x2e, 0x1d, 0x3e, 0x5e, 0x4b, 0x8e, 0x26, 0xc6, 0x55, 0x9a, 0x4e,
+	0x25, 0x58, 0x39, 0x71, 0x74, 0x04, 0xf7, 0xf2, 0xe4, 0xe5, 0xdd, 0x04, 0xbb, 0x22, 0x31, 0x5e,
+	0xb0, 0x2c, 0x16, 0xd6, 0x7d, 0xbd, 0x56, 0xb4, 0xd4, 0x0d, 0xb9, 0x27, 0x65, 0x67, 0x52, 0x24,
+	0xd7, 0xca, 0x6a, 0xfb, 0xb0, 0x74, 0xe1, 0x0b, 0xcb, 0x52, 0x09, 0xef, 0x2d, 0x1b, 0x48, 0xc1,
+	0x32, 0xc0, 0x2a, 0x95, 0x78, 0xea, 0xd3, 0x08, 0xb3, 0x84, 0xc4, 0xd6, 0x03, 0x1d, 0x20, 0x59,
+	0x92, 0x78, 0xe2, 0xd3, 0x68, 0x9c, 0x90, 0x18, 0x3d, 0x86, 0xb2, 0x48, 0x33, 0x2e, 0x70, 0xc8,
+	0x16, 0x3e, 0x8d, 0xad, 0xa6, 0xf2, 0x5d, 0x52, 0xd8, 0xb1, 0x82, 0x90, 0x0f, 0xf5, 0x95, 0x3b,
+	0x90, 0x38, 0x60, 0xa1, 0x6c, 0xf7, 0x87, 0x6a, 0x1a, 0x9f, 0xdf, 0x38, 0x8d, 0xc5, 0x2d, 0xfb,
+	0xb9, 0xa1, 0x53, 0xf3, 0x3f, 0x86, 0x10, 0x83, 0x8a, 0x08, 0x12, 0x7c, 0x45, 0x48, 0xe2, 0x47,
+	0xf4, 0x0d, 0xb1, 0x1e, 0xa9, 0x62, 0x9d, 0xe6, 0xce, 0x97, 0x0f, 0x45, 0x11, 0xe2, 0x48, 0x52,
+	0x2d, 0xf7, 0x1c, 0x65, 0xf1, 0x84, 0xb1, 0xc8, 0x25, 0x42, 0xd0, 0x78, 0xc6, 0x6d, 0xaf, 0x37,
+	0x59, 0x7e, 0x07, 0xc9, 0x0f, 0x85, 0x47, 0xa7, 0x2c, 0x56, 0x4e, 0x68, 0x06, 0x8d, 0x62, 0xdc,
+	0x72, 0xe7, 0x98, 0x07, 0x2c, 0x21, 0xd6, 0xff, 0x54, 0xe0, 0xa3, 0x9b, 0xb2, 0x3a, 0xd6, 0xc6,
+	0x23, 0x6d, 0xeb, 0x4a, 0x53, 0xa7, 0x1e, 0x7e, 0x0a, 0x36, 0x7f, 0x33, 0xa0, 0xb1, 0x76, 0x4e,
+	0x90, 0x03, 0xdb, 0x6a, 0x71, 0x1a, 0x8a, 0xc7, 0xef, 0x3f, 0x6b, 0xd8, 0x6c, 0xb9, 0x26, 0x55,
+	0xe3, 0x2a, 0x5f, 0x07, 0x23, 0xd8, 0x56, 0x8b, 0xb3, 0x01, 0x15, 0xa7, 0xff, 0x72, 0xe0, 0x7a,
+	0xce, 0x05, 0x1e, 0x8f, 0x86, 0x17, 0xe6, 0x46, 0x73, 0x73, 0xd7, 0x40, 0x35, 0xb8, 0xd3, 0x1d,
+	0x0e, 0xc7, 0x3f, 0xe2, 0xee, 0xe8, 0xc2, 0x34, 0x14, 0xf4, 0x08, 0xee, 0xbe, 0x1e, 0x38, 0xde,
+	0x79, 0x77, 0x88, 0xdd, 0xbe, 0xf3, 0x7a, 0xd0, 0xeb, 0x6b, 0x83, 0x4d, 0x29, 0x6d, 0xfe, 0x61,
+	0x40, 0x7d, 0x4d, 0xaa, 0xe8, 0x02, 0x4a, 0x74, 0xa1, 0xde, 0xd2, 0x95, 0x14, 0xbe, 0xfd, 0x0c,
+	0xd2, 0x54, 0x02, 0x0e, 0x68, 0x67, 0xea, 0xea, 0x5f, 0x41, 0x2d, 0x77, 0x1d, 0xfb, 0x0b, 0xc2,
+	0x13, 0x5f, 0xce, 0xdc, 0x66, 0x6b, 0x4b, 0xbe, 0xec, 0x5a, 0x30, 0xba, 0xc6, 0x0f, 0xec, 0x3c,
+	0x5f, 0x04, 0xd5, 0xee, 0x70, 0x88, 0x47, 0xdd, 0xb3, 0xbe, 0x3b, 0xe9, 0xf6, 0xfa, 0xae, 0xb9,
+	0x21, 0x31, 0xb7, 0x7b, 0xd6, 0x5f, 0x82, 0xa6, 0x71, 0xf0, 0x1d, 0x34, 0xd6, 0x3e, 0x40, 0x68,
+	0x07, 0xb6, 0xc6, 0x27, 0x27, 0xe6, 0x06, 0x2a, 0xc1, 0xce, 0x71, 0xff, 0xa4, 0x7b, 0x3e, 0xf4,
+	0x4c, 0x03, 0x01, 0xdc, 0x76, 0x3d, 0x67, 0xd0, 0xf3, 0xcc, 0xcd, 0x83, 0x27, 0x00, 0xcb, 0x87,
+	0x05, 0xed, 0xc2, 0xf6, 0x68, 0x3c, 0xea, 0x9b, 0x1b, 0xa8, 0x0a, 0x70, 0x76, 0xae, 0xf8, 0xf3,
+	0x86, 0xae, 0x69, 0x1c, 0x3c, 0x85, 0xda, 0x27, 0x2d, 0x2f, 0xd5, 0xbd, 0xfe, 0x4f, 0x9e, 0xb9,
+	0x21, 0xbf, 0x4e, 0xdd, 0xf1, 0xc8, 0x34, 0x4e, 0xb7, 0x77, 0xf7, 0x4c, 0xf3, 0x74, 0x7b, 0x17,
+	0x99, 0xf5, 0x03, 0x0e, 0xe5, 0xd5, 0xd5, 0x81, 0x2c, 0xd8, 0x29, 0xd6, 0xb7, 0xfe, 0xa9, 0x29,
+	0x8e, 0x68, 0x00, 0x65, 0x11, 0xc9, 0x67, 0x5a, 0xf7, 0xb8, 0xfa, 0x89, 0x29, 0x1d, 0x3e, 0xf9,
+	0x97, 0x41, 0xf1, 0x86, 0x6e, 0x31, 0x11, 0x4e, 0x49, 0x44, 0xbc, 0x38, 0xbc, 0x68, 0xff, 0xfe,
+	0x7e, 0xdf, 0xf8, 0xf3, 0xfd, 0xbe, 0xf1, 0xf7, 0xfb, 0x7d, 0xe3, 0xe7, 0xa6, 0xf6, 0x40, 0x59,
+	0xc7, 0x4f, 0x68, 0xe7, 0x83, 0xbf, 0xb6, 0xcb, 0xdb, 0x6a, 0x59, 0x1e, 0xfd, 0x13, 0x00, 0x00,
+	0xff, 0xff, 0xa3, 0x39, 0x16, 0x35, 0x1e, 0x0a, 0x00, 0x00,
 }
diff --git a/mesh/v1alpha1/config.proto b/mesh/v1alpha1/config.proto
index f09b789ed1..975d8c5a01 100644
--- a/mesh/v1alpha1/config.proto
+++ b/mesh/v1alpha1/config.proto
@@ -211,7 +211,7 @@ message MeshConfig {
       // Only configure routes to services that are in the same namespace
       // as the workload as well as services in namespaces specified in
       // importNamespaces.
-      CURRENT_NAMESPACE = 1;
+      SAME_NAMESPACE = 1;
     }
 
     // REQUIRED: The default import setting for every workload in the mesh.
diff --git a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
index 17876816aa..6296b26b6a 100644
--- a/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
+++ b/mesh/v1alpha1/istio.mesh.v1alpha1.pb.html
@@ -399,8 +399,8 @@ <h2 id="MeshConfig-DefaultNetworkScope-Mode">MeshConfig.DefaultNetworkScope.Mode
 
 </td>
 </tr>
-<tr id="MeshConfig-DefaultNetworkScope-Mode-CURRENT_NAMESPACE">
-<td><code>CURRENT_NAMESPACE</code></td>
+<tr id="MeshConfig-DefaultNetworkScope-Mode-SAME_NAMESPACE">
+<td><code>SAME_NAMESPACE</code></td>
 <td>
 <p>Only configure routes to services that are in the same namespace
 as the workload as well as services in namespaces specified in
diff --git a/networking/v1alpha3/destination_rule.pb.go b/networking/v1alpha3/destination_rule.pb.go
index e6e08ba92d..44df1d8164 100644
--- a/networking/v1alpha3/destination_rule.pb.go
+++ b/networking/v1alpha3/destination_rule.pb.go
@@ -247,6 +247,11 @@ type DestinationRule struct {
 	// One or more named sets that represent individual versions of a
 	// service. Traffic policies can be overridden at subset level.
 	Subsets []*Subset `protobuf:"bytes,3,rep,name=subsets" json:"subsets,omitempty"`
+	// The visibility setting associated with this DestinationRule. Set to
+	// PRIVATE if this destination rule should not be exported, i.e. restrict
+	// the applicability of this destination rule to only workloads in the same
+	// namespace as the destination rule.
+	ConfigScope ConfigScope `protobuf:"varint,4,opt,name=config_scope,json=configScope,proto3,enum=istio.networking.v1alpha3.ConfigScope" json:"config_scope,omitempty"`
 }
 
 func (m *DestinationRule) Reset()                    { *m = DestinationRule{} }
@@ -275,6 +280,13 @@ func (m *DestinationRule) GetSubsets() []*Subset {
 	return nil
 }
 
+func (m *DestinationRule) GetConfigScope() ConfigScope {
+	if m != nil {
+		return m.ConfigScope
+	}
+	return ConfigScope_PUBLIC
+}
+
 // Traffic policies to apply for a specific destination, across all
 // destination ports. See DestinationRule for examples.
 type TrafficPolicy struct {
@@ -1324,6 +1336,11 @@ func (m *DestinationRule) MarshalTo(dAtA []byte) (int, error) {
 			i += n
 		}
 	}
+	if m.ConfigScope != 0 {
+		dAtA[i] = 0x20
+		i++
+		i = encodeVarintDestinationRule(dAtA, i, uint64(m.ConfigScope))
+	}
 	return i, nil
 }
 
@@ -1969,6 +1986,9 @@ func (m *DestinationRule) Size() (n int) {
 			n += 1 + l + sovDestinationRule(uint64(l))
 		}
 	}
+	if m.ConfigScope != 0 {
+		n += 1 + sovDestinationRule(uint64(m.ConfigScope))
+	}
 	return n
 }
 
@@ -2379,6 +2399,25 @@ func (m *DestinationRule) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConfigScope", wireType)
+			}
+			m.ConfigScope = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowDestinationRule
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ConfigScope |= (ConfigScope(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipDestinationRule(dAtA[iNdEx:])
@@ -4461,92 +4500,94 @@ func init() {
 }
 
 var fileDescriptorDestinationRule = []byte{
-	// 1379 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x57, 0xcd, 0x6e, 0x1b, 0xb7,
-	0x16, 0xb6, 0x7e, 0x63, 0x1f, 0xf9, 0x47, 0xe6, 0x35, 0x72, 0x15, 0x5d, 0xc0, 0xf1, 0x15, 0x8a,
-	0xc6, 0x4d, 0x9b, 0x51, 0xed, 0xa0, 0x40, 0x9a, 0x20, 0x45, 0x2c, 0xdb, 0x88, 0xdc, 0xc8, 0x96,
-	0x40, 0xc9, 0x40, 0x91, 0xcd, 0x80, 0x1a, 0xd1, 0x12, 0xe3, 0xd1, 0x70, 0x4a, 0x72, 0x54, 0x3b,
-	0xcf, 0xd0, 0x75, 0xd0, 0x6d, 0x37, 0x7d, 0x81, 0xbe, 0x44, 0xd1, 0x55, 0xb7, 0xed, 0xa6, 0x45,
-	0x5e, 0xa0, 0xab, 0x6e, 0xba, 0x2a, 0xc8, 0xe1, 0x48, 0x72, 0xe2, 0xd8, 0x31, 0xd2, 0xec, 0x38,
-	0x3c, 0xe7, 0xfb, 0x48, 0x9e, 0xef, 0xf0, 0x1c, 0x0e, 0xdc, 0x0e, 0xa8, 0xfa, 0x86, 0x8b, 0x63,
-	0x16, 0xf4, 0xab, 0xa3, 0x0d, 0xe2, 0x87, 0x03, 0x72, 0xb7, 0xda, 0xa3, 0x52, 0xb1, 0x80, 0x28,
-	0xc6, 0x03, 0x57, 0x44, 0x3e, 0x75, 0x42, 0xc1, 0x15, 0x47, 0x37, 0x98, 0x54, 0x8c, 0x3b, 0x13,
-	0x84, 0x93, 0x20, 0xca, 0xab, 0x7d, 0xce, 0xfb, 0x3e, 0xad, 0x1a, 0xc7, 0x6e, 0x74, 0x54, 0xed,
-	0x45, 0xc2, 0xe0, 0x63, 0x68, 0xf9, 0xa3, 0xf3, 0x96, 0x19, 0x31, 0xa1, 0x22, 0xe2, 0xbb, 0x92,
-	0x8a, 0x11, 0xf3, 0xec, 0x2a, 0xe5, 0x95, 0x3e, 0xef, 0x73, 0x33, 0xac, 0xea, 0x51, 0x3c, 0x5b,
-	0xf9, 0x31, 0x05, 0x4b, 0x3b, 0x93, 0x6d, 0xe1, 0xc8, 0xa7, 0x08, 0x41, 0x76, 0xc0, 0xa5, 0x2a,
-	0xa5, 0xd6, 0x52, 0xeb, 0x73, 0xd8, 0x8c, 0x51, 0x13, 0x16, 0x95, 0x20, 0x47, 0x47, 0xcc, 0x73,
-	0x43, 0xee, 0x33, 0xef, 0xb4, 0x94, 0x5e, 0x4b, 0xad, 0x17, 0x36, 0xd7, 0x9d, 0x37, 0x6e, 0xde,
-	0xe9, 0xc4, 0x80, 0x96, 0xf1, 0xc7, 0x0b, 0x6a, 0xfa, 0x13, 0x3d, 0x80, 0x6b, 0x32, 0xea, 0x4a,
-	0xaa, 0x64, 0x29, 0xb3, 0x96, 0x59, 0x2f, 0x6c, 0xfe, 0xff, 0x02, 0xa6, 0xb6, 0xf1, 0xc4, 0x09,
-	0xa2, 0xf2, 0x5b, 0x1e, 0x16, 0xce, 0xb0, 0xa3, 0x0e, 0x2c, 0xf8, 0x9c, 0xf4, 0xdc, 0x2e, 0xf1,
-	0x49, 0xe0, 0x51, 0x61, 0x36, 0x5f, 0xd8, 0xac, 0x5e, 0x40, 0xda, 0xe0, 0xa4, 0x57, 0xb3, 0xee,
-	0x6d, 0xaa, 0x14, 0x0b, 0xfa, 0x12, 0xcf, 0xfb, 0x53, 0xb3, 0xe8, 0x29, 0x2c, 0x79, 0x3c, 0x08,
-	0xa8, 0x67, 0x24, 0x0b, 0x39, 0xf7, 0xed, 0xb1, 0x37, 0x2e, 0xe0, 0xdd, 0x1e, 0x23, 0x5a, 0x9c,
-	0xfb, 0x63, 0xe6, 0x45, 0xef, 0xcc, 0x3c, 0xfa, 0x0a, 0x96, 0x79, 0xa4, 0x7c, 0x46, 0x85, 0xdb,
-	0xa3, 0x2a, 0x36, 0x94, 0x32, 0x86, 0xfd, 0xe3, 0x0b, 0xd8, 0x9b, 0x31, 0x66, 0x27, 0x81, 0xe0,
-	0x22, 0x7f, 0x65, 0x06, 0xdd, 0x83, 0x8c, 0xf2, 0x65, 0x29, 0x6b, 0xb8, 0x3e, 0xbc, 0x48, 0xa0,
-	0x46, 0x7b, 0xbc, 0x3d, 0x0d, 0x41, 0xcf, 0xe0, 0x3f, 0x21, 0x17, 0xca, 0xf5, 0xe9, 0x88, 0xea,
-	0xfc, 0x89, 0x6d, 0xa5, 0x9c, 0x11, 0xe8, 0xfe, 0xdb, 0x4a, 0xed, 0xb4, 0xb8, 0x50, 0x67, 0xc5,
-	0x5f, 0xd6, 0xb4, 0x0d, 0xcd, 0x9a, 0x2c, 0x58, 0x7e, 0x91, 0x81, 0xe5, 0xd7, 0x1c, 0xd1, 0x03,
-	0xc8, 0x6a, 0x57, 0x2b, 0xdf, 0xad, 0x0b, 0x96, 0xd4, 0xd8, 0x36, 0xf5, 0xa9, 0xa7, 0xb8, 0xc0,
-	0x06, 0xf4, 0x7a, 0x12, 0xa4, 0xdf, 0x53, 0x12, 0x64, 0xde, 0x6b, 0x12, 0x64, 0xff, 0xc5, 0x24,
-	0xc8, 0x5d, 0x39, 0x09, 0x2a, 0x7f, 0xa6, 0x20, 0x1f, 0x5f, 0x38, 0x5d, 0x09, 0x02, 0x32, 0xa4,
-	0x49, 0x25, 0xd0, 0x63, 0xb4, 0x0b, 0x79, 0x9f, 0x74, 0xa9, 0x2f, 0x4b, 0x69, 0x93, 0x16, 0x77,
-	0x2e, 0xbd, 0xb7, 0x4e, 0xc3, 0xf8, 0xef, 0x06, 0x4a, 0x9c, 0x62, 0x0b, 0x3e, 0xa7, 0xa0, 0x64,
-	0xde, 0xa9, 0xa0, 0x94, 0x3f, 0x87, 0xc2, 0xd4, 0x3a, 0xa8, 0x08, 0x99, 0x63, 0x7a, 0x6a, 0x77,
-	0xae, 0x87, 0x68, 0x05, 0x72, 0x23, 0xe2, 0x47, 0xd4, 0x64, 0xc5, 0x1c, 0x8e, 0x3f, 0xee, 0xa7,
-	0xef, 0xa5, 0x2a, 0x3f, 0xe4, 0x60, 0xe5, 0xbc, 0x44, 0x40, 0x18, 0xf2, 0x92, 0x0d, 0x43, 0x3f,
-	0x8e, 0xc0, 0xe2, 0xe6, 0xbd, 0x2b, 0x66, 0x92, 0xd3, 0x36, 0xe8, 0x46, 0xad, 0x3e, 0x83, 0x2d,
-	0x13, 0x3a, 0x36, 0xe9, 0x24, 0x99, 0x54, 0x34, 0x50, 0xee, 0x80, 0xc8, 0x81, 0x4d, 0xd3, 0x47,
-	0x57, 0x25, 0xdf, 0x1e, 0xd3, 0xd4, 0x89, 0x1c, 0x98, 0x45, 0x16, 0xbd, 0x33, 0x73, 0xe5, 0xbf,
-	0xd2, 0x50, 0x7c, 0xd5, 0x0d, 0xdd, 0x86, 0xe2, 0x40, 0xa9, 0xd0, 0x1d, 0x50, 0xd2, 0xa3, 0xc2,
-	0x9d, 0x28, 0xac, 0x09, 0xb4, 0xa5, 0x6e, 0x0c, 0x07, 0x5a, 0xed, 0x00, 0x0a, 0xc6, 0xd7, 0xe3,
-	0xfc, 0x98, 0x51, 0xbb, 0xd3, 0x27, 0xef, 0xba, 0x53, 0xa7, 0xde, 0xe9, 0xb4, 0xb6, 0x0d, 0x65,
-	0x7d, 0x06, 0x83, 0x5e, 0x21, 0xfe, 0x42, 0x1f, 0xc0, 0x42, 0x24, 0xa9, 0x2b, 0x79, 0x24, 0x3c,
-	0xea, 0xb2, 0xd0, 0x64, 0xc5, 0x6c, 0x7d, 0x06, 0x17, 0x22, 0x49, 0xdb, 0x66, 0x76, 0x2f, 0x44,
-	0xb7, 0x61, 0x79, 0xc8, 0x02, 0x36, 0x8c, 0x86, 0xae, 0x60, 0x41, 0xdf, 0x95, 0xec, 0x39, 0x35,
-	0xd7, 0x26, 0x8b, 0x97, 0xac, 0x01, 0xb3, 0xa0, 0xdf, 0x66, 0xcf, 0x69, 0xb9, 0x0f, 0x30, 0x59,
-	0xed, 0xdc, 0x8c, 0x46, 0x90, 0x0d, 0x89, 0x1a, 0xd8, 0xbc, 0x30, 0x63, 0xb4, 0x01, 0x19, 0xa5,
-	0x92, 0x8b, 0x7e, 0xc3, 0x89, 0xdb, 0xb0, 0x93, 0xb4, 0x61, 0x67, 0xc7, 0xb6, 0xe1, 0x5a, 0xf6,
-	0xbb, 0xdf, 0x6f, 0xa6, 0xb0, 0xf6, 0xad, 0x01, 0xcc, 0x6a, 0x35, 0xdd, 0x63, 0x7a, 0x5a, 0xa9,
-	0xc3, 0x6c, 0x22, 0x3d, 0x5a, 0x82, 0x02, 0x6e, 0x1e, 0x1e, 0xec, 0xb8, 0xb8, 0x59, 0xdb, 0x3b,
-	0x28, 0xce, 0xa0, 0x45, 0x80, 0xc6, 0xee, 0x56, 0xbb, 0xe3, 0x6e, 0x37, 0x0f, 0x0e, 0x8a, 0x29,
-	0x04, 0x90, 0xc7, 0x5b, 0x07, 0x3b, 0xcd, 0xfd, 0x62, 0x5a, 0x3b, 0xb7, 0xb6, 0xda, 0xed, 0x4e,
-	0x1d, 0x37, 0x0f, 0x1f, 0xd7, 0x8b, 0x99, 0x5a, 0x01, 0xe6, 0xfc, 0xae, 0xbd, 0x22, 0x95, 0x17,
-	0x79, 0xb8, 0x7e, 0x7e, 0x65, 0x41, 0x4d, 0xc8, 0x28, 0x2f, 0xb4, 0x75, 0xf3, 0xe1, 0x95, 0x2b,
-	0x93, 0xd3, 0xd9, 0x6e, 0x4d, 0x95, 0x01, 0x2f, 0x44, 0x18, 0xb2, 0x5a, 0x17, 0x2b, 0xf9, 0x17,
-	0x57, 0x67, 0xd4, 0x51, 0x1f, 0x53, 0x1a, 0xae, 0xf2, 0xdf, 0x69, 0x28, 0x4c, 0x2d, 0x84, 0x6e,
-	0xc1, 0xd2, 0x90, 0x9c, 0xb8, 0x93, 0xa2, 0x28, 0xcd, 0x01, 0x72, 0x78, 0x71, 0x48, 0x4e, 0x26,
-	0xb4, 0x12, 0xd5, 0xc6, 0x35, 0xd8, 0x55, 0x6c, 0x48, 0x79, 0xa4, 0xec, 0xbe, 0xde, 0x2c, 0xcd,
-	0xb8, 0xd6, 0x76, 0x62, 0x00, 0xe2, 0xb0, 0xa0, 0xbc, 0xd0, 0x3d, 0xa6, 0x34, 0x24, 0x3e, 0x1b,
-	0x51, 0x2b, 0xee, 0x97, 0xef, 0x14, 0x2b, 0xa7, 0xe3, 0x85, 0x4f, 0x12, 0x46, 0x3c, 0xaf, 0xa6,
-	0xbe, 0xca, 0xdf, 0xa6, 0x60, 0x7e, 0xda, 0x8c, 0xae, 0x43, 0x3e, 0x14, 0xbc, 0x4b, 0xe3, 0x53,
-	0x2e, 0x60, 0xfb, 0x85, 0xee, 0x40, 0x56, 0x9f, 0xea, 0xf2, 0x23, 0x19, 0x37, 0xf4, 0x19, 0xcc,
-	0xb2, 0x40, 0x51, 0x31, 0x22, 0x97, 0x27, 0x28, 0x1e, 0xbb, 0x96, 0x7f, 0x4d, 0xc1, 0xfc, 0xb4,
-	0x26, 0xe8, 0x01, 0x94, 0xb5, 0x2a, 0x1b, 0xae, 0xd6, 0x20, 0xa4, 0x41, 0x4f, 0x5f, 0x25, 0x41,
-	0xbf, 0x8e, 0xa8, 0x54, 0x89, 0x10, 0xff, 0x35, 0x1e, 0xfb, 0xe4, 0xa4, 0x15, 0xdb, 0xb1, 0x35,
-	0xa3, 0x4f, 0x00, 0x69, 0xd3, 0xa6, 0x01, 0x8f, 0x41, 0x69, 0x03, 0x32, 0xe5, 0x65, 0x73, 0x9f,
-	0x9c, 0x8c, 0xbd, 0x1f, 0xc2, 0xff, 0xa6, 0xfd, 0xdc, 0x90, 0x8a, 0x29, 0xd5, 0xcd, 0x29, 0x72,
-	0xb8, 0x34, 0x9c, 0x20, 0x5a, 0x54, 0x4c, 0x82, 0x8f, 0x6e, 0x42, 0x21, 0x86, 0x2b, 0xc1, 0x68,
-	0xfc, 0xb2, 0xc9, 0x61, 0x30, 0xee, 0x66, 0xa6, 0xf2, 0x7d, 0x1a, 0x8a, 0xaf, 0x36, 0x45, 0x74,
-	0x07, 0x90, 0x2e, 0x87, 0xd4, 0x8b, 0x14, 0x1b, 0x51, 0x97, 0x0a, 0xc1, 0x45, 0x72, 0xae, 0xe5,
-	0x29, 0xcb, 0xae, 0x31, 0x9c, 0x09, 0x6b, 0xfa, 0xad, 0xc3, 0x8a, 0x1e, 0x03, 0xea, 0x12, 0x49,
-	0x5d, 0xfa, 0xcc, 0xbe, 0x10, 0x8c, 0x94, 0x97, 0xea, 0x52, 0xd4, 0xa0, 0x5d, 0x8b, 0xd1, 0x29,
-	0x8a, 0x3e, 0x85, 0x15, 0x7d, 0xc8, 0x31, 0x4f, 0x48, 0x85, 0x47, 0x03, 0x65, 0x4f, 0x8b, 0x86,
-	0xe4, 0x24, 0x71, 0x6f, 0xc5, 0x16, 0xad, 0xc1, 0x90, 0x05, 0xba, 0x8e, 0xfb, 0x6a, 0x30, 0xf6,
-	0xcf, 0xc5, 0x1a, 0x0c, 0x59, 0x50, 0x37, 0x06, 0xeb, 0x5d, 0xf9, 0x59, 0x5f, 0xbe, 0x49, 0xb3,
-	0x47, 0x35, 0xc8, 0x0e, 0x79, 0x2f, 0x69, 0x6d, 0xce, 0xdb, 0x3d, 0x11, 0xf4, 0x58, 0xa3, 0xb0,
-	0xc1, 0x9a, 0x10, 0xfb, 0x4c, 0x37, 0x32, 0x8f, 0x0a, 0xc5, 0x8e, 0x98, 0x47, 0x54, 0xd2, 0x60,
-	0x97, 0x63, 0xcb, 0xf6, 0xc4, 0xa0, 0x75, 0x0c, 0x05, 0x1b, 0x11, 0x45, 0x75, 0x95, 0x34, 0x41,
-	0x9a, 0xc3, 0x60, 0xa7, 0x9e, 0xd0, 0x53, 0x5d, 0x10, 0x3c, 0x32, 0xcd, 0x15, 0x8b, 0x3d, 0x87,
-	0x17, 0x3d, 0x32, 0x45, 0x24, 0x75, 0x07, 0x90, 0x51, 0x57, 0xc7, 0xc3, 0x25, 0xbe, 0x32, 0x3d,
-	0x2c, 0x7e, 0xa7, 0xce, 0xe1, 0x25, 0x6b, 0xd8, 0xf2, 0x95, 0x6e, 0x61, 0x52, 0x3f, 0x05, 0x64,
-	0xc0, 0x4a, 0xf9, 0xf8, 0x29, 0x20, 0x03, 0x56, 0x79, 0x04, 0xd7, 0xec, 0x39, 0x50, 0x01, 0xae,
-	0xed, 0xec, 0xb5, 0xb7, 0x6a, 0x8d, 0xdd, 0xe2, 0x8c, 0xae, 0xc4, 0xed, 0xbd, 0xfd, 0x56, 0x63,
-	0x37, 0xae, 0xca, 0xfb, 0x87, 0x9d, 0xc3, 0xad, 0x46, 0x31, 0x8d, 0x8a, 0x30, 0xbf, 0xd7, 0xee,
-	0xec, 0x35, 0x5d, 0x3b, 0x93, 0xa9, 0x39, 0x3f, 0xbd, 0x5c, 0x4d, 0xfd, 0xf2, 0x72, 0x35, 0xf5,
-	0xc7, 0xcb, 0xd5, 0xd4, 0xd3, 0xb5, 0x38, 0x76, 0x8c, 0x57, 0x49, 0xc8, 0xaa, 0xe7, 0xfc, 0x93,
-	0x75, 0xf3, 0x26, 0x03, 0xee, 0xfe, 0x13, 0x00, 0x00, 0xff, 0xff, 0x9a, 0x4a, 0x6d, 0x05, 0x18,
-	0x0e, 0x00, 0x00,
+	// 1416 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x57, 0x4f, 0x6f, 0x1b, 0xb7,
+	0x12, 0xb7, 0xfe, 0xc6, 0x1e, 0xd9, 0xb2, 0xcc, 0x67, 0xe4, 0x29, 0x7a, 0x80, 0xe3, 0x27, 0x14,
+	0x8d, 0x9b, 0x36, 0xab, 0xda, 0x41, 0x81, 0x34, 0x41, 0x8a, 0x58, 0xb6, 0x11, 0xb9, 0x91, 0x2d,
+	0x81, 0x2b, 0x03, 0x45, 0x2e, 0x0b, 0x6a, 0x45, 0x4b, 0x8c, 0x57, 0xcb, 0xed, 0x92, 0xab, 0xda,
+	0xf9, 0x0c, 0x3d, 0x07, 0xbd, 0xf6, 0xd2, 0xcf, 0x52, 0xf4, 0xd4, 0x6b, 0x7b, 0x69, 0x91, 0x2f,
+	0xd0, 0x53, 0x2f, 0x3d, 0x14, 0x05, 0xb9, 0x5c, 0x49, 0x4e, 0x1c, 0x39, 0x46, 0x9a, 0x1b, 0xc9,
+	0xf9, 0xfd, 0x86, 0xe4, 0xcc, 0x6f, 0x67, 0xb8, 0x70, 0xdb, 0xa7, 0xf2, 0x1b, 0x1e, 0x9e, 0x30,
+	0xbf, 0x5f, 0x1b, 0x6d, 0x12, 0x2f, 0x18, 0x90, 0xbb, 0xb5, 0x1e, 0x15, 0x92, 0xf9, 0x44, 0x32,
+	0xee, 0x3b, 0x61, 0xe4, 0x51, 0x2b, 0x08, 0xb9, 0xe4, 0xe8, 0x06, 0x13, 0x92, 0x71, 0x6b, 0xc2,
+	0xb0, 0x12, 0x46, 0x65, 0xad, 0xcf, 0x79, 0xdf, 0xa3, 0x35, 0x0d, 0xec, 0x46, 0xc7, 0xb5, 0x5e,
+	0x14, 0x6a, 0x7e, 0x4c, 0xad, 0x7c, 0x74, 0xd1, 0x36, 0x23, 0x16, 0xca, 0x88, 0x78, 0x8e, 0xa0,
+	0xe1, 0x88, 0xb9, 0x66, 0x97, 0xca, 0xad, 0x8b, 0xa0, 0x66, 0xcd, 0x11, 0x2e, 0x0f, 0x12, 0xe0,
+	0x6a, 0x9f, 0xf7, 0xb9, 0x1e, 0xd6, 0xd4, 0x28, 0x5e, 0xad, 0xfe, 0x9d, 0x82, 0xe5, 0xdd, 0xc9,
+	0xf9, 0x71, 0xe4, 0x51, 0x84, 0x20, 0x3b, 0xe0, 0x42, 0x96, 0x53, 0xeb, 0xa9, 0x8d, 0x05, 0xac,
+	0xc7, 0xa8, 0x05, 0x45, 0x19, 0x92, 0xe3, 0x63, 0xe6, 0x3a, 0x01, 0xf7, 0x98, 0x7b, 0x56, 0x4e,
+	0xaf, 0xa7, 0x36, 0x0a, 0x5b, 0x1b, 0xd6, 0x1b, 0x6f, 0x69, 0x75, 0x62, 0x42, 0x5b, 0xe3, 0xf1,
+	0x92, 0x9c, 0x9e, 0xa2, 0x07, 0x70, 0x4d, 0x44, 0x5d, 0x41, 0xa5, 0x28, 0x67, 0xd6, 0x33, 0x1b,
+	0x85, 0xad, 0xff, 0xcf, 0xf0, 0x64, 0x6b, 0x24, 0x4e, 0x18, 0x68, 0x1f, 0x16, 0x5d, 0xee, 0x1f,
+	0xb3, 0x7e, 0x7c, 0xc3, 0x72, 0x76, 0x3d, 0xb5, 0x51, 0xdc, 0xfa, 0x70, 0x86, 0x87, 0x1d, 0x0d,
+	0xb7, 0x15, 0x1a, 0x17, 0xdc, 0xc9, 0xa4, 0xfa, 0x6b, 0x1e, 0x96, 0xce, 0x1d, 0x14, 0x75, 0x60,
+	0xc9, 0xe3, 0xa4, 0xe7, 0x74, 0x89, 0x47, 0x7c, 0x97, 0x86, 0x3a, 0x0e, 0x85, 0xad, 0xda, 0x0c,
+	0xef, 0x4d, 0x4e, 0x7a, 0x75, 0x03, 0xb7, 0xa9, 0x94, 0xcc, 0xef, 0x0b, 0xbc, 0xe8, 0x4d, 0xad,
+	0xa2, 0xa7, 0xb0, 0xec, 0x72, 0xdf, 0xa7, 0xae, 0x96, 0x49, 0xc0, 0xb9, 0x67, 0x22, 0xb8, 0x39,
+	0xfb, 0xd4, 0x86, 0xd1, 0xe6, 0xdc, 0x1b, 0x7b, 0x2e, 0xba, 0xe7, 0xd6, 0xd1, 0x57, 0xb0, 0xc2,
+	0x23, 0xe9, 0x31, 0x1a, 0x3a, 0x3d, 0x2a, 0x63, 0x43, 0x39, 0xa3, 0xbd, 0x7f, 0x3c, 0xc3, 0x7b,
+	0x2b, 0xe6, 0xec, 0x26, 0x14, 0x5c, 0xe2, 0xaf, 0xac, 0xa0, 0x7b, 0x90, 0x91, 0x9e, 0xd0, 0xf1,
+	0x2d, 0xcc, 0x8c, 0x6f, 0xa7, 0x69, 0x8f, 0x8f, 0xa7, 0x28, 0xe8, 0x19, 0xfc, 0x27, 0xe0, 0xa1,
+	0x74, 0x3c, 0x3a, 0xa2, 0x4a, 0xb3, 0xb1, 0xad, 0x9c, 0xd3, 0xb9, 0xbe, 0xff, 0xb6, 0xaa, 0xb1,
+	0xda, 0x3c, 0x94, 0xe7, 0x75, 0xb4, 0xa2, 0xdc, 0x36, 0x95, 0xd7, 0x64, 0xc3, 0xca, 0x8b, 0x0c,
+	0xac, 0xbc, 0x06, 0x44, 0x0f, 0x20, 0xab, 0xa0, 0x26, 0x7d, 0xb7, 0x66, 0x6c, 0xa9, 0xb8, 0x36,
+	0xf5, 0xa8, 0x2b, 0x79, 0x88, 0x35, 0xe9, 0x75, 0x11, 0xa4, 0xdf, 0x93, 0x08, 0x32, 0xef, 0x55,
+	0x04, 0xd9, 0x7f, 0x51, 0x04, 0xb9, 0x2b, 0x8b, 0xa0, 0xfa, 0x47, 0x0a, 0xf2, 0xf1, 0xb7, 0xab,
+	0x8a, 0x8a, 0x4f, 0x86, 0x34, 0x29, 0x2a, 0x6a, 0x8c, 0xf6, 0x20, 0xef, 0x91, 0x2e, 0xf5, 0x44,
+	0x39, 0xad, 0x65, 0x71, 0xe7, 0xd2, 0x12, 0x60, 0x35, 0x35, 0x7e, 0xcf, 0x97, 0xe1, 0x19, 0x36,
+	0xe4, 0x0b, 0x6a, 0x53, 0xe6, 0x9d, 0x6a, 0x53, 0xe5, 0x73, 0x28, 0x4c, 0xed, 0x83, 0x4a, 0x90,
+	0x39, 0xa1, 0x67, 0xe6, 0xe4, 0x6a, 0x88, 0x56, 0x21, 0x37, 0x22, 0x5e, 0x44, 0xb5, 0x2a, 0x16,
+	0x70, 0x3c, 0xb9, 0x9f, 0xbe, 0x97, 0xaa, 0xfe, 0x90, 0x83, 0xd5, 0x8b, 0x84, 0x80, 0x30, 0xe4,
+	0x05, 0x1b, 0x06, 0x5e, 0x1c, 0x81, 0xe2, 0xd6, 0xbd, 0x2b, 0x2a, 0xc9, 0xb2, 0x35, 0xbb, 0x59,
+	0x6f, 0xcc, 0x61, 0xe3, 0x09, 0x9d, 0x68, 0x39, 0x09, 0x26, 0x24, 0xf5, 0xa5, 0x33, 0x20, 0x62,
+	0x60, 0x64, 0xfa, 0xe8, 0xaa, 0xce, 0x77, 0xc6, 0x6e, 0x1a, 0x44, 0x0c, 0xf4, 0x26, 0x45, 0xf7,
+	0xdc, 0x5a, 0xe5, 0xcf, 0x34, 0x94, 0x5e, 0x85, 0xa1, 0xdb, 0x50, 0x1a, 0x48, 0x19, 0x38, 0x03,
+	0x4a, 0x7a, 0x34, 0x74, 0x26, 0x19, 0x56, 0x0e, 0x94, 0xa5, 0xa1, 0x0d, 0x87, 0x2a, 0xdb, 0x3e,
+	0x14, 0x34, 0xd6, 0xe5, 0xfc, 0x84, 0x51, 0x73, 0xd2, 0x27, 0xef, 0x7a, 0x52, 0xab, 0xd1, 0xe9,
+	0xb4, 0x77, 0xb4, 0xcb, 0xc6, 0x1c, 0x06, 0xb5, 0x43, 0x3c, 0x43, 0x1f, 0xc0, 0x52, 0x24, 0xa8,
+	0x23, 0x78, 0x14, 0xba, 0xd4, 0x61, 0x81, 0x56, 0xc5, 0x7c, 0x63, 0x0e, 0x17, 0x22, 0x41, 0x6d,
+	0xbd, 0xba, 0x1f, 0xa0, 0xdb, 0xb0, 0x32, 0x64, 0x3e, 0x1b, 0x46, 0x43, 0x27, 0x64, 0x7e, 0xdf,
+	0x11, 0xec, 0x79, 0xdc, 0x4f, 0xb2, 0x78, 0xd9, 0x18, 0x30, 0xf3, 0xfb, 0x36, 0x7b, 0x4e, 0x2b,
+	0x7d, 0x80, 0xc9, 0x6e, 0x17, 0x2a, 0x1a, 0x41, 0x36, 0x20, 0x72, 0x60, 0x74, 0xa1, 0xc7, 0x68,
+	0x13, 0x32, 0x52, 0x26, 0x1f, 0xfa, 0x0d, 0x2b, 0x6e, 0xfd, 0x56, 0xd2, 0xfa, 0xad, 0x5d, 0xd3,
+	0xfa, 0xeb, 0xd9, 0xef, 0x7e, 0xbb, 0x99, 0xc2, 0x0a, 0x5b, 0x07, 0x98, 0x57, 0xd9, 0x74, 0x4e,
+	0xe8, 0x59, 0xb5, 0x01, 0xf3, 0x49, 0xea, 0xd1, 0x32, 0x14, 0x70, 0xeb, 0xe8, 0x70, 0xd7, 0xc1,
+	0xad, 0xfa, 0xfe, 0x61, 0x69, 0x0e, 0x15, 0x01, 0x9a, 0x7b, 0xdb, 0x76, 0xc7, 0xd9, 0x69, 0x1d,
+	0x1e, 0x96, 0x52, 0x08, 0x20, 0x8f, 0xb7, 0x0f, 0x77, 0x5b, 0x07, 0xa5, 0xb4, 0x02, 0xb7, 0xb7,
+	0x6d, 0xbb, 0xd3, 0xc0, 0xad, 0xa3, 0xc7, 0x8d, 0x52, 0xa6, 0x5e, 0x80, 0x05, 0xaf, 0x6b, 0x3e,
+	0x91, 0xea, 0x8b, 0x3c, 0x5c, 0xbf, 0xb8, 0xb2, 0xa0, 0x16, 0x64, 0xa4, 0x1b, 0x98, 0xba, 0xf9,
+	0xf0, 0xca, 0x95, 0xc9, 0xea, 0xec, 0xb4, 0xa7, 0xca, 0x80, 0x1b, 0x20, 0x0c, 0x59, 0x95, 0x17,
+	0x93, 0xf2, 0x2f, 0xae, 0xee, 0x51, 0x45, 0x7d, 0xec, 0x52, 0xfb, 0xaa, 0xfc, 0x95, 0x86, 0xc2,
+	0xd4, 0x46, 0xe8, 0x16, 0x2c, 0x0f, 0xc9, 0xa9, 0x33, 0x29, 0x8a, 0x42, 0x5f, 0x20, 0x87, 0x8b,
+	0x43, 0x72, 0x3a, 0x71, 0x2b, 0x50, 0x7d, 0x5c, 0x83, 0x1d, 0xc9, 0x86, 0x94, 0x47, 0xd2, 0x9c,
+	0xeb, 0xcd, 0xa9, 0x19, 0xd7, 0xda, 0x4e, 0x4c, 0x40, 0x1c, 0x96, 0xa4, 0x1b, 0x38, 0x27, 0x94,
+	0x06, 0xc4, 0x63, 0x23, 0x6a, 0x92, 0xfb, 0xe5, 0x3b, 0xc5, 0xca, 0xea, 0xb8, 0xc1, 0x93, 0xc4,
+	0x23, 0x5e, 0x94, 0x53, 0xb3, 0xca, 0xb7, 0x29, 0x58, 0x9c, 0x36, 0xa3, 0xeb, 0x90, 0x0f, 0x42,
+	0xde, 0xa5, 0xf1, 0x2d, 0x97, 0xb0, 0x99, 0xa1, 0x3b, 0x90, 0x55, 0xb7, 0xba, 0xfc, 0x4a, 0x1a,
+	0x86, 0x3e, 0x83, 0x79, 0xe6, 0x4b, 0x1a, 0x8e, 0xc8, 0xe5, 0x02, 0xc5, 0x63, 0x68, 0xe5, 0x97,
+	0x14, 0x2c, 0x4e, 0xe7, 0x04, 0x3d, 0x80, 0x8a, 0xca, 0xca, 0xa6, 0xa3, 0x72, 0x10, 0x50, 0xbf,
+	0xa7, 0x3e, 0xa5, 0x90, 0x7e, 0x1d, 0x51, 0x21, 0x93, 0x44, 0xfc, 0x57, 0x23, 0x0e, 0xc8, 0x69,
+	0x3b, 0xb6, 0x63, 0x63, 0x46, 0x9f, 0x00, 0x52, 0xa6, 0x2d, 0x4d, 0x1e, 0x93, 0xd2, 0x9a, 0xa4,
+	0xcb, 0xcb, 0xd6, 0x01, 0x39, 0x1d, 0xa3, 0x1f, 0xc2, 0xff, 0xa6, 0x71, 0x4e, 0x40, 0xc3, 0xa9,
+	0xac, 0xeb, 0x5b, 0xe4, 0x70, 0x79, 0x38, 0x61, 0xb4, 0x69, 0x38, 0x09, 0x3e, 0xba, 0x09, 0x85,
+	0x98, 0x2e, 0x43, 0x46, 0xe3, 0x97, 0x4d, 0x0e, 0x83, 0x86, 0xeb, 0x95, 0xea, 0xf7, 0x69, 0x28,
+	0xbd, 0xda, 0x14, 0xd1, 0x1d, 0x40, 0xaa, 0x1c, 0x52, 0x37, 0x92, 0x6c, 0x44, 0x1d, 0x1a, 0x86,
+	0x3c, 0x4c, 0xee, 0xb5, 0x32, 0x65, 0xd9, 0xd3, 0x86, 0x73, 0x61, 0x4d, 0xbf, 0x75, 0x58, 0xd1,
+	0x63, 0x40, 0x5d, 0x22, 0xa8, 0x43, 0x9f, 0x99, 0x17, 0x82, 0x4e, 0xe5, 0xa5, 0x79, 0x29, 0x29,
+	0xd2, 0x9e, 0xe1, 0x28, 0x89, 0xa2, 0x4f, 0x61, 0x55, 0x5d, 0x72, 0xec, 0x27, 0xa0, 0xa1, 0x4b,
+	0x7d, 0x69, 0x6e, 0x8b, 0x86, 0xe4, 0x34, 0x81, 0xb7, 0x63, 0x8b, 0xca, 0xc1, 0x90, 0xf9, 0xaa,
+	0x8e, 0x7b, 0x72, 0x30, 0xc6, 0xe7, 0xe2, 0x1c, 0x0c, 0x99, 0xdf, 0xd0, 0x06, 0x83, 0xae, 0xfe,
+	0xa4, 0x3e, 0xbe, 0x49, 0xb3, 0x47, 0x75, 0xc8, 0x0e, 0x79, 0x2f, 0x69, 0x6d, 0xd6, 0xdb, 0x3d,
+	0x11, 0xd4, 0x58, 0xb1, 0xb0, 0xe6, 0xea, 0x10, 0x7b, 0x4c, 0x35, 0x32, 0x97, 0x86, 0x92, 0x1d,
+	0x33, 0x97, 0xc8, 0xa4, 0xc1, 0xae, 0xc4, 0x96, 0x9d, 0x89, 0x41, 0xe5, 0x31, 0x08, 0xd9, 0x88,
+	0x48, 0xaa, 0xaa, 0xa4, 0x0e, 0xd2, 0x02, 0x06, 0xb3, 0xf4, 0x84, 0x9e, 0xa9, 0x82, 0xe0, 0x92,
+	0x69, 0x5f, 0x71, 0xb2, 0x17, 0x70, 0xd1, 0x25, 0x53, 0x8e, 0x84, 0xea, 0x00, 0x22, 0xea, 0xaa,
+	0x78, 0x38, 0xc4, 0x93, 0xba, 0x87, 0xc5, 0xef, 0xd4, 0x05, 0xbc, 0x6c, 0x0c, 0xdb, 0x9e, 0x54,
+	0x2d, 0x4c, 0xa8, 0xa7, 0x80, 0xf0, 0x59, 0x39, 0x1f, 0x3f, 0x05, 0x84, 0xcf, 0xaa, 0x8f, 0xe0,
+	0x9a, 0xb9, 0x07, 0x2a, 0xc0, 0xb5, 0xdd, 0x7d, 0x7b, 0xbb, 0xde, 0xdc, 0x2b, 0xcd, 0xa9, 0x4a,
+	0x6c, 0xef, 0x1f, 0xb4, 0x9b, 0x7b, 0x71, 0x55, 0x3e, 0x38, 0xea, 0x1c, 0x6d, 0x37, 0x4b, 0x69,
+	0x54, 0x82, 0xc5, 0x7d, 0xbb, 0xb3, 0xdf, 0x72, 0xcc, 0x4a, 0xa6, 0x6e, 0xfd, 0xf8, 0x72, 0x2d,
+	0xf5, 0xf3, 0xcb, 0xb5, 0xd4, 0xef, 0x2f, 0xd7, 0x52, 0x4f, 0xd7, 0xe3, 0xd8, 0x31, 0x5e, 0x23,
+	0x01, 0xab, 0x5d, 0xf0, 0x73, 0xd7, 0xcd, 0x6b, 0x05, 0xdc, 0xfd, 0x27, 0x00, 0x00, 0xff, 0xff,
+	0xa1, 0xaa, 0x97, 0xcc, 0x8c, 0x0e, 0x00, 0x00,
 }
diff --git a/networking/v1alpha3/destination_rule.proto b/networking/v1alpha3/destination_rule.proto
index a19091e2c3..ebd4faf38e 100644
--- a/networking/v1alpha3/destination_rule.proto
+++ b/networking/v1alpha3/destination_rule.proto
@@ -15,6 +15,7 @@ syntax = "proto3";
 
 import "google/protobuf/duration.proto";
 import "networking/v1alpha3/virtual_service.proto";
+import "networking/v1alpha3/network_scope.proto";
 import "gogoproto/gogo.proto";
 
 package istio.networking.v1alpha3;
@@ -117,6 +118,12 @@ message DestinationRule {
   // One or more named sets that represent individual versions of a
   // service. Traffic policies can be overridden at subset level.
   repeated Subset subsets = 3;
+
+  // The visibility setting associated with this DestinationRule. Set to
+  // PRIVATE if this destination rule should not be exported, i.e. restrict
+  // the applicability of this destination rule to only workloads in the same
+  // namespace as the destination rule.
+  ConfigScope config_scope = 4;
 }
 
 // Traffic policies to apply for a specific destination, across all
diff --git a/networking/v1alpha3/istio.networking.v1alpha3.pb.html b/networking/v1alpha3/istio.networking.v1alpha3.pb.html
index 908c879d90..4c91ad0146 100644
--- a/networking/v1alpha3/istio.networking.v1alpha3.pb.html
+++ b/networking/v1alpha3/istio.networking.v1alpha3.pb.html
@@ -56,11 +56,16 @@ <h2 id="ConfigScope">ConfigScope</h2>
 <tr id="ConfigScope-PUBLIC">
 <td><code>PUBLIC</code></td>
 <td>
+<p>Config with this scope are visible to all workloads in the mesh</p>
+
 </td>
 </tr>
 <tr id="ConfigScope-PRIVATE">
 <td><code>PRIVATE</code></td>
 <td>
+<p>Configs with this scope are visible to only workloads in the same
+namespace as the configuration resource.</p>
+
 </td>
 </tr>
 </tbody>
@@ -657,6 +662,17 @@ <h2 id="DestinationRule">DestinationRule</h2>
 <p>One or more named sets that represent individual versions of a
 service. Traffic policies can be overridden at subset level.</p>
 
+</td>
+</tr>
+<tr id="DestinationRule-config_scope">
+<td><code>configScope</code></td>
+<td><code><a href="#ConfigScope">ConfigScope</a></code></td>
+<td>
+<p>The visibility setting associated with this DestinationRule. Set to
+PRIVATE if this destination rule should not be exported, i.e. restrict
+the applicability of this destination rule to only workloads in the same
+namespace as the destination rule.</p>
+
 </td>
 </tr>
 </tbody>
@@ -2416,7 +2432,7 @@ <h2 id="NetworkScope">NetworkScope</h2>
 compute the sidecar configuration for every workload in the namespace.</p>
 
 <p>NOTE 1: If workloads in the mesh depend only on other workloads in the
-same namespace, set defaultNetworkScope.importMode to CURRENT_NAMESPACE
+same namespace, set defaultNetworkScope.importMode to SAME_NAMESPACE
 in the mesh global config map (in values.yaml).</p>
 
 <p>NOTE 2: To facilitate incremental pruning of the the sidecar
@@ -2443,7 +2459,7 @@ <h2 id="NetworkScope">NetworkScope</h2>
     - namespace: prod-apis
 </code></pre>
 
-<p>In a mesh where the default network scope is set to CURRENT_NAMESPACE
+<p>In a mesh where the default network scope is set to SAME_NAMESPACE
 only, if one or more workloads need to be able to reach every other
 service in the mesh (e.g., metrics collection server), the following
 NetworkScope resource can be used to specify such a dependency:</p>
@@ -2462,7 +2478,7 @@ <h2 id="NetworkScope">NetworkScope</h2>
 <p>The configuration above will allow workloads in the metrics-collection
 namespace to access service in any namespace while workloads in other
 namespaces will be configured for namespace local access as per the
-global default network scope (CURRENT_NAMESPACE).</p>
+global default network scope (SAME_NAMESPACE).</p>
 
 <table class="message-fields">
 <thead>
@@ -3449,8 +3465,8 @@ <h2 id="ServiceEntry">ServiceEntry</h2>
 
 </td>
 </tr>
-<tr id="ServiceEntry-scope">
-<td><code>scope</code></td>
+<tr id="ServiceEntry-config_scope">
+<td><code>configScope</code></td>
 <td><code><a href="#ConfigScope">ConfigScope</a></code></td>
 <td>
 <p>The visibility setting associated with this service entry. Set to
@@ -4403,11 +4419,11 @@ <h2 id="VirtualService">VirtualService</h2>
 
 </td>
 </tr>
-<tr id="VirtualService-scope">
-<td><code>scope</code></td>
+<tr id="VirtualService-config_scope">
+<td><code>configScope</code></td>
 <td><code><a href="#ConfigScope">ConfigScope</a></code></td>
 <td>
-<p>The visibility setting associated with this virtual service. Set to
+<p>The visibility setting associated with this VirtualService. Set to
 PRIVATE if this virtual service should not be exported, i.e. restrict
 the applicability of this virtual service to only workloads in the same
 namespace as the virtual service.</p>
diff --git a/networking/v1alpha3/network_scope.pb.go b/networking/v1alpha3/network_scope.pb.go
index 868ced0ded..6f6f79d670 100644
--- a/networking/v1alpha3/network_scope.pb.go
+++ b/networking/v1alpha3/network_scope.pb.go
@@ -22,7 +22,10 @@ var _ = math.Inf
 type ConfigScope int32
 
 const (
-	ConfigScope_PUBLIC  ConfigScope = 0
+	// Config with this scope are visible to all workloads in the mesh
+	ConfigScope_PUBLIC ConfigScope = 0
+	// Configs with this scope are visible to only workloads in the same
+	// namespace as the configuration resource.
 	ConfigScope_PRIVATE ConfigScope = 1
 )
 
@@ -63,7 +66,7 @@ func (ConfigScope) EnumDescriptor() ([]byte, []int) { return fileDescriptorNetwo
 // compute the sidecar configuration for every workload in the namespace.
 //
 // NOTE 1: If workloads in the mesh depend only on other workloads in the
-// same namespace, set defaultNetworkScope.importMode to CURRENT_NAMESPACE
+// same namespace, set defaultNetworkScope.importMode to SAME_NAMESPACE
 // in the mesh global config map (in values.yaml).
 //
 // NOTE 2: To facilitate incremental pruning of the the sidecar
@@ -91,7 +94,7 @@ func (ConfigScope) EnumDescriptor() ([]byte, []int) { return fileDescriptorNetwo
 //     - namespace: prod-apis
 // ```
 //
-// In a mesh where the default network scope is set to CURRENT_NAMESPACE
+// In a mesh where the default network scope is set to SAME_NAMESPACE
 // only, if one or more workloads need to be able to reach every other
 // service in the mesh (e.g., metrics collection server), the following
 // NetworkScope resource can be used to specify such a dependency:
@@ -111,7 +114,7 @@ func (ConfigScope) EnumDescriptor() ([]byte, []int) { return fileDescriptorNetwo
 // The configuration above will allow workloads in the metrics-collection
 // namespace to access service in any namespace while workloads in other
 // namespaces will be configured for namespace local access as per the
-// global default network scope (CURRENT_NAMESPACE).
+// global default network scope (SAME_NAMESPACE).
 //
 type NetworkScope struct {
 	// REQUIRED. The set of services that workloads in this namespace are
@@ -185,6 +188,16 @@ func (m *NetworkScope_Import) GetHost() string {
 // Dependency describes a workload and the set of service dependencies
 // for the workload.
 type NetworkScope_Dependency struct {
+	// [#not-implemented-hide:]
+	// One or more labels that indicate a specific set of pods/VMs on which
+	// this dependency configuration should be applied.  The scope of label
+	// search is platform dependent.  On Kubernetes, for example, the scope
+	// includes pods running in the namespace in which the NetworkScope
+	// resource is present.  If the sourceWorkloadLabels are omitted, the
+	// imports specified will be applicable to all workloads in the current
+	// configuration namespace.
+	// NOTE: source_workload_labels are currently not supported.
+	SourceWorkloadLabels map[string]string `protobuf:"bytes,1,rep,name=source_workload_labels,json=sourceWorkloadLabels" json:"source_workload_labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 	// REQUIRED: Import describes the set of namespaces whose exported
 	// services will be accessed by the workloads selected by the
 	// sourceWorkloadLabels. The sidecars attached to the workloads will be
@@ -203,6 +216,13 @@ func (*NetworkScope_Dependency) Descriptor() ([]byte, []int) {
 	return fileDescriptorNetworkScope, []int{0, 1}
 }
 
+func (m *NetworkScope_Dependency) GetSourceWorkloadLabels() map[string]string {
+	if m != nil {
+		return m.SourceWorkloadLabels
+	}
+	return nil
+}
+
 func (m *NetworkScope_Dependency) GetImports() []*NetworkScope_Import {
 	if m != nil {
 		return m.Imports
@@ -291,6 +311,23 @@ func (m *NetworkScope_Dependency) MarshalTo(dAtA []byte) (int, error) {
 	_ = i
 	var l int
 	_ = l
+	if len(m.SourceWorkloadLabels) > 0 {
+		for k, _ := range m.SourceWorkloadLabels {
+			dAtA[i] = 0xa
+			i++
+			v := m.SourceWorkloadLabels[k]
+			mapSize := 1 + len(k) + sovNetworkScope(uint64(len(k))) + 1 + len(v) + sovNetworkScope(uint64(len(v)))
+			i = encodeVarintNetworkScope(dAtA, i, uint64(mapSize))
+			dAtA[i] = 0xa
+			i++
+			i = encodeVarintNetworkScope(dAtA, i, uint64(len(k)))
+			i += copy(dAtA[i:], k)
+			dAtA[i] = 0x12
+			i++
+			i = encodeVarintNetworkScope(dAtA, i, uint64(len(v)))
+			i += copy(dAtA[i:], v)
+		}
+	}
 	if len(m.Imports) > 0 {
 		for _, msg := range m.Imports {
 			dAtA[i] = 0x12
@@ -344,6 +381,14 @@ func (m *NetworkScope_Import) Size() (n int) {
 func (m *NetworkScope_Dependency) Size() (n int) {
 	var l int
 	_ = l
+	if len(m.SourceWorkloadLabels) > 0 {
+		for k, v := range m.SourceWorkloadLabels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + sovNetworkScope(uint64(len(k))) + 1 + len(v) + sovNetworkScope(uint64(len(v)))
+			n += mapEntrySize + 1 + sovNetworkScope(uint64(mapEntrySize))
+		}
+	}
 	if len(m.Imports) > 0 {
 		for _, e := range m.Imports {
 			l = e.Size()
@@ -584,6 +629,124 @@ func (m *NetworkScope_Dependency) Unmarshal(dAtA []byte) error {
 			return fmt.Errorf("proto: Dependency: illegal tag %d (wire type %d)", fieldNum, wire)
 		}
 		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SourceWorkloadLabels", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowNetworkScope
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthNetworkScope
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SourceWorkloadLabels == nil {
+				m.SourceWorkloadLabels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return ErrIntOverflowNetworkScope
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= (uint64(b) & 0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowNetworkScope
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= (uint64(b) & 0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return ErrInvalidLengthNetworkScope
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return ErrIntOverflowNetworkScope
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= (uint64(b) & 0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return ErrInvalidLengthNetworkScope
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := skipNetworkScope(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if skippy < 0 {
+						return ErrInvalidLengthNetworkScope
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.SourceWorkloadLabels[mapkey] = mapvalue
+			iNdEx = postIndex
 		case 2:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Imports", wireType)
@@ -744,22 +907,27 @@ var (
 func init() { proto.RegisterFile("networking/v1alpha3/network_scope.proto", fileDescriptorNetworkScope) }
 
 var fileDescriptorNetworkScope = []byte{
-	// 266 bytes of a gzipped FileDescriptorProto
+	// 352 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x52, 0xcf, 0x4b, 0x2d, 0x29,
 	0xcf, 0x2f, 0xca, 0xce, 0xcc, 0x4b, 0xd7, 0x2f, 0x33, 0x4c, 0xcc, 0x29, 0xc8, 0x48, 0x34, 0xd6,
 	0x87, 0x8a, 0xc5, 0x17, 0x27, 0xe7, 0x17, 0xa4, 0xea, 0x15, 0x14, 0xe5, 0x97, 0xe4, 0x0b, 0x49,
-	0x66, 0x16, 0x97, 0x64, 0xe6, 0xeb, 0x21, 0x94, 0xeb, 0xc1, 0x94, 0x2b, 0xfd, 0x62, 0xe4, 0xe2,
+	0x66, 0x16, 0x97, 0x64, 0xe6, 0xeb, 0x21, 0x94, 0xeb, 0xc1, 0x94, 0x2b, 0x9d, 0x64, 0xe6, 0xe2,
 	0xf1, 0x83, 0x88, 0x07, 0x83, 0x74, 0x08, 0x85, 0x71, 0xf1, 0xa4, 0xa4, 0x16, 0xa4, 0xe6, 0xa5,
 	0xa4, 0xe6, 0x25, 0x67, 0xa6, 0x16, 0x4b, 0x30, 0x2a, 0x30, 0x6b, 0x70, 0x1b, 0x19, 0xe9, 0xe1,
 	0x34, 0x42, 0x0f, 0x59, 0xbb, 0x9e, 0x0b, 0x4c, 0x6f, 0x65, 0x10, 0x8a, 0x39, 0x52, 0x56, 0x5c,
 	0x6c, 0x9e, 0xb9, 0x05, 0xf9, 0x45, 0x25, 0x42, 0x32, 0x5c, 0x9c, 0x79, 0x89, 0xb9, 0xa9, 0xc5,
 	0x05, 0x89, 0xc9, 0xa9, 0x12, 0x8c, 0x0a, 0x8c, 0x1a, 0x9c, 0x41, 0x08, 0x01, 0x21, 0x21, 0x2e,
-	0x96, 0x8c, 0xfc, 0xe2, 0x12, 0x09, 0x26, 0xb0, 0x04, 0x98, 0x2d, 0x15, 0xc6, 0xc5, 0x85, 0x30,
-	0x57, 0xc8, 0x83, 0x8b, 0x3d, 0x13, 0x6c, 0x52, 0xb1, 0x04, 0x13, 0xd8, 0x71, 0x7a, 0xc4, 0x3a,
-	0x0e, 0xe2, 0x80, 0x20, 0x98, 0x76, 0x2d, 0x35, 0x2e, 0x6e, 0xe7, 0xfc, 0xbc, 0xb4, 0xcc, 0x74,
-	0x88, 0xd7, 0xb9, 0xb8, 0xd8, 0x02, 0x42, 0x9d, 0x7c, 0x3c, 0x9d, 0x05, 0x18, 0x84, 0xb8, 0xb9,
-	0xd8, 0x03, 0x82, 0x3c, 0xc3, 0x1c, 0x43, 0x5c, 0x05, 0x18, 0x9d, 0xf4, 0x4e, 0x3c, 0x92, 0x63,
-	0xbc, 0xf0, 0x48, 0x8e, 0xf1, 0xc1, 0x23, 0x39, 0xc6, 0x28, 0x05, 0x88, 0x6d, 0x99, 0xf9, 0xfa,
-	0x89, 0x05, 0x99, 0xfa, 0x58, 0xe2, 0x20, 0x89, 0x0d, 0x1c, 0xec, 0xc6, 0x80, 0x00, 0x00, 0x00,
-	0xff, 0xff, 0x7a, 0xa8, 0x8e, 0x07, 0xa1, 0x01, 0x00, 0x00,
+	0x96, 0x8c, 0xfc, 0xe2, 0x12, 0x09, 0x26, 0xb0, 0x04, 0x98, 0x2d, 0xb5, 0x84, 0x89, 0x8b, 0x0b,
+	0x61, 0xb0, 0x50, 0x13, 0x23, 0x97, 0x58, 0x71, 0x7e, 0x69, 0x51, 0x72, 0x6a, 0x3c, 0xc8, 0xe2,
+	0x9c, 0xfc, 0xc4, 0x94, 0xf8, 0x9c, 0xc4, 0xa4, 0xd4, 0x1c, 0x98, 0x6b, 0x7d, 0x48, 0x77, 0xad,
+	0x5e, 0x30, 0xd8, 0xc0, 0x70, 0xa8, 0x79, 0x3e, 0x60, 0xe3, 0x5c, 0xf3, 0x4a, 0x8a, 0x2a, 0x83,
+	0x44, 0x8a, 0xb1, 0x48, 0x09, 0x79, 0x70, 0xb1, 0x67, 0x82, 0xfd, 0x53, 0x2c, 0xc1, 0x04, 0xb6,
+	0x54, 0x8f, 0x58, 0x4b, 0x21, 0xc1, 0x10, 0x04, 0xd3, 0x2e, 0xe5, 0xce, 0x25, 0x89, 0xd3, 0x72,
+	0x21, 0x01, 0x2e, 0xe6, 0xec, 0xd4, 0x4a, 0x68, 0x30, 0x81, 0x98, 0x42, 0x22, 0x5c, 0xac, 0x65,
+	0x89, 0x39, 0xa5, 0xa9, 0xd0, 0x10, 0x82, 0x70, 0xac, 0x98, 0x2c, 0x18, 0xb5, 0xd4, 0xb8, 0xb8,
+	0x9d, 0xf3, 0xf3, 0xd2, 0x32, 0xd3, 0x21, 0x31, 0xc9, 0xc5, 0xc5, 0x16, 0x10, 0xea, 0xe4, 0xe3,
+	0xe9, 0x2c, 0xc0, 0x20, 0xc4, 0xcd, 0xc5, 0x1e, 0x10, 0xe4, 0x19, 0xe6, 0x18, 0xe2, 0x2a, 0xc0,
+	0xe8, 0xa4, 0x77, 0xe2, 0x91, 0x1c, 0xe3, 0x85, 0x47, 0x72, 0x8c, 0x0f, 0x1e, 0xc9, 0x31, 0x46,
+	0x29, 0x40, 0x9c, 0x9d, 0x99, 0xaf, 0x9f, 0x58, 0x90, 0xa9, 0x8f, 0x25, 0x49, 0x25, 0xb1, 0x81,
+	0x53, 0x91, 0x31, 0x20, 0x00, 0x00, 0xff, 0xff, 0x64, 0xd5, 0x9b, 0x1f, 0x70, 0x02, 0x00, 0x00,
 }
diff --git a/networking/v1alpha3/network_scope.proto b/networking/v1alpha3/network_scope.proto
index 4f34ef313d..e78dbc0322 100644
--- a/networking/v1alpha3/network_scope.proto
+++ b/networking/v1alpha3/network_scope.proto
@@ -41,7 +41,7 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // compute the sidecar configuration for every workload in the namespace.
 //
 // NOTE 1: If workloads in the mesh depend only on other workloads in the
-// same namespace, set defaultNetworkScope.importMode to CURRENT_NAMESPACE
+// same namespace, set defaultNetworkScope.importMode to SAME_NAMESPACE
 // in the mesh global config map (in values.yaml).
 //
 // NOTE 2: To facilitate incremental pruning of the the sidecar
@@ -69,7 +69,7 @@ option go_package = "istio.io/api/networking/v1alpha3";
 //     - namespace: prod-apis
 // ```
 //
-// In a mesh where the default network scope is set to CURRENT_NAMESPACE
+// In a mesh where the default network scope is set to SAME_NAMESPACE
 // only, if one or more workloads need to be able to reach every other
 // service in the mesh (e.g., metrics collection server), the following
 // NetworkScope resource can be used to specify such a dependency:
@@ -89,7 +89,7 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // The configuration above will allow workloads in the metrics-collection
 // namespace to access service in any namespace while workloads in other
 // namespaces will be configured for namespace local access as per the
-// global default network scope (CURRENT_NAMESPACE).
+// global default network scope (SAME_NAMESPACE).
 //
 message NetworkScope {
   // Import describes the set of namespaces whose exported services
@@ -124,6 +124,17 @@ message NetworkScope {
   // Dependency describes a workload and the set of service dependencies
   // for the workload.
   message Dependency {
+    // [#not-implemented-hide:]
+    // One or more labels that indicate a specific set of pods/VMs on which
+    // this dependency configuration should be applied.  The scope of label
+    // search is platform dependent.  On Kubernetes, for example, the scope
+    // includes pods running in the namespace in which the NetworkScope
+    // resource is present.  If the sourceWorkloadLabels are omitted, the
+    // imports specified will be applicable to all workloads in the current
+    // configuration namespace.
+    // NOTE: source_workload_labels are currently not supported.
+    map<string, string> source_workload_labels = 1;
+
     // REQUIRED: Import describes the set of namespaces whose exported
     // services will be accessed by the workloads selected by the
     // sourceWorkloadLabels. The sidecars attached to the workloads will be
@@ -132,7 +143,7 @@ message NetworkScope {
     // explicitly specified namespaces, namespaces specified in the global
     // mesh config (through defaultNetworkScope.importNamespaces) will also be
     // imported.
-    repeated Import imports = 2;
+    repeated Import imports = 2;    
   };
 
   // REQUIRED. The set of services that workloads in this namespace are
@@ -148,6 +159,10 @@ message NetworkScope {
 // will not be imported when the namespace containing the configuration is
 // imported in a NetworkScope.
 enum ConfigScope {
+  // Config with this scope are visible to all workloads in the mesh
   PUBLIC = 0;
+
+  // Configs with this scope are visible to only workloads in the same
+  // namespace as the configuration resource.
   PRIVATE = 1;
 }
diff --git a/networking/v1alpha3/service_entry.pb.go b/networking/v1alpha3/service_entry.pb.go
index f95afa6684..80b70528d2 100644
--- a/networking/v1alpha3/service_entry.pb.go
+++ b/networking/v1alpha3/service_entry.pb.go
@@ -405,7 +405,7 @@ type ServiceEntry struct {
 	// where the service entry was added. The default scope is public,
 	// i.e. the service added by the service entry will be visible to
 	// workloads in the entire mesh.
-	Scope ConfigScope `protobuf:"varint,7,opt,name=scope,proto3,enum=istio.networking.v1alpha3.ConfigScope" json:"scope,omitempty"`
+	ConfigScope ConfigScope `protobuf:"varint,7,opt,name=config_scope,json=configScope,proto3,enum=istio.networking.v1alpha3.ConfigScope" json:"config_scope,omitempty"`
 }
 
 func (m *ServiceEntry) Reset()                    { *m = ServiceEntry{} }
@@ -455,9 +455,9 @@ func (m *ServiceEntry) GetEndpoints() []*ServiceEntry_Endpoint {
 	return nil
 }
 
-func (m *ServiceEntry) GetScope() ConfigScope {
+func (m *ServiceEntry) GetConfigScope() ConfigScope {
 	if m != nil {
-		return m.Scope
+		return m.ConfigScope
 	}
 	return ConfigScope_PUBLIC
 }
@@ -642,10 +642,10 @@ func (m *ServiceEntry) MarshalTo(dAtA []byte) (int, error) {
 			i += n
 		}
 	}
-	if m.Scope != 0 {
+	if m.ConfigScope != 0 {
 		dAtA[i] = 0x38
 		i++
-		i = encodeVarintServiceEntry(dAtA, i, uint64(m.Scope))
+		i = encodeVarintServiceEntry(dAtA, i, uint64(m.ConfigScope))
 	}
 	return i, nil
 }
@@ -766,8 +766,8 @@ func (m *ServiceEntry) Size() (n int) {
 			n += 1 + l + sovServiceEntry(uint64(l))
 		}
 	}
-	if m.Scope != 0 {
-		n += 1 + sovServiceEntry(uint64(m.Scope))
+	if m.ConfigScope != 0 {
+		n += 1 + sovServiceEntry(uint64(m.ConfigScope))
 	}
 	return n
 }
@@ -1011,9 +1011,9 @@ func (m *ServiceEntry) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 7:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Scope", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConfigScope", wireType)
 			}
-			m.Scope = 0
+			m.ConfigScope = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowServiceEntry
@@ -1023,7 +1023,7 @@ func (m *ServiceEntry) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Scope |= (ConfigScope(b) & 0x7F) << shift
+				m.ConfigScope |= (ConfigScope(b) & 0x7F) << shift
 				if b < 0x80 {
 					break
 				}
@@ -1538,38 +1538,38 @@ var (
 func init() { proto.RegisterFile("networking/v1alpha3/service_entry.proto", fileDescriptorServiceEntry) }
 
 var fileDescriptorServiceEntry = []byte{
-	// 516 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x93, 0xd1, 0x6e, 0xd3, 0x3e,
-	0x14, 0xc6, 0xe7, 0x66, 0x4d, 0x9b, 0xb3, 0xff, 0xfe, 0x2a, 0x16, 0x42, 0x26, 0x42, 0x25, 0xf4,
-	0x02, 0x2a, 0x21, 0xa5, 0xa3, 0x13, 0xd2, 0x80, 0xdd, 0x8c, 0x11, 0x89, 0x49, 0x25, 0x80, 0xdb,
-	0x0b, 0xc4, 0x4d, 0x95, 0xb5, 0xa6, 0xb5, 0x16, 0xc5, 0x51, 0xec, 0xb5, 0xea, 0x5b, 0x70, 0xcf,
-	0x0b, 0x71, 0xc9, 0x23, 0xa0, 0x3e, 0x09, 0x8a, 0xe3, 0x34, 0xbd, 0x28, 0x63, 0xbb, 0xeb, 0x39,
-	0x3d, 0xdf, 0xcf, 0x5f, 0xfc, 0x1d, 0xc3, 0xb3, 0x84, 0xa9, 0xa5, 0xc8, 0xae, 0x78, 0x32, 0xeb,
-	0x2d, 0x5e, 0x44, 0x71, 0x3a, 0x8f, 0x8e, 0x7b, 0x92, 0x65, 0x0b, 0x3e, 0x61, 0x63, 0x96, 0xa8,
-	0x6c, 0xe5, 0xa7, 0x99, 0x50, 0x02, 0x3f, 0xe4, 0x52, 0x71, 0xe1, 0x57, 0xe3, 0x7e, 0x39, 0xee,
-	0x3e, 0xd9, 0xc5, 0x98, 0x45, 0x8a, 0x2d, 0x23, 0xa3, 0x76, 0x77, 0x1e, 0x63, 0x7a, 0x63, 0x39,
-	0x11, 0x29, 0x2b, 0x06, 0x3b, 0x3f, 0x1a, 0xf0, 0xdf, 0xb0, 0x38, 0x3e, 0xc8, 0x4f, 0xc7, 0xf7,
-	0xa1, 0x3e, 0x17, 0x52, 0x49, 0x82, 0x3c, 0xab, 0xeb, 0xd0, 0xa2, 0xc0, 0x8f, 0xc0, 0x89, 0xa6,
-	0xd3, 0x8c, 0x49, 0xc9, 0x24, 0xa9, 0xe9, 0x7f, 0xaa, 0x06, 0x7e, 0x09, 0xf5, 0x54, 0x64, 0x4a,
-	0x12, 0xcb, 0xb3, 0xba, 0x07, 0xfd, 0xc7, 0xfe, 0x5f, 0xbd, 0xfb, 0x9f, 0x44, 0xa6, 0x68, 0x31,
-	0x8d, 0x07, 0xd0, 0x8c, 0xc5, 0x24, 0x52, 0x5c, 0x24, 0x64, 0xdf, 0x43, 0xdd, 0xff, 0xfb, 0x47,
-	0x37, 0x28, 0xb7, 0x5d, 0xfa, 0x03, 0xa3, 0xa3, 0x1b, 0x02, 0xa6, 0x00, 0x19, 0x93, 0x22, 0xbe,
-	0xd6, 0xbc, 0xba, 0xe6, 0xf5, 0x6f, 0xcb, 0xa3, 0x1b, 0x25, 0xdd, 0xa2, 0xe0, 0x10, 0x1c, 0x96,
-	0x4c, 0x53, 0xc1, 0x13, 0x25, 0x89, 0xad, 0x3f, 0xee, 0xd6, 0x16, 0x03, 0x23, 0xa4, 0x15, 0x02,
-	0x9f, 0x42, 0x5d, 0x5f, 0x3e, 0x69, 0x68, 0x7b, 0x4f, 0x6f, 0x60, 0x9d, 0x8b, 0xe4, 0x1b, 0x9f,
-	0x0d, 0xf3, 0x69, 0x5a, 0x88, 0xdc, 0xef, 0x16, 0x34, 0x4b, 0x2a, 0x26, 0xd0, 0x30, 0x01, 0x10,
-	0xe4, 0xa1, 0xae, 0x43, 0xcb, 0x12, 0x7f, 0x2e, 0xd3, 0xa8, 0x69, 0xc3, 0x6f, 0xee, 0x6a, 0x58,
-	0x67, 0x24, 0x75, 0xaf, 0x4c, 0x6a, 0x04, 0x76, 0x1c, 0x5d, 0xb2, 0xb8, 0x4c, 0xf8, 0xf4, 0xce,
-	0xcc, 0x81, 0x96, 0x17, 0x50, 0xc3, 0xca, 0x3f, 0xc1, 0x00, 0x74, 0xfc, 0x0e, 0x2d, 0x4b, 0xec,
-	0x16, 0x9b, 0x11, 0x73, 0xb5, 0xd2, 0x49, 0x3a, 0x74, 0x53, 0xe3, 0x07, 0x60, 0x2f, 0x19, 0x9f,
-	0xcd, 0x15, 0xb1, 0x3d, 0xd4, 0x3d, 0xa4, 0xa6, 0x72, 0x4f, 0x00, 0x2a, 0xe3, 0xb8, 0x05, 0xd6,
-	0x15, 0x5b, 0x99, 0xab, 0xc9, 0x7f, 0xe6, 0x8b, 0xbd, 0x88, 0xe2, 0x6b, 0x46, 0x6a, 0x5a, 0x56,
-	0x14, 0xaf, 0x6b, 0x27, 0xc8, 0x7d, 0x05, 0x07, 0x5b, 0xf6, 0xfe, 0x25, 0x75, 0xb6, 0xa4, 0x9d,
-	0x23, 0x68, 0x96, 0xab, 0x88, 0xef, 0xc1, 0xe1, 0x87, 0x60, 0xf8, 0x7e, 0x1c, 0x7c, 0x19, 0x05,
-	0x34, 0x3c, 0x1b, 0xb4, 0xf6, 0x36, 0xad, 0x8b, 0xd0, 0xb4, 0x50, 0xe7, 0x39, 0x40, 0xb5, 0x6c,
-	0xb8, 0x09, 0xfb, 0xe1, 0xc7, 0x30, 0x68, 0xed, 0x61, 0x00, 0x7b, 0x38, 0x3a, 0x1b, 0x5d, 0x9c,
-	0xb7, 0x10, 0x6e, 0x80, 0xf5, 0x2e, 0x1c, 0xb6, 0x6a, 0x6f, 0xfd, 0x9f, 0xeb, 0x36, 0xfa, 0xb5,
-	0x6e, 0xa3, 0xdf, 0xeb, 0x36, 0xfa, 0xea, 0x15, 0x97, 0xce, 0x45, 0x2f, 0x4a, 0x79, 0x6f, 0xc7,
-	0x0b, 0xbf, 0xb4, 0xf5, 0xa3, 0x3e, 0xfe, 0x13, 0x00, 0x00, 0xff, 0xff, 0xc7, 0x74, 0xc7, 0x64,
-	0x66, 0x04, 0x00, 0x00,
+	// 521 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x53, 0xcd, 0x6e, 0xd3, 0x4c,
+	0x14, 0xed, 0xc4, 0x8d, 0x13, 0xdf, 0xb4, 0x9f, 0xf2, 0x8d, 0x10, 0x1a, 0x2c, 0x14, 0x4c, 0x16,
+	0x10, 0x09, 0xc9, 0x29, 0xa9, 0x90, 0xca, 0xcf, 0xa6, 0x14, 0x4b, 0x44, 0x0a, 0x06, 0x26, 0x59,
+	0x20, 0x36, 0x91, 0x9b, 0x0c, 0xc9, 0xa8, 0x96, 0xc7, 0xf2, 0x4c, 0x13, 0xe5, 0x2d, 0x78, 0x0c,
+	0x1e, 0x85, 0x25, 0x8f, 0x80, 0xf2, 0x24, 0x28, 0xe3, 0x71, 0x9c, 0x45, 0x28, 0xed, 0xce, 0xe7,
+	0xfa, 0x9e, 0x73, 0xcf, 0xcc, 0xb9, 0x03, 0x4f, 0x13, 0xa6, 0x96, 0x22, 0xbb, 0xe2, 0xc9, 0xac,
+	0xbb, 0x78, 0x1e, 0xc5, 0xe9, 0x3c, 0x3a, 0xed, 0x4a, 0x96, 0x2d, 0xf8, 0x84, 0x8d, 0x59, 0xa2,
+	0xb2, 0x95, 0x9f, 0x66, 0x42, 0x09, 0xfc, 0x80, 0x4b, 0xc5, 0x85, 0x5f, 0xb6, 0xfb, 0x45, 0xbb,
+	0xfb, 0x78, 0x9f, 0xc6, 0x2c, 0x52, 0x6c, 0x19, 0x19, 0xb6, 0xbb, 0x77, 0x8c, 0xa9, 0x8d, 0xe5,
+	0x44, 0xa4, 0x2c, 0x6f, 0x6c, 0xff, 0xa8, 0xc1, 0xd1, 0x30, 0x1f, 0x1f, 0x6c, 0xa6, 0xe3, 0x7b,
+	0x50, 0x9d, 0x0b, 0xa9, 0x24, 0x41, 0x9e, 0xd5, 0x71, 0x68, 0x0e, 0xf0, 0x43, 0x70, 0xa2, 0xe9,
+	0x34, 0x63, 0x52, 0x32, 0x49, 0x2a, 0xfa, 0x4f, 0x59, 0xc0, 0x2f, 0xa0, 0x9a, 0x8a, 0x4c, 0x49,
+	0x62, 0x79, 0x56, 0xa7, 0xd1, 0x7b, 0xe4, 0xff, 0xd5, 0xbb, 0xff, 0x49, 0x64, 0x8a, 0xe6, 0xdd,
+	0x78, 0x00, 0xf5, 0x58, 0x4c, 0x22, 0xc5, 0x45, 0x42, 0x0e, 0x3d, 0xd4, 0xf9, 0xaf, 0x77, 0x72,
+	0x03, 0x73, 0xd7, 0xa5, 0x3f, 0x30, 0x3c, 0xba, 0x55, 0xc0, 0x14, 0x20, 0x63, 0x52, 0xc4, 0xd7,
+	0x5a, 0xaf, 0xaa, 0xf5, 0x7a, 0xb7, 0xd5, 0xa3, 0x5b, 0x26, 0xdd, 0x51, 0xc1, 0x21, 0x38, 0x2c,
+	0x99, 0xa6, 0x82, 0x27, 0x4a, 0x12, 0x5b, 0x1f, 0xee, 0xd6, 0x16, 0x03, 0x43, 0xa4, 0xa5, 0x04,
+	0xee, 0xc3, 0xd1, 0x44, 0x24, 0xdf, 0xf8, 0x2c, 0xcf, 0x80, 0xd4, 0xb4, 0xcb, 0x27, 0x37, 0x48,
+	0x5e, 0xe8, 0xf6, 0xe1, 0xa6, 0x9b, 0x36, 0x26, 0x25, 0x70, 0xbf, 0x5b, 0x50, 0x2f, 0x46, 0x60,
+	0x02, 0x35, 0x93, 0x06, 0x41, 0x1e, 0xea, 0x38, 0xb4, 0x80, 0xf8, 0x73, 0x11, 0x4d, 0x45, 0xbb,
+	0x7f, 0x7d, 0x57, 0xf7, 0x3a, 0x30, 0xa9, 0x6b, 0x45, 0x6c, 0x23, 0xb0, 0xe3, 0xe8, 0x92, 0xc5,
+	0x45, 0xdc, 0x6f, 0xee, 0xac, 0x39, 0xd0, 0xf4, 0x5c, 0xd4, 0x68, 0x6d, 0x8e, 0x60, 0x04, 0xf4,
+	0x2e, 0x38, 0xb4, 0x80, 0xd8, 0xcd, 0xd7, 0x24, 0xe6, 0x6a, 0xa5, 0x63, 0x75, 0xe8, 0x16, 0xe3,
+	0xfb, 0x60, 0x2f, 0x19, 0x9f, 0xcd, 0x15, 0xb1, 0x3d, 0xd4, 0x39, 0xa6, 0x06, 0xb9, 0x67, 0x00,
+	0xa5, 0x71, 0xdc, 0x04, 0xeb, 0x8a, 0xad, 0xcc, 0xd5, 0x6c, 0x3e, 0x37, 0x5b, 0xbe, 0x88, 0xe2,
+	0x6b, 0x46, 0x2a, 0x9a, 0x96, 0x83, 0x57, 0x95, 0x33, 0xe4, 0xbe, 0x84, 0xc6, 0x8e, 0xbd, 0x7f,
+	0x51, 0x9d, 0x1d, 0x6a, 0xfb, 0x04, 0xea, 0xc5, 0x5e, 0xe2, 0xff, 0xe1, 0xf8, 0x43, 0x30, 0x7c,
+	0x3f, 0x0e, 0xbe, 0x8c, 0x02, 0x1a, 0x9e, 0x0f, 0x9a, 0x07, 0xdb, 0x52, 0x3f, 0x34, 0x25, 0xd4,
+	0x7e, 0x06, 0x50, 0x6e, 0x1e, 0xae, 0xc3, 0x61, 0xf8, 0x31, 0x0c, 0x9a, 0x07, 0x18, 0xc0, 0x1e,
+	0x8e, 0xce, 0x47, 0xfd, 0x8b, 0x26, 0xc2, 0x35, 0xb0, 0xde, 0x85, 0xc3, 0x66, 0xe5, 0xad, 0xff,
+	0x73, 0xdd, 0x42, 0xbf, 0xd6, 0x2d, 0xf4, 0x7b, 0xdd, 0x42, 0x5f, 0xbd, 0xfc, 0xd2, 0xb9, 0xe8,
+	0x46, 0x29, 0xef, 0xee, 0x79, 0xee, 0x97, 0xb6, 0x7e, 0xe1, 0xa7, 0x7f, 0x02, 0x00, 0x00, 0xff,
+	0xff, 0x24, 0xa5, 0x68, 0xd6, 0x73, 0x04, 0x00, 0x00,
 }
diff --git a/networking/v1alpha3/service_entry.proto b/networking/v1alpha3/service_entry.proto
index 1af4134422..de25067bae 100644
--- a/networking/v1alpha3/service_entry.proto
+++ b/networking/v1alpha3/service_entry.proto
@@ -434,5 +434,5 @@ message ServiceEntry {
   // where the service entry was added. The default scope is public,
   // i.e. the service added by the service entry will be visible to
   // workloads in the entire mesh.
-  ConfigScope scope = 7;
+  ConfigScope config_scope = 7;
 }
diff --git a/networking/v1alpha3/virtual_service.pb.go b/networking/v1alpha3/virtual_service.pb.go
index 3927cea164..17c4d44ad4 100644
--- a/networking/v1alpha3/virtual_service.pb.go
+++ b/networking/v1alpha3/virtual_service.pb.go
@@ -134,11 +134,11 @@ type VirtualService struct {
 	// be applied to any port that is not a HTTP or TLS port. The first rule
 	// matching an incoming request is used.
 	Tcp []*TCPRoute `protobuf:"bytes,4,rep,name=tcp" json:"tcp,omitempty"`
-	// The visibility setting associated with this virtual service. Set to
+	// The visibility setting associated with this VirtualService. Set to
 	// PRIVATE if this virtual service should not be exported, i.e. restrict
 	// the applicability of this virtual service to only workloads in the same
 	// namespace as the virtual service.
-	Scope ConfigScope `protobuf:"varint,6,opt,name=scope,proto3,enum=istio.networking.v1alpha3.ConfigScope" json:"scope,omitempty"`
+	ConfigScope ConfigScope `protobuf:"varint,6,opt,name=config_scope,json=configScope,proto3,enum=istio.networking.v1alpha3.ConfigScope" json:"config_scope,omitempty"`
 }
 
 func (m *VirtualService) Reset()                    { *m = VirtualService{} }
@@ -181,9 +181,9 @@ func (m *VirtualService) GetTcp() []*TCPRoute {
 	return nil
 }
 
-func (m *VirtualService) GetScope() ConfigScope {
+func (m *VirtualService) GetConfigScope() ConfigScope {
 	if m != nil {
-		return m.Scope
+		return m.ConfigScope
 	}
 	return ConfigScope_PUBLIC
 }
@@ -2263,10 +2263,10 @@ func (m *VirtualService) MarshalTo(dAtA []byte) (int, error) {
 			i += n
 		}
 	}
-	if m.Scope != 0 {
+	if m.ConfigScope != 0 {
 		dAtA[i] = 0x30
 		i++
-		i = encodeVarintVirtualService(dAtA, i, uint64(m.Scope))
+		i = encodeVarintVirtualService(dAtA, i, uint64(m.ConfigScope))
 	}
 	return i, nil
 }
@@ -3666,8 +3666,8 @@ func (m *VirtualService) Size() (n int) {
 			n += 1 + l + sovVirtualService(uint64(l))
 		}
 	}
-	if m.Scope != 0 {
-		n += 1 + sovVirtualService(uint64(m.Scope))
+	if m.ConfigScope != 0 {
+		n += 1 + sovVirtualService(uint64(m.ConfigScope))
 	}
 	return n
 }
@@ -4462,9 +4462,9 @@ func (m *VirtualService) Unmarshal(dAtA []byte) error {
 			iNdEx = postIndex
 		case 6:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Scope", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field ConfigScope", wireType)
 			}
-			m.Scope = 0
+			m.ConfigScope = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowVirtualService
@@ -4474,7 +4474,7 @@ func (m *VirtualService) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Scope |= (ConfigScope(b) & 0x7F) << shift
+				m.ConfigScope |= (ConfigScope(b) & 0x7F) << shift
 				if b < 0x80 {
 					break
 				}
@@ -9131,118 +9131,119 @@ func init() {
 }
 
 var fileDescriptorVirtualService = []byte{
-	// 1806 bytes of a gzipped FileDescriptorProto
+	// 1811 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x59, 0x4f, 0x73, 0xe3, 0x48,
-	0x15, 0x1f, 0xd9, 0x96, 0xff, 0x3c, 0x3b, 0x19, 0xa7, 0xc9, 0xce, 0x6a, 0xcc, 0x56, 0xc8, 0x7a,
-	0xd9, 0xdd, 0x50, 0xcb, 0xda, 0x85, 0x03, 0x4b, 0x6a, 0xc9, 0x66, 0xd7, 0x4e, 0x66, 0xd6, 0x43,
-	0xcd, 0x90, 0x94, 0x1c, 0xf6, 0xc0, 0x45, 0x25, 0x4b, 0x1d, 0x5b, 0x8c, 0x2c, 0x89, 0x56, 0x2b,
-	0xb1, 0x8b, 0x23, 0x7f, 0xee, 0x50, 0x5c, 0x29, 0xae, 0x7c, 0x06, 0x2e, 0x5c, 0x39, 0x51, 0x7c,
-	0x02, 0x6a, 0x6a, 0x0e, 0x5c, 0xf9, 0x0a, 0x54, 0xff, 0x91, 0xac, 0xc4, 0x89, 0x65, 0x87, 0x81,
-	0xda, 0x53, 0xdc, 0xdd, 0xef, 0xf7, 0xfa, 0xf5, 0xeb, 0x7e, 0xef, 0xfd, 0xf4, 0x02, 0xdf, 0xf1,
-	0x30, 0xbd, 0xf2, 0xc9, 0x4b, 0xc7, 0x1b, 0xb5, 0x2f, 0xbf, 0x67, 0xba, 0xc1, 0xd8, 0xdc, 0x6f,
-	0x5f, 0x3a, 0x84, 0x46, 0xa6, 0x6b, 0x84, 0x98, 0x5c, 0x3a, 0x16, 0x6e, 0x05, 0xc4, 0xa7, 0x3e,
-	0x7a, 0xec, 0x84, 0xd4, 0xf1, 0x5b, 0x73, 0x40, 0x2b, 0x06, 0x34, 0x76, 0x46, 0xbe, 0x3f, 0x72,
-	0x71, 0x9b, 0x0b, 0x0e, 0xa3, 0x8b, 0xb6, 0x1d, 0x11, 0x93, 0x3a, 0xbe, 0x27, 0xa0, 0x8b, 0xeb,
-	0x57, 0xc4, 0x0c, 0x02, 0x4c, 0x42, 0xb9, 0xfe, 0xe1, 0x6d, 0x56, 0xc8, 0x39, 0x23, 0xb4, 0xfc,
-	0x40, 0xda, 0xd0, 0xfc, 0x73, 0x0e, 0x36, 0xbf, 0x12, 0xd6, 0x0d, 0x84, 0x71, 0x68, 0x1b, 0xd4,
-	0xb1, 0x1f, 0xd2, 0x50, 0x53, 0x76, 0xf3, 0x7b, 0x15, 0x5d, 0x0c, 0x50, 0x03, 0xca, 0x23, 0x93,
-	0xe2, 0x2b, 0x73, 0x16, 0x6a, 0x39, 0xbe, 0x90, 0x8c, 0xd1, 0x01, 0x14, 0xc6, 0x94, 0x06, 0x5a,
-	0x7e, 0x37, 0xbf, 0x57, 0xed, 0x7c, 0xbb, 0x75, 0xe7, 0xb9, 0x5a, 0xfd, 0xf3, 0xf3, 0x33, 0xdd,
-	0x8f, 0x28, 0xd6, 0x39, 0x02, 0xfd, 0x00, 0xf2, 0xd4, 0x0a, 0xb4, 0x02, 0x07, 0xbe, 0xb7, 0x04,
-	0x78, 0x7e, 0x2c, 0x71, 0x4c, 0x9e, 0xc3, 0xdc, 0x50, 0x53, 0xb3, 0x61, 0xcf, 0x07, 0x31, 0xcc,
-	0x0d, 0xd1, 0x21, 0xa8, 0xfc, 0xec, 0x5a, 0x71, 0x57, 0xd9, 0xdb, 0xec, 0x7c, 0xb0, 0x04, 0x78,
-	0xec, 0x7b, 0x17, 0xce, 0x68, 0xc0, 0xa4, 0x75, 0x01, 0x6a, 0x5e, 0x42, 0xf5, 0x04, 0x87, 0xd4,
-	0xf1, 0xf8, 0x45, 0x20, 0x04, 0x05, 0xe6, 0x19, 0x4d, 0xd9, 0x55, 0xf6, 0x2a, 0x3a, 0xff, 0x8d,
-	0x1e, 0x41, 0x31, 0x8c, 0x86, 0x21, 0xa6, 0x5a, 0x8e, 0xcf, 0xca, 0x11, 0xfa, 0x11, 0x14, 0x02,
-	0x9f, 0x50, 0x2d, 0xbf, 0xab, 0xec, 0x55, 0x3b, 0x1f, 0x2e, 0xd9, 0xf7, 0xcc, 0x27, 0x74, 0x80,
-	0x5d, 0x6c, 0x51, 0x9f, 0xe8, 0x1c, 0xd4, 0xfc, 0x37, 0x40, 0x25, 0xf1, 0x1b, 0xea, 0x82, 0x3a,
-	0x31, 0xa9, 0x35, 0xe6, 0xb7, 0x53, 0xed, 0x7c, 0x94, 0xe1, 0xec, 0x17, 0x4c, 0x56, 0xc7, 0xbf,
-	0x88, 0x70, 0x48, 0x75, 0x81, 0x44, 0x4f, 0x40, 0x25, 0x4c, 0x17, 0xbf, 0xc7, 0x6a, 0xa7, 0xbd,
-	0xca, 0x7d, 0xa5, 0x4e, 0xae, 0x0b, 0x34, 0x3a, 0x86, 0x32, 0xc1, 0xb6, 0x43, 0xb0, 0xb5, 0xca,
-	0xc1, 0xb8, 0x26, 0x29, 0xae, 0x27, 0x40, 0xf4, 0x05, 0x94, 0x08, 0xbe, 0x22, 0x0e, 0xc5, 0x5a,
-	0x81, 0xeb, 0xf8, 0x20, 0x53, 0x07, 0x97, 0xd6, 0x63, 0x18, 0xfa, 0x08, 0xb6, 0xae, 0xf0, 0x30,
-	0xf4, 0xad, 0x97, 0x98, 0x1a, 0x51, 0x30, 0x22, 0xa6, 0x8d, 0x35, 0x75, 0x57, 0xd9, 0x2b, 0xeb,
-	0xf5, 0x64, 0xe1, 0xa7, 0x62, 0x1e, 0xed, 0x43, 0x89, 0x3a, 0x13, 0xec, 0x47, 0x94, 0xbf, 0x81,
-	0x6a, 0xe7, 0x71, 0x4b, 0x44, 0x52, 0x2b, 0x8e, 0xa4, 0xd6, 0x89, 0x8c, 0x34, 0x3d, 0x96, 0x44,
-	0x47, 0xcc, 0x46, 0x4a, 0x1c, 0x1c, 0x6a, 0x25, 0x0e, 0xca, 0x7c, 0xe1, 0x98, 0x92, 0x99, 0x1e,
-	0x83, 0xd0, 0x31, 0xa8, 0x17, 0x66, 0xe4, 0x52, 0xad, 0xcc, 0xd1, 0x1f, 0x67, 0xa0, 0x9f, 0x32,
-	0xd9, 0x67, 0xde, 0xcf, 0xb1, 0x25, 0xbc, 0xcd, 0xb1, 0xe8, 0x08, 0x8a, 0x13, 0x87, 0x10, 0x9f,
-	0x68, 0x95, 0x4c, 0x3f, 0xa5, 0x2f, 0x4b, 0xa2, 0xd0, 0x53, 0xa8, 0x5a, 0x3e, 0x09, 0x8d, 0xc0,
-	0x77, 0x1d, 0x6b, 0xa6, 0x01, 0x57, 0xf2, 0xfe, 0xd2, 0x08, 0x20, 0xe1, 0x19, 0x17, 0xd6, 0xc1,
-	0x4a, 0x7e, 0xa3, 0x21, 0x6c, 0xb2, 0x4c, 0xe3, 0xd9, 0xc6, 0x18, 0x9b, 0x36, 0x26, 0xa1, 0x56,
-	0xe5, 0xaf, 0xe8, 0x87, 0xab, 0xbc, 0xa2, 0x56, 0x97, 0x43, 0xfb, 0x02, 0xf9, 0xc4, 0xa3, 0x64,
-	0xd6, 0xcb, 0x69, 0x8a, 0xbe, 0x61, 0xa6, 0xe7, 0xd1, 0xa7, 0xf0, 0x36, 0xc1, 0x13, 0xff, 0x12,
-	0x1b, 0x04, 0x87, 0x81, 0xef, 0x85, 0x38, 0xd9, 0xac, 0xc6, 0x52, 0x0f, 0xc7, 0xbc, 0x25, 0x44,
-	0x74, 0x29, 0x11, 0x63, 0x7f, 0x09, 0x6f, 0x4b, 0xfb, 0x16, 0xb0, 0x1b, 0xdc, 0xd0, 0xcf, 0xd7,
-	0x30, 0xf4, 0x86, 0xf2, 0xb9, 0xc1, 0x6f, 0x99, 0xb7, 0xad, 0xa3, 0x03, 0x78, 0x94, 0x18, 0xce,
-	0x43, 0x2e, 0xd9, 0x7b, 0x33, 0xb1, 0x7b, 0x3b, 0xb6, 0x9b, 0x0b, 0xc4, 0xc8, 0x29, 0x3c, 0x4a,
-	0xcc, 0xbe, 0x8e, 0x7c, 0xc8, 0xad, 0x3e, 0x5a, 0xcb, 0xea, 0xb4, 0xea, 0xb9, 0xd1, 0xdb, 0xe6,
-	0x2d, 0xcb, 0xe8, 0x10, 0x4a, 0xf1, 0x56, 0x75, 0xfe, 0x28, 0x9a, 0xcb, 0xb6, 0x12, 0x92, 0x7a,
-	0x0c, 0x69, 0x7c, 0x01, 0x68, 0xf1, 0x4e, 0x51, 0x1d, 0xf2, 0x2f, 0xf1, 0x4c, 0xa6, 0x46, 0xf6,
-	0x93, 0x15, 0x95, 0x4b, 0xd3, 0x8d, 0xb0, 0x4c, 0x8c, 0x62, 0xf0, 0x69, 0xee, 0x40, 0x69, 0xf4,
-	0xa1, 0x71, 0xb7, 0xb3, 0xd7, 0xd2, 0xf4, 0x25, 0x3c, 0xbe, 0xd3, 0x01, 0xeb, 0x28, 0x6a, 0xfe,
-	0x2b, 0x0f, 0xa5, 0xd8, 0x3d, 0x2f, 0x58, 0xf0, 0x73, 0x75, 0x1c, 0x5b, 0xed, 0xec, 0x67, 0xbb,
-	0x47, 0xfe, 0x3d, 0x0d, 0xb0, 0x48, 0x25, 0xa1, 0x1e, 0xeb, 0x40, 0xa7, 0x2c, 0x69, 0x8a, 0x73,
-	0xf2, 0x7d, 0xef, 0xa9, 0x2f, 0x51, 0xd2, 0xf8, 0x4b, 0x0e, 0xea, 0x37, 0x97, 0xd1, 0x4f, 0x20,
-	0xcf, 0x8a, 0x90, 0x28, 0x11, 0x87, 0xf7, 0xd8, 0xa0, 0x35, 0xc0, 0x94, 0xfb, 0x4d, 0x67, 0x8a,
-	0x98, 0x3e, 0xd3, 0xb6, 0x65, 0xbd, 0xb8, 0x97, 0xbe, 0xae, 0x6d, 0x4b, 0x7d, 0xa6, 0x6d, 0xb3,
-	0x3a, 0x29, 0xa2, 0x80, 0x53, 0x86, 0x8a, 0x2e, 0x47, 0x8d, 0x4f, 0xa0, 0x1c, 0x6f, 0xbc, 0xd6,
-	0xcd, 0x7f, 0x02, 0xe5, 0x78, 0x83, 0xb5, 0x2e, 0xfa, 0xf7, 0x0a, 0x94, 0x63, 0x8a, 0xc0, 0xd2,
-	0x74, 0xba, 0xb2, 0x7e, 0xbc, 0x9c, 0x56, 0xf0, 0xc2, 0xda, 0xa5, 0x94, 0x38, 0xc3, 0x88, 0xe2,
-	0x30, 0xae, 0xad, 0xdd, 0xeb, 0xb5, 0x75, 0x59, 0x79, 0xbe, 0xa3, 0xae, 0x36, 0x7f, 0xc7, 0x8c,
-	0x92, 0x74, 0x07, 0xf5, 0xae, 0x1b, 0xf5, 0xdd, 0x25, 0xfa, 0x9e, 0x7f, 0xff, 0x7f, 0x67, 0xd3,
-	0x9f, 0x54, 0xa8, 0xdf, 0xa4, 0x13, 0xe8, 0x00, 0xf2, 0x11, 0x71, 0x64, 0x58, 0x2c, 0xab, 0x47,
-	0x03, 0x4a, 0x1c, 0x6f, 0x24, 0xb0, 0x0c, 0xc2, 0x8a, 0x59, 0x68, 0x8d, 0xf1, 0x24, 0x8e, 0x81,
-	0x55, 0xc1, 0x12, 0xc5, 0x8b, 0x21, 0xa6, 0x63, 0xdf, 0x96, 0xc4, 0x63, 0x65, 0xbc, 0x40, 0xa1,
-	0x13, 0xa8, 0x98, 0x11, 0x1d, 0xfb, 0xc4, 0xa1, 0xb3, 0x15, 0x78, 0x47, 0x5a, 0xc5, 0x1c, 0x88,
-	0xf4, 0x79, 0xe6, 0x14, 0x4c, 0xf4, 0x60, 0x0d, 0x32, 0xd6, 0x4a, 0x67, 0xa7, 0x24, 0x9f, 0x32,
-	0x56, 0xc9, 0x99, 0x22, 0x63, 0x27, 0x1b, 0x82, 0x00, 0xa2, 0x21, 0x6c, 0x84, 0x7e, 0x44, 0x2c,
-	0x6c, 0xb8, 0xe6, 0x10, 0xbb, 0x8c, 0x85, 0xb0, 0xdd, 0x3e, 0x5b, 0x67, 0xb7, 0x01, 0x57, 0xf0,
-	0x9c, 0xe3, 0xc5, 0x96, 0xb5, 0x30, 0x35, 0x75, 0x8d, 0xde, 0x97, 0xaf, 0xd3, 0xfb, 0xc6, 0x10,
-	0x6a, 0x19, 0xa9, 0xf4, 0x30, 0x1d, 0x61, 0xab, 0xfb, 0x32, 0x15, 0xc1, 0x9f, 0xc3, 0xd6, 0x82,
-	0x89, 0x6b, 0x85, 0xf2, 0xdf, 0x55, 0xd8, 0xbe, 0x8d, 0xad, 0xa2, 0x3e, 0x54, 0xed, 0xf9, 0x70,
-	0x85, 0xd7, 0x9a, 0x7e, 0xfe, 0x69, 0x28, 0xcb, 0x5a, 0x57, 0xd8, 0x19, 0x8d, 0x05, 0xbb, 0x57,
-	0x75, 0x39, 0x5a, 0x46, 0x57, 0xf2, 0x59, 0x74, 0xe5, 0xb7, 0xca, 0xdd, 0x7c, 0x45, 0x7c, 0x15,
-	0xfd, 0x78, 0x4d, 0x7a, 0xfe, 0xc6, 0xa9, 0x8b, 0x9a, 0x41, 0x5d, 0x7e, 0xa5, 0xdc, 0xc9, 0x5d,
-	0x8a, 0xfc, 0x04, 0xcf, 0xee, 0x7b, 0x82, 0x7b, 0xd2, 0x98, 0xd2, 0xfa, 0x34, 0xe6, 0x6b, 0x48,
-	0x42, 0x28, 0xd4, 0xff, 0xff, 0x6f, 0xb9, 0xf9, 0xd7, 0x1c, 0x6c, 0x2d, 0x14, 0x12, 0xd4, 0x86,
-	0x6f, 0xa4, 0xc0, 0x46, 0x18, 0x0d, 0x3d, 0x9c, 0x34, 0x08, 0x50, 0x6a, 0x69, 0x20, 0x56, 0x92,
-	0x34, 0x96, 0x4b, 0xa5, 0xb1, 0xf7, 0x92, 0x34, 0x26, 0xf0, 0x3c, 0x77, 0x57, 0xe2, 0x3c, 0x24,
-	0x90, 0xc8, 0xba, 0x99, 0xeb, 0x0a, 0x99, 0xf4, 0x77, 0xc1, 0xdc, 0xb5, 0x92, 0x9d, 0x7a, 0x23,
-	0xd9, 0xfd, 0xd7, 0x89, 0xe8, 0x9f, 0x39, 0x40, 0x8b, 0xfc, 0x00, 0x7d, 0x13, 0x2a, 0xa1, 0xe7,
-	0x18, 0xe9, 0xce, 0x4a, 0x39, 0xf4, 0x9c, 0x3e, 0x6f, 0xae, 0xdc, 0xe1, 0xdf, 0x5c, 0xa6, 0x7f,
-	0xf3, 0xcb, 0xfc, 0x5b, 0xb8, 0xc5, 0xbf, 0xf6, 0x4d, 0xff, 0xaa, 0x99, 0x1f, 0x45, 0x8b, 0x87,
-	0x59, 0xcb, 0xc1, 0xc5, 0x37, 0xed, 0xe0, 0x23, 0xa8, 0xa5, 0x9b, 0x09, 0x0c, 0x1b, 0xd3, 0x90,
-	0x8a, 0xa0, 0x17, 0xef, 0xa4, 0xcb, 0xbb, 0xc0, 0xcf, 0x27, 0x9a, 0x9f, 0x41, 0x35, 0xd5, 0x48,
-	0x58, 0x1b, 0x8e, 0xa1, 0x9a, 0xaa, 0x61, 0xe8, 0x11, 0xa8, 0x78, 0x6a, 0x5a, 0xb2, 0x0f, 0xd4,
-	0x7f, 0xa0, 0x8b, 0x21, 0xd2, 0xa0, 0x18, 0x10, 0x7c, 0xe1, 0x4c, 0x85, 0x86, 0xfe, 0x03, 0x5d,
-	0x8e, 0x19, 0x82, 0xe0, 0x11, 0x9e, 0x8a, 0xf7, 0xcf, 0x10, 0x7c, 0xd8, 0xab, 0x01, 0x70, 0xbe,
-	0x66, 0xd0, 0x59, 0x80, 0x9b, 0xbf, 0x51, 0x64, 0xd7, 0x07, 0x33, 0xff, 0x34, 0xa0, 0x6c, 0x52,
-	0x8a, 0x27, 0x01, 0x7f, 0x3c, 0x2c, 0x60, 0x93, 0x31, 0xea, 0xc2, 0xc3, 0x00, 0x13, 0x83, 0x92,
-	0x99, 0x11, 0xf7, 0x36, 0x72, 0x59, 0xbd, 0x8d, 0x8d, 0x00, 0x93, 0x73, 0x32, 0x3b, 0x97, 0x1d,
-	0x8e, 0xc7, 0xec, 0xab, 0x84, 0x29, 0xf0, 0x3d, 0x19, 0x95, 0xbc, 0x79, 0x31, 0x3b, 0xf5, 0x9a,
-	0x7f, 0xcc, 0x01, 0xcc, 0x5b, 0x01, 0xe8, 0x5d, 0xa8, 0x99, 0xae, 0xeb, 0x5f, 0x19, 0x3e, 0x71,
-	0x46, 0x8e, 0x27, 0x5f, 0x72, 0x95, 0xcf, 0x9d, 0xf2, 0x29, 0xf6, 0x0e, 0x85, 0x88, 0x20, 0x5b,
-	0xf1, 0x33, 0x16, 0xb8, 0x17, 0x62, 0x6e, 0x2e, 0x74, 0xad, 0x52, 0x4a, 0xa1, 0x38, 0xa7, 0xbf,
-	0x0f, 0x9b, 0x78, 0x1a, 0xf8, 0x37, 0x4a, 0x62, 0x45, 0xdf, 0x10, 0xb3, 0xb1, 0x58, 0x07, 0x4a,
-	0x13, 0x73, 0x6a, 0x98, 0x23, 0xd1, 0xf7, 0x59, 0x7a, 0xf0, 0xe2, 0xc4, 0x9c, 0x76, 0x47, 0x18,
-	0x7d, 0x09, 0x5b, 0x62, 0x7f, 0x8b, 0x60, 0x1b, 0x7b, 0xd4, 0x31, 0xdd, 0x50, 0xb6, 0x84, 0x1a,
-	0x0b, 0xe8, 0x9e, 0xef, 0xbb, 0x5f, 0xb1, 0xf7, 0xa7, 0xd7, 0x39, 0xe8, 0x78, 0x8e, 0x69, 0xfe,
-	0x41, 0x05, 0xb4, 0xd8, 0xb5, 0x41, 0xcf, 0x40, 0xb5, 0xb1, 0x6b, 0xce, 0x56, 0xf9, 0x68, 0x5c,
-	0x40, 0xb7, 0x4e, 0x18, 0x54, 0x17, 0x1a, 0x98, 0x2a, 0x73, 0x18, 0x27, 0xd3, 0xb5, 0x55, 0x75,
-	0x19, 0x54, 0x17, 0x1a, 0x1a, 0xbf, 0xce, 0x81, 0xca, 0x75, 0xa3, 0x77, 0xa0, 0x14, 0x60, 0x62,
-	0x61, 0x4f, 0x3c, 0x5c, 0x95, 0x57, 0xd6, 0x78, 0x0a, 0x1d, 0x42, 0xf5, 0xc2, 0x99, 0x62, 0xdb,
-	0x10, 0x67, 0xc8, 0x7a, 0x4e, 0xfd, 0x07, 0x3a, 0x70, 0x79, 0xa1, 0xbb, 0x0f, 0x5b, 0xec, 0x82,
-	0x3c, 0xe1, 0x22, 0xa9, 0x23, 0x9f, 0xad, 0xa3, 0x9e, 0x42, 0x09, 0x4d, 0x3d, 0x00, 0x69, 0xd2,
-	0xfc, 0x72, 0x97, 0xd5, 0xf5, 0x33, 0x21, 0xac, 0xa7, 0x50, 0xbd, 0x2d, 0x78, 0x38, 0xa6, 0x34,
-	0x10, 0x66, 0xf0, 0xd8, 0x6a, 0xbc, 0x52, 0x40, 0xe5, 0x7e, 0xc9, 0x70, 0xc3, 0xbb, 0x50, 0xe5,
-	0xd0, 0x90, 0x9a, 0x34, 0x0a, 0x45, 0xa5, 0x64, 0x67, 0x65, 0x93, 0x03, 0x3e, 0xc7, 0x44, 0x46,
-	0x24, 0xb0, 0x62, 0x91, 0x38, 0xa4, 0x81, 0x4d, 0xce, 0x45, 0x18, 0xa0, 0x63, 0x60, 0xde, 0xbe,
-	0x2b, 0xc4, 0x22, 0x7c, 0xf2, 0x09, 0x6f, 0xce, 0xbd, 0x89, 0x73, 0xd6, 0x00, 0xf8, 0x06, 0x22,
-	0x7d, 0x3c, 0x85, 0x5a, 0xba, 0x95, 0xcc, 0xd2, 0x91, 0x17, 0x4d, 0x86, 0x98, 0xf0, 0x73, 0x6e,
-	0xb0, 0x74, 0x24, 0xc6, 0x68, 0x1b, 0x0a, 0x9e, 0x29, 0xbf, 0xc4, 0x98, 0x5d, 0x7c, 0xd4, 0x2b,
-	0x8a, 0x02, 0xd3, 0xfc, 0x16, 0x94, 0xe4, 0x66, 0xf3, 0x8c, 0xcc, 0x34, 0x28, 0x32, 0x23, 0xf7,
-	0x5a, 0x7f, 0x7b, 0xbd, 0xa3, 0xfc, 0xe3, 0xf5, 0x8e, 0xf2, 0xea, 0xf5, 0x8e, 0xf2, 0xb3, 0x5d,
-	0x61, 0xb3, 0xe3, 0xb7, 0xcd, 0xc0, 0x69, 0xdf, 0xf2, 0x4f, 0x88, 0x61, 0x91, 0xdf, 0xfc, 0xfe,
-	0x7f, 0x02, 0x00, 0x00, 0xff, 0xff, 0x8d, 0x99, 0xb2, 0xe8, 0x28, 0x19, 0x00, 0x00,
+	0x15, 0x1f, 0xd9, 0x96, 0xff, 0x3c, 0x39, 0x19, 0xa7, 0xc9, 0xce, 0x6a, 0xcc, 0xd6, 0x90, 0xf5,
+	0xb2, 0xbb, 0xa1, 0x96, 0xb5, 0x0b, 0x0f, 0x2c, 0xa9, 0x65, 0x76, 0x76, 0xed, 0xcc, 0xcc, 0x3a,
+	0xd4, 0x0c, 0x49, 0xc9, 0x61, 0x0f, 0x5c, 0x54, 0xb2, 0xd4, 0xb1, 0xc5, 0xc8, 0x92, 0x68, 0xb5,
+	0x12, 0xbb, 0x38, 0xf2, 0xe7, 0x0e, 0xc5, 0x95, 0xe2, 0x53, 0x70, 0xe1, 0xc2, 0x95, 0x13, 0xc5,
+	0x27, 0xa0, 0xa6, 0xe6, 0xc0, 0x95, 0xaf, 0x40, 0xf5, 0x1f, 0xc9, 0x4a, 0x9c, 0x58, 0x76, 0x18,
+	0xa8, 0x3d, 0xc5, 0xdd, 0xfd, 0x7e, 0xaf, 0x5f, 0xbf, 0xee, 0xf7, 0xde, 0x4f, 0x2f, 0xf0, 0x1d,
+	0x1f, 0xd3, 0x8b, 0x80, 0xbc, 0x74, 0xfd, 0x71, 0xe7, 0xfc, 0x7b, 0x96, 0x17, 0x4e, 0xac, 0x87,
+	0x9d, 0x73, 0x97, 0xd0, 0xd8, 0xf2, 0xcc, 0x08, 0x93, 0x73, 0xd7, 0xc6, 0xed, 0x90, 0x04, 0x34,
+	0x40, 0xf7, 0xdd, 0x88, 0xba, 0x41, 0x7b, 0x01, 0x68, 0x27, 0x80, 0xe6, 0x83, 0x71, 0x10, 0x8c,
+	0x3d, 0xdc, 0xe1, 0x82, 0xa3, 0xf8, 0xac, 0xe3, 0xc4, 0xc4, 0xa2, 0x6e, 0xe0, 0x0b, 0xe8, 0xf2,
+	0xfa, 0x05, 0xb1, 0xc2, 0x10, 0x93, 0x48, 0xae, 0x7f, 0x78, 0x9d, 0x15, 0x72, 0xce, 0x8c, 0xec,
+	0x20, 0x94, 0x36, 0xb4, 0xfe, 0x5c, 0x80, 0xed, 0xaf, 0x84, 0x75, 0x43, 0x61, 0x1c, 0xda, 0x05,
+	0x75, 0x12, 0x44, 0x34, 0xd2, 0x95, 0xbd, 0xe2, 0x7e, 0xcd, 0x10, 0x03, 0xd4, 0x84, 0xea, 0xd8,
+	0xa2, 0xf8, 0xc2, 0x9a, 0x47, 0x7a, 0x81, 0x2f, 0xa4, 0x63, 0x74, 0x00, 0xa5, 0x09, 0xa5, 0xa1,
+	0x5e, 0xdc, 0x2b, 0xee, 0x6b, 0xdd, 0x6f, 0xb7, 0x6f, 0x3c, 0x57, 0x7b, 0x70, 0x7a, 0x7a, 0x62,
+	0x04, 0x31, 0xc5, 0x06, 0x47, 0xa0, 0x1f, 0x40, 0x91, 0xda, 0xa1, 0x5e, 0xe2, 0xc0, 0xf7, 0x56,
+	0x00, 0x4f, 0x0f, 0x25, 0x8e, 0xc9, 0x73, 0x98, 0x17, 0xe9, 0x6a, 0x3e, 0xec, 0xf9, 0x30, 0x81,
+	0x79, 0x11, 0x3a, 0x82, 0xba, 0x1d, 0xf8, 0x67, 0xee, 0x58, 0xb8, 0x40, 0x2f, 0xef, 0x29, 0xfb,
+	0xdb, 0xdd, 0x0f, 0x56, 0xe0, 0x0f, 0xb9, 0xf8, 0x90, 0x49, 0x1b, 0x9a, 0xbd, 0x18, 0xb4, 0xce,
+	0x41, 0x7b, 0x82, 0x23, 0xea, 0xfa, 0xfc, 0x56, 0x10, 0x82, 0x12, 0x73, 0x93, 0xae, 0xec, 0x29,
+	0xfb, 0x35, 0x83, 0xff, 0x46, 0xf7, 0xa0, 0x1c, 0xc5, 0xa3, 0x08, 0x53, 0xbd, 0xc0, 0x67, 0xe5,
+	0x08, 0xfd, 0x08, 0x4a, 0x61, 0x40, 0xa8, 0x5e, 0xdc, 0x53, 0xf6, 0xb5, 0xee, 0x87, 0x2b, 0x76,
+	0x3f, 0x09, 0x08, 0x1d, 0x62, 0x0f, 0xdb, 0x34, 0x20, 0x06, 0x07, 0xb5, 0xfe, 0x0d, 0x50, 0x4b,
+	0x9d, 0x88, 0x7a, 0xa0, 0x4e, 0x2d, 0x6a, 0x4f, 0xf8, 0x55, 0x69, 0xdd, 0x8f, 0x72, 0x3c, 0xff,
+	0x82, 0xc9, 0x1a, 0xf8, 0x17, 0x31, 0x8e, 0xa8, 0x21, 0x90, 0xe8, 0x29, 0xa8, 0x84, 0xe9, 0xe2,
+	0x97, 0xaa, 0x75, 0x3b, 0xeb, 0x5c, 0x5e, 0xe6, 0xe4, 0x86, 0x40, 0xa3, 0x43, 0xa8, 0x12, 0xec,
+	0xb8, 0x04, 0xdb, 0xeb, 0x1c, 0x8c, 0x6b, 0x92, 0xe2, 0x46, 0x0a, 0x44, 0x5f, 0x40, 0x85, 0xe0,
+	0x0b, 0xe2, 0x52, 0xac, 0x97, 0xb8, 0x8e, 0x0f, 0x72, 0x75, 0x70, 0x69, 0x23, 0x81, 0xa1, 0x8f,
+	0x60, 0xe7, 0x02, 0x8f, 0xa2, 0xc0, 0x7e, 0x89, 0xa9, 0x19, 0x87, 0x63, 0x62, 0x39, 0x58, 0x57,
+	0xf7, 0x94, 0xfd, 0xaa, 0xd1, 0x48, 0x17, 0x7e, 0x2a, 0xe6, 0xd1, 0x43, 0xa8, 0x50, 0x77, 0x8a,
+	0x83, 0x98, 0xf2, 0x97, 0xa0, 0x75, 0xef, 0xb7, 0x45, 0x58, 0xb5, 0x93, 0xb0, 0x6a, 0x3f, 0x91,
+	0x61, 0x67, 0x24, 0x92, 0xe8, 0x31, 0xb3, 0x91, 0x12, 0x17, 0x47, 0x7a, 0x85, 0x83, 0x72, 0x9f,
+	0x3b, 0xa6, 0x64, 0x6e, 0x24, 0x20, 0x74, 0x08, 0xea, 0x99, 0x15, 0x7b, 0x54, 0xaf, 0x72, 0xf4,
+	0xc7, 0x39, 0xe8, 0x67, 0x4c, 0xf6, 0xc8, 0xff, 0x39, 0xb6, 0x85, 0xb7, 0x39, 0x16, 0x3d, 0x86,
+	0xf2, 0xd4, 0x25, 0x24, 0x20, 0x7a, 0x2d, 0xd7, 0x4f, 0xd9, 0xcb, 0x92, 0x28, 0xf4, 0x0c, 0x34,
+	0x3b, 0x20, 0x91, 0x19, 0x06, 0x9e, 0x6b, 0xcf, 0x75, 0xe0, 0x4a, 0xde, 0x5f, 0x19, 0x07, 0x24,
+	0x3a, 0xe1, 0xc2, 0x06, 0xd8, 0xe9, 0x6f, 0x34, 0x82, 0x6d, 0x96, 0x76, 0x7c, 0xc7, 0x9c, 0x60,
+	0xcb, 0xc1, 0x24, 0xd2, 0x35, 0xfe, 0x8a, 0x7e, 0xb8, 0xce, 0x2b, 0x6a, 0xf7, 0x38, 0x74, 0x20,
+	0x90, 0x4f, 0x7d, 0x4a, 0xe6, 0xfd, 0x82, 0xae, 0x18, 0x5b, 0x56, 0x76, 0x1e, 0x7d, 0x0a, 0x6f,
+	0x13, 0x3c, 0x0d, 0xce, 0xb1, 0x49, 0x70, 0x14, 0x06, 0x7e, 0x84, 0xd3, 0xcd, 0xea, 0x2c, 0x0f,
+	0x71, 0xcc, 0x5b, 0x42, 0xc4, 0x90, 0x12, 0x09, 0xf6, 0x97, 0xf0, 0xb6, 0xb4, 0x6f, 0x09, 0xbb,
+	0xc5, 0x0d, 0xfd, 0x7c, 0x03, 0x43, 0xaf, 0x28, 0x5f, 0x18, 0xfc, 0x96, 0x75, 0xdd, 0x3a, 0x3a,
+	0x80, 0x7b, 0xa9, 0xe1, 0x3c, 0xe4, 0xd2, 0xbd, 0xb7, 0x53, 0xbb, 0x77, 0x13, 0xbb, 0xb9, 0x40,
+	0x82, 0x9c, 0xc1, 0xbd, 0xd4, 0xec, 0xcb, 0xc8, 0xbb, 0xdc, 0xea, 0xc7, 0x1b, 0x59, 0x9d, 0x55,
+	0xbd, 0x30, 0x7a, 0xd7, 0xba, 0x66, 0x19, 0x3d, 0x82, 0x4a, 0xb2, 0x55, 0x83, 0x3f, 0x8a, 0xd6,
+	0xaa, 0xad, 0x84, 0xa4, 0x91, 0x40, 0x9a, 0x5f, 0x00, 0x5a, 0xbe, 0x53, 0xd4, 0x80, 0xe2, 0x4b,
+	0x3c, 0x97, 0xa9, 0x91, 0xfd, 0x64, 0x15, 0xe6, 0xdc, 0xf2, 0x62, 0x2c, 0x13, 0xa3, 0x18, 0x7c,
+	0x5a, 0x38, 0x50, 0x9a, 0x03, 0x68, 0xde, 0xec, 0xec, 0x8d, 0x34, 0x7d, 0x09, 0xf7, 0x6f, 0x74,
+	0xc0, 0x26, 0x8a, 0x5a, 0xff, 0x2a, 0x42, 0x25, 0x71, 0xcf, 0x0b, 0x16, 0xfc, 0x5c, 0x1d, 0xc7,
+	0x6a, 0xdd, 0x87, 0xf9, 0xee, 0x91, 0x7f, 0x8f, 0x43, 0x2c, 0x52, 0x49, 0x64, 0x24, 0x3a, 0xd0,
+	0x31, 0x4b, 0x9a, 0xe2, 0x9c, 0x7c, 0xdf, 0x5b, 0xea, 0x4b, 0x95, 0x34, 0xff, 0x52, 0x80, 0xc6,
+	0xd5, 0x65, 0xf4, 0x13, 0x28, 0xb2, 0x22, 0x24, 0x4a, 0xc4, 0xa3, 0x5b, 0x6c, 0xd0, 0x1e, 0x62,
+	0xca, 0xfd, 0x66, 0x30, 0x45, 0x4c, 0x9f, 0xe5, 0x38, 0xb2, 0x5e, 0xdc, 0x4a, 0x5f, 0xcf, 0x71,
+	0xa4, 0x3e, 0xcb, 0x71, 0x58, 0x9d, 0x14, 0x51, 0xc0, 0xf9, 0x43, 0xcd, 0x90, 0xa3, 0xe6, 0x27,
+	0x50, 0x4d, 0x36, 0xde, 0xe8, 0xe6, 0x3f, 0x81, 0x6a, 0xb2, 0xc1, 0x46, 0x17, 0xfd, 0x7b, 0x05,
+	0xaa, 0x09, 0x5f, 0x60, 0x69, 0x3a, 0x5b, 0x59, 0x3f, 0x5e, 0xcd, 0x31, 0x78, 0x61, 0xed, 0x51,
+	0x4a, 0xdc, 0x51, 0x4c, 0x71, 0x94, 0xd4, 0xd6, 0xde, 0xe5, 0xda, 0xba, 0xaa, 0x3c, 0xdf, 0x50,
+	0x57, 0x5b, 0xbf, 0x63, 0x46, 0x49, 0xee, 0x83, 0xfa, 0x97, 0x8d, 0xfa, 0xee, 0x0a, 0x7d, 0xcf,
+	0xbf, 0xff, 0xbf, 0xb3, 0xe9, 0x4f, 0x2a, 0x34, 0xae, 0xd2, 0x09, 0x74, 0x00, 0xc5, 0x98, 0xb8,
+	0x32, 0x2c, 0x56, 0xd5, 0xa3, 0x21, 0x25, 0xae, 0x3f, 0x16, 0x58, 0x06, 0x61, 0xc5, 0x2c, 0xb2,
+	0x27, 0x78, 0x9a, 0xc4, 0xc0, 0xba, 0x60, 0x89, 0xe2, 0xc5, 0x10, 0xd3, 0x49, 0xe0, 0x48, 0xe2,
+	0xb1, 0x36, 0x5e, 0xa0, 0xd0, 0x13, 0xa8, 0x59, 0x31, 0x9d, 0x04, 0xc4, 0xa5, 0xf3, 0x35, 0x78,
+	0x47, 0x56, 0xc5, 0x02, 0x88, 0x8c, 0x45, 0xe6, 0x14, 0xb4, 0xf4, 0x60, 0x03, 0x32, 0xd6, 0xce,
+	0x66, 0xa7, 0x34, 0x9f, 0x32, 0x56, 0xc9, 0x99, 0x22, 0x63, 0x27, 0x5b, 0x82, 0x00, 0xa2, 0x11,
+	0x6c, 0x45, 0x41, 0x4c, 0x6c, 0x6c, 0x7a, 0xd6, 0x08, 0x7b, 0x8c, 0x85, 0xb0, 0xdd, 0x3e, 0xdb,
+	0x64, 0xb7, 0x21, 0x57, 0xf0, 0x9c, 0xe3, 0xc5, 0x96, 0xf5, 0x28, 0x33, 0x75, 0x89, 0xeb, 0x57,
+	0x2f, 0x73, 0xfd, 0xe6, 0x08, 0xea, 0x39, 0xa9, 0xf4, 0x51, 0x36, 0xc2, 0xd6, 0xf7, 0x65, 0x26,
+	0x82, 0x3f, 0x87, 0x9d, 0x25, 0x13, 0x37, 0x0a, 0xe5, 0xbf, 0xab, 0xb0, 0x7b, 0x1d, 0x5b, 0x45,
+	0x03, 0xd0, 0x9c, 0xc5, 0x70, 0x8d, 0xd7, 0x9a, 0x7d, 0xfe, 0x59, 0x28, 0xcb, 0x5a, 0x17, 0xd8,
+	0x1d, 0x4f, 0x04, 0xbb, 0x57, 0x0d, 0x39, 0x5a, 0x45, 0x57, 0x8a, 0x79, 0x74, 0xe5, 0xb7, 0xca,
+	0xcd, 0x7c, 0x45, 0x7c, 0x22, 0xfd, 0x78, 0x43, 0x7a, 0xfe, 0xc6, 0xa9, 0x8b, 0x9a, 0x43, 0x5d,
+	0x7e, 0xa5, 0xdc, 0xc8, 0x5d, 0xca, 0xfc, 0x04, 0x47, 0xb7, 0x3d, 0xc1, 0x2d, 0x69, 0x4c, 0x65,
+	0x73, 0x1a, 0xf3, 0x35, 0x24, 0x21, 0x14, 0x1a, 0xff, 0xff, 0xb7, 0xdc, 0xfa, 0x6b, 0x01, 0x76,
+	0x96, 0x0a, 0x09, 0xea, 0xc0, 0x37, 0x32, 0x60, 0x33, 0x8a, 0x47, 0x3e, 0x4e, 0xbb, 0x05, 0x28,
+	0xb3, 0x34, 0x14, 0x2b, 0x69, 0x1a, 0x2b, 0x64, 0xd2, 0xd8, 0x7b, 0x69, 0x1a, 0x13, 0x78, 0x9e,
+	0xbb, 0x6b, 0x49, 0x1e, 0x12, 0x48, 0x64, 0x5f, 0xcd, 0x75, 0xa5, 0x5c, 0xfa, 0xbb, 0x64, 0xee,
+	0x46, 0xc9, 0x4e, 0xbd, 0x92, 0xec, 0xfe, 0xeb, 0x44, 0xf4, 0xcf, 0x02, 0xa0, 0x65, 0x7e, 0x80,
+	0xbe, 0x09, 0xb5, 0xc8, 0x77, 0xcd, 0x6c, 0x9b, 0xa5, 0x1a, 0xf9, 0xee, 0x80, 0x77, 0x5a, 0x6e,
+	0xf0, 0x6f, 0x21, 0xd7, 0xbf, 0xc5, 0x55, 0xfe, 0x2d, 0x5d, 0xe3, 0x5f, 0xe7, 0xaa, 0x7f, 0xd5,
+	0xdc, 0x8f, 0xa2, 0xe5, 0xc3, 0x6c, 0xe4, 0xe0, 0xf2, 0x9b, 0x76, 0xf0, 0x63, 0xa8, 0x67, 0x9b,
+	0x09, 0x0c, 0x9b, 0xd0, 0x90, 0x9a, 0xa0, 0x17, 0xef, 0x64, 0xcb, 0xbb, 0xc0, 0x2f, 0x26, 0x5a,
+	0x9f, 0x81, 0x96, 0x69, 0x24, 0x6c, 0x0c, 0xc7, 0xa0, 0x65, 0x6a, 0x18, 0xba, 0x07, 0x2a, 0x9e,
+	0x59, 0xb6, 0xec, 0x03, 0x0d, 0xee, 0x18, 0x62, 0x88, 0x74, 0x28, 0x87, 0x04, 0x9f, 0xb9, 0x33,
+	0xa1, 0x61, 0x70, 0xc7, 0x90, 0x63, 0x86, 0x20, 0x78, 0x8c, 0x67, 0xe2, 0xfd, 0x33, 0x04, 0x1f,
+	0xf6, 0xeb, 0x00, 0x9c, 0xaf, 0x99, 0x74, 0x1e, 0xe2, 0xd6, 0x6f, 0x14, 0xd9, 0xf5, 0xc1, 0xcc,
+	0x3f, 0x4d, 0xa8, 0x5a, 0x94, 0xe2, 0x69, 0xc8, 0x1f, 0x0f, 0x0b, 0xd8, 0x74, 0x8c, 0x7a, 0x70,
+	0x37, 0xc4, 0xc4, 0xa4, 0x64, 0x6e, 0x26, 0xbd, 0x8d, 0x42, 0x5e, 0x6f, 0x63, 0x2b, 0xc4, 0xe4,
+	0x94, 0xcc, 0x4f, 0x65, 0x87, 0xe3, 0x3e, 0xfb, 0x2a, 0x61, 0x0a, 0x02, 0x5f, 0x46, 0x25, 0x6f,
+	0x5e, 0xcc, 0x8f, 0xfd, 0xd6, 0x1f, 0x0b, 0x00, 0x8b, 0x56, 0x00, 0x7a, 0x17, 0xea, 0x96, 0xe7,
+	0x05, 0x17, 0x66, 0x40, 0xdc, 0xb1, 0xeb, 0xcb, 0x97, 0xac, 0xf1, 0xb9, 0x63, 0x3e, 0xc5, 0xde,
+	0xa1, 0x10, 0x11, 0x64, 0x2b, 0x79, 0xc6, 0x02, 0xf7, 0x42, 0xcc, 0x2d, 0x84, 0x2e, 0x55, 0x4a,
+	0x29, 0x94, 0xe4, 0xf4, 0xf7, 0x61, 0x1b, 0xcf, 0xc2, 0xe0, 0x4a, 0x49, 0xac, 0x19, 0x5b, 0x62,
+	0x36, 0x11, 0xeb, 0x42, 0x65, 0x6a, 0xcd, 0x4c, 0x6b, 0x2c, 0xfa, 0x3e, 0x2b, 0x0f, 0x5e, 0x9e,
+	0x5a, 0xb3, 0xde, 0x18, 0xa3, 0x2f, 0x61, 0x47, 0xec, 0x6f, 0x13, 0xec, 0x60, 0x9f, 0xba, 0x96,
+	0x17, 0xc9, 0x96, 0x50, 0x73, 0x09, 0xdd, 0x0f, 0x02, 0xef, 0x2b, 0xf6, 0xfe, 0x8c, 0x06, 0x07,
+	0x1d, 0x2e, 0x30, 0xad, 0x3f, 0xa8, 0x80, 0x96, 0xbb, 0x36, 0xe8, 0x08, 0x54, 0x07, 0x7b, 0xd6,
+	0x7c, 0x9d, 0x8f, 0xc6, 0x25, 0x74, 0xfb, 0x09, 0x83, 0x1a, 0x42, 0x03, 0x53, 0x65, 0x8d, 0x92,
+	0x64, 0xba, 0xb1, 0xaa, 0x1e, 0x83, 0x1a, 0x42, 0x43, 0xf3, 0xd7, 0x05, 0x50, 0xb9, 0x6e, 0xf4,
+	0x0e, 0x54, 0x42, 0x4c, 0x6c, 0xec, 0x8b, 0x87, 0xab, 0xf2, 0xca, 0x9a, 0x4c, 0xa1, 0x47, 0xa0,
+	0x9d, 0xb9, 0x33, 0xec, 0x98, 0xe2, 0x0c, 0x79, 0xcf, 0x69, 0x70, 0xc7, 0x00, 0x2e, 0x2f, 0x74,
+	0x0f, 0x60, 0x87, 0x5d, 0x90, 0x2f, 0x5c, 0x24, 0x75, 0x14, 0xf3, 0x75, 0x34, 0x32, 0x28, 0xa1,
+	0xa9, 0x0f, 0x20, 0x4d, 0x5a, 0x5c, 0xee, 0xaa, 0xba, 0x7e, 0x22, 0x84, 0x8d, 0x0c, 0xaa, 0xbf,
+	0x03, 0x77, 0x27, 0x94, 0x86, 0xc2, 0x0c, 0x1e, 0x5b, 0xcd, 0x57, 0x0a, 0xa8, 0xdc, 0x2f, 0x39,
+	0x6e, 0x78, 0x17, 0x34, 0x0e, 0x8d, 0xa8, 0x45, 0xe3, 0x48, 0x54, 0x4a, 0x76, 0x56, 0x36, 0x39,
+	0xe4, 0x73, 0x4c, 0x64, 0x4c, 0x42, 0x3b, 0x11, 0x49, 0x42, 0x1a, 0xd8, 0xe4, 0x42, 0x84, 0x01,
+	0xba, 0x26, 0xe6, 0xed, 0xbb, 0x52, 0x22, 0xc2, 0x27, 0x9f, 0xf2, 0xe6, 0xdc, 0x9b, 0x38, 0x67,
+	0x1d, 0x80, 0x6f, 0x20, 0xd2, 0xc7, 0x33, 0xa8, 0x67, 0x5b, 0xc9, 0x2c, 0x1d, 0xf9, 0xf1, 0x74,
+	0x84, 0x09, 0x3f, 0xe7, 0x16, 0x4b, 0x47, 0x62, 0x8c, 0x76, 0xa1, 0xe4, 0x5b, 0xf2, 0x4b, 0x8c,
+	0xd9, 0xc5, 0x47, 0xfd, 0xb2, 0x28, 0x30, 0xad, 0x6f, 0x41, 0x45, 0x6e, 0xb6, 0xc8, 0xc8, 0x4c,
+	0x83, 0x22, 0x33, 0x72, 0xbf, 0xfd, 0xb7, 0xd7, 0x0f, 0x94, 0x7f, 0xbc, 0x7e, 0xa0, 0xbc, 0x7a,
+	0xfd, 0x40, 0xf9, 0xd9, 0x9e, 0xb0, 0xd9, 0x0d, 0x3a, 0x56, 0xe8, 0x76, 0xae, 0xf9, 0x8f, 0xc4,
+	0xa8, 0xcc, 0x6f, 0xfe, 0xe1, 0x7f, 0x02, 0x00, 0x00, 0xff, 0xff, 0xcb, 0x93, 0xb9, 0x9e, 0x35,
+	0x19, 0x00, 0x00,
 }
diff --git a/networking/v1alpha3/virtual_service.proto b/networking/v1alpha3/virtual_service.proto
index d299590965..3f0e74e5b5 100644
--- a/networking/v1alpha3/virtual_service.proto
+++ b/networking/v1alpha3/virtual_service.proto
@@ -178,11 +178,11 @@ message VirtualService {
   // matching an incoming request is used.
   repeated TCPRoute tcp = 4;
 
-  // The visibility setting associated with this virtual service. Set to
+  // The visibility setting associated with this VirtualService. Set to
   // PRIVATE if this virtual service should not be exported, i.e. restrict
   // the applicability of this virtual service to only workloads in the same
   // namespace as the virtual service.
-  ConfigScope scope = 6;
+  ConfigScope config_scope = 6;
 }
 
 // Destination indicates the network addressable service to which the
diff --git a/proto.lock b/proto.lock
index 2b3eb84c3b..633c8f8014 100644
--- a/proto.lock
+++ b/proto.lock
@@ -699,7 +699,7 @@
                 "integer": 0
               },
               {
-                "name": "CURRENT_NAMESPACE",
+                "name": "SAME_NAMESPACE",
                 "integer": 1
               }
             ]
@@ -2481,6 +2481,11 @@
                 "name": "subsets",
                 "type": "Subset",
                 "is_repeated": true
+              },
+              {
+                "id": 4,
+                "name": "config_scope",
+                "type": "ConfigScope"
               }
             ]
           },
@@ -3198,6 +3203,16 @@
                     "type": "Import",
                     "is_repeated": true
                   }
+                ],
+                "maps": [
+                  {
+                    "key_type": "string",
+                    "field": {
+                      "id": 1,
+                      "name": "source_workload_labels",
+                      "type": "string"
+                    }
+                  }
                 ]
               }
             ]
@@ -3280,7 +3295,7 @@
               },
               {
                 "id": 7,
-                "name": "scope",
+                "name": "config_scope",
                 "type": "ConfigScope"
               }
             ],
@@ -3372,7 +3387,7 @@
               },
               {
                 "id": 6,
-                "name": "scope",
+                "name": "config_scope",
                 "type": "ConfigScope"
               }
             ]
diff --git a/python/istio_api/mesh/v1alpha1/config_pb2.py b/python/istio_api/mesh/v1alpha1/config_pb2.py
index 01cb073f21..f5462a765d 100644
--- a/python/istio_api/mesh/v1alpha1/config_pb2.py
+++ b/python/istio_api/mesh/v1alpha1/config_pb2.py
@@ -22,7 +22,7 @@
   name='mesh/v1alpha1/config.proto',
   package='istio.mesh.v1alpha1',
   syntax='proto3',
-  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xe6\r\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x1e\n\x16policy_check_fail_open\x18\x19 \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x61\n\rtcp_keepalive\x18\x1c \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepalive\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x38\n\x11rds_refresh_delay\x18\x0b \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12N\n\x13\x61\x63\x63\x65ss_log_encoding\x18\x1b \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.AccessLogEncoding\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\x19\n\rmixer_address\x18\x10 \x01(\tB\x02\x18\x01\x12Z\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicyB\x02\x18\x01\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x38\n\x11sds_refresh_delay\x18\x15 \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\x12\x14\n\x0ctrust_domain\x18\x1a \x01(\t\x12R\n\x15\x64\x65\x66\x61ult_network_scope\x18\x1d \x01(\x0b\x32\x33.istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope\x1a\xb5\x01\n\x15OutboundTrafficPolicy\x12L\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.ModeB\x02\x18\x01\"N\n\x04Mode\x12\x15\n\rREGISTRY_ONLY\x10\x00\x1a\x02\x08\x01\x12\x11\n\tALLOW_ANY\x10\x01\x1a\x02\x08\x01\x12\x1c\n\x14VIRTUAL_SERVICE_ONLY\x10\x02\x1a\x02\x08\x01\x1a\xb2\x01\n\x13\x44\x65\x66\x61ultNetworkScope\x12M\n\x0bimport_mode\x18\x01 \x01(\x0e\x32\x38.istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope.Mode\x12\x19\n\x11import_namespaces\x18\x02 \x03(\t\"1\n\x04Mode\x12\x12\n\x0e\x41LL_NAMESPACES\x10\x00\x12\x15\n\x11\x43URRENT_NAMESPACE\x10\x01\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\"\'\n\x11\x41\x63\x63\x65ssLogEncoding\x12\x08\n\x04TEXT\x10\x00\x12\x08\n\x04JSON\x10\x01J\x04\x08\x0f\x10\x10J\x04\x08\x12\x10\x13\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettingsB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
+  serialized_pb=_b('\n\x1amesh/v1alpha1/config.proto\x12\x13istio.mesh.v1alpha1\x1a\x1egoogle/protobuf/duration.proto\x1a\x19mesh/v1alpha1/proxy.proto\x1a*networking/v1alpha3/destination_rule.proto\"\xe3\r\n\nMeshConfig\x12\x1a\n\x12mixer_check_server\x18\x01 \x01(\t\x12\x1b\n\x13mixer_report_server\x18\x02 \x01(\t\x12\x1d\n\x15\x64isable_policy_checks\x18\x03 \x01(\x08\x12\x1e\n\x16policy_check_fail_open\x18\x19 \x01(\x08\x12\x19\n\x11proxy_listen_port\x18\x04 \x01(\x05\x12\x17\n\x0fproxy_http_port\x18\x05 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x61\n\rtcp_keepalive\x18\x1c \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepalive\x12\x15\n\ringress_class\x18\x07 \x01(\t\x12\x17\n\x0fingress_service\x18\x08 \x01(\t\x12V\n\x17ingress_controller_mode\x18\t \x01(\x0e\x32\x35.istio.mesh.v1alpha1.MeshConfig.IngressControllerMode\x12\x43\n\x0b\x61uth_policy\x18\n \x01(\x0e\x32*.istio.mesh.v1alpha1.MeshConfig.AuthPolicyB\x02\x18\x01\x12\x38\n\x11rds_refresh_delay\x18\x0b \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x16\n\x0e\x65nable_tracing\x18\x0c \x01(\x08\x12\x17\n\x0f\x61\x63\x63\x65ss_log_file\x18\r \x01(\t\x12\x19\n\x11\x61\x63\x63\x65ss_log_format\x18\x18 \x01(\t\x12N\n\x13\x61\x63\x63\x65ss_log_encoding\x18\x1b \x01(\x0e\x32\x31.istio.mesh.v1alpha1.MeshConfig.AccessLogEncoding\x12\x38\n\x0e\x64\x65\x66\x61ult_config\x18\x0e \x01(\x0b\x32 .istio.mesh.v1alpha1.ProxyConfig\x12\x19\n\rmixer_address\x18\x10 \x01(\tB\x02\x18\x01\x12Z\n\x17outbound_traffic_policy\x18\x11 \x01(\x0b\x32\x35.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicyB\x02\x18\x01\x12\'\n\x1f\x65nable_client_side_policy_check\x18\x13 \x01(\x08\x12\x14\n\x0csds_uds_path\x18\x14 \x01(\t\x12\x38\n\x11sds_refresh_delay\x18\x15 \x01(\x0b\x32\x19.google.protobuf.DurationB\x02\x18\x01\x12\x39\n\x0e\x63onfig_sources\x18\x16 \x03(\x0b\x32!.istio.mesh.v1alpha1.ConfigSource\x12\x1e\n\x16\x65nable_sds_token_mount\x18\x17 \x01(\x08\x12\x14\n\x0ctrust_domain\x18\x1a \x01(\t\x12R\n\x15\x64\x65\x66\x61ult_network_scope\x18\x1d \x01(\x0b\x32\x33.istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope\x1a\xb5\x01\n\x15OutboundTrafficPolicy\x12L\n\x04mode\x18\x01 \x01(\x0e\x32:.istio.mesh.v1alpha1.MeshConfig.OutboundTrafficPolicy.ModeB\x02\x18\x01\"N\n\x04Mode\x12\x15\n\rREGISTRY_ONLY\x10\x00\x1a\x02\x08\x01\x12\x11\n\tALLOW_ANY\x10\x01\x1a\x02\x08\x01\x12\x1c\n\x14VIRTUAL_SERVICE_ONLY\x10\x02\x1a\x02\x08\x01\x1a\xaf\x01\n\x13\x44\x65\x66\x61ultNetworkScope\x12M\n\x0bimport_mode\x18\x01 \x01(\x0e\x32\x38.istio.mesh.v1alpha1.MeshConfig.DefaultNetworkScope.Mode\x12\x19\n\x11import_namespaces\x18\x02 \x03(\t\".\n\x04Mode\x12\x12\n\x0e\x41LL_NAMESPACES\x10\x00\x12\x12\n\x0eSAME_NAMESPACE\x10\x01\"9\n\x15IngressControllerMode\x12\x07\n\x03OFF\x10\x00\x12\x0b\n\x07\x44\x45\x46\x41ULT\x10\x01\x12\n\n\x06STRICT\x10\x02\"&\n\nAuthPolicy\x12\x08\n\x04NONE\x10\x00\x12\x0e\n\nMUTUAL_TLS\x10\x01\"\'\n\x11\x41\x63\x63\x65ssLogEncoding\x12\x08\n\x04TEXT\x10\x00\x12\x08\n\x04JSON\x10\x01J\x04\x08\x0f\x10\x10J\x04\x08\x12\x10\x13\"]\n\x0c\x43onfigSource\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12<\n\x0ctls_settings\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettingsB\x1cZ\x1aistio.io/api/mesh/v1alpha1b\x06proto3')
   ,
   dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,mesh_dot_v1alpha1_dot_proxy__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_destination__rule__pb2.DESCRIPTOR,])
 
@@ -65,14 +65,14 @@
       options=None,
       type=None),
     _descriptor.EnumValueDescriptor(
-      name='CURRENT_NAMESPACE', index=1, number=1,
+      name='SAME_NAMESPACE', index=1, number=1,
       options=None,
       type=None),
   ],
   containing_type=None,
   options=None,
   serialized_start=1720,
-  serialized_end=1769,
+  serialized_end=1766,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_DEFAULTNETWORKSCOPE_MODE)
 
@@ -97,8 +97,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1771,
-  serialized_end=1828,
+  serialized_start=1768,
+  serialized_end=1825,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_INGRESSCONTROLLERMODE)
 
@@ -119,8 +119,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1830,
-  serialized_end=1868,
+  serialized_start=1827,
+  serialized_end=1865,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_AUTHPOLICY)
 
@@ -141,8 +141,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1870,
-  serialized_end=1909,
+  serialized_start=1867,
+  serialized_end=1906,
 )
 _sym_db.RegisterEnumDescriptor(_MESHCONFIG_ACCESSLOGENCODING)
 
@@ -213,7 +213,7 @@
   oneofs=[
   ],
   serialized_start=1591,
-  serialized_end=1769,
+  serialized_end=1766,
 )
 
 _MESHCONFIG = _descriptor.Descriptor(
@@ -428,7 +428,7 @@
   oneofs=[
   ],
   serialized_start=155,
-  serialized_end=1921,
+  serialized_end=1918,
 )
 
 
@@ -465,8 +465,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1923,
-  serialized_end=2016,
+  serialized_start=1920,
+  serialized_end=2013,
 )
 
 _MESHCONFIG_OUTBOUNDTRAFFICPOLICY.fields_by_name['mode'].enum_type = _MESHCONFIG_OUTBOUNDTRAFFICPOLICY_MODE
diff --git a/python/istio_api/networking/v1alpha3/destination_rule_pb2.py b/python/istio_api/networking/v1alpha3/destination_rule_pb2.py
index e352885f81..23e08904dc 100644
--- a/python/istio_api/networking/v1alpha3/destination_rule_pb2.py
+++ b/python/istio_api/networking/v1alpha3/destination_rule_pb2.py
@@ -15,6 +15,7 @@
 
 from google.protobuf import duration_pb2 as google_dot_protobuf_dot_duration__pb2
 from networking.v1alpha3 import virtual_service_pb2 as networking_dot_v1alpha3_dot_virtual__service__pb2
+from networking.v1alpha3 import network_scope_pb2 as networking_dot_v1alpha3_dot_network__scope__pb2
 from gogoproto import gogo_pb2 as gogoproto_dot_gogo__pb2
 
 
@@ -22,9 +23,9 @@
   name='networking/v1alpha3/destination_rule.proto',
   package='istio.networking.v1alpha3',
   syntax='proto3',
-  serialized_pb=_b('\n*networking/v1alpha3/destination_rule.proto\x12\x19istio.networking.v1alpha3\x1a\x1egoogle/protobuf/duration.proto\x1a)networking/v1alpha3/virtual_service.proto\x1a\x14gogoproto/gogo.proto\"\x95\x01\n\x0f\x44\x65stinationRule\x12\x0c\n\x04host\x18\x01 \x01(\t\x12@\n\x0etraffic_policy\x18\x02 \x01(\x0b\x32(.istio.networking.v1alpha3.TrafficPolicy\x12\x32\n\x07subsets\x18\x03 \x03(\x0b\x32!.istio.networking.v1alpha3.Subset\"\xd7\x05\n\rTrafficPolicy\x12\x46\n\rload_balancer\x18\x01 \x01(\x0b\x32/.istio.networking.v1alpha3.LoadBalancerSettings\x12J\n\x0f\x63onnection_pool\x18\x02 \x01(\x0b\x32\x31.istio.networking.v1alpha3.ConnectionPoolSettings\x12\x46\n\x11outlier_detection\x18\x03 \x01(\x0b\x32+.istio.networking.v1alpha3.OutlierDetection\x12\x33\n\x03tls\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettings\x12W\n\x13port_level_settings\x18\x05 \x03(\x0b\x32:.istio.networking.v1alpha3.TrafficPolicy.PortTrafficPolicy\x1a\xdb\x02\n\x11PortTrafficPolicy\x12\x35\n\x04port\x18\x01 \x01(\x0b\x32\'.istio.networking.v1alpha3.PortSelector\x12\x46\n\rload_balancer\x18\x02 \x01(\x0b\x32/.istio.networking.v1alpha3.LoadBalancerSettings\x12J\n\x0f\x63onnection_pool\x18\x03 \x01(\x0b\x32\x31.istio.networking.v1alpha3.ConnectionPoolSettings\x12\x46\n\x11outlier_detection\x18\x04 \x01(\x0b\x32+.istio.networking.v1alpha3.OutlierDetection\x12\x33\n\x03tls\x18\x05 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettings\"\xc6\x01\n\x06Subset\x12\x0c\n\x04name\x18\x01 \x01(\t\x12=\n\x06labels\x18\x02 \x03(\x0b\x32-.istio.networking.v1alpha3.Subset.LabelsEntry\x12@\n\x0etraffic_policy\x18\x03 \x01(\x0b\x32(.istio.networking.v1alpha3.TrafficPolicy\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xc3\x04\n\x14LoadBalancerSettings\x12J\n\x06simple\x18\x01 \x01(\x0e\x32\x38.istio.networking.v1alpha3.LoadBalancerSettings.SimpleLBH\x00\x12[\n\x0f\x63onsistent_hash\x18\x02 \x01(\x0b\x32@.istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLBH\x00\x1a\xaa\x02\n\x10\x43onsistentHashLB\x12\x1a\n\x10http_header_name\x18\x01 \x01(\tH\x00\x12\x62\n\x0bhttp_cookie\x18\x02 \x01(\x0b\x32K.istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLB.HTTPCookieH\x00\x12\x17\n\ruse_source_ip\x18\x03 \x01(\x08H\x00\x12\x19\n\x11minimum_ring_size\x18\x04 \x01(\x04\x1aV\n\nHTTPCookie\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0c\n\x04path\x18\x02 \x01(\t\x12,\n\x03ttl\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x04\x98\xdf\x1f\x01\x42\n\n\x08hash_key\"H\n\x08SimpleLB\x12\x0f\n\x0bROUND_ROBIN\x10\x00\x12\x0e\n\nLEAST_CONN\x10\x01\x12\n\n\x06RANDOM\x10\x02\x12\x0f\n\x0bPASSTHROUGH\x10\x03\x42\x0b\n\tlb_policy\"\xf3\x04\n\x16\x43onnectionPoolSettings\x12J\n\x03tcp\x18\x01 \x01(\x0b\x32=.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings\x12L\n\x04http\x18\x02 \x01(\x0b\x32>.istio.networking.v1alpha3.ConnectionPoolSettings.HTTPSettings\x1a\xb3\x02\n\x0bTCPSettings\x12\x17\n\x0fmax_connections\x18\x01 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x61\n\rtcp_keepalive\x18\x03 \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepalive\x1at\n\x0cTcpKeepalive\x12\x0e\n\x06probes\x18\x01 \x01(\r\x12\'\n\x04time\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12+\n\x08interval\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x1a\x88\x01\n\x0cHTTPSettings\x12\"\n\x1ahttp1_max_pending_requests\x18\x01 \x01(\x05\x12\x1a\n\x12http2_max_requests\x18\x02 \x01(\x05\x12#\n\x1bmax_requests_per_connection\x18\x03 \x01(\x05\x12\x13\n\x0bmax_retries\x18\x04 \x01(\x05\"\xcc\x01\n\x10OutlierDetection\x12\x1a\n\x12\x63onsecutive_errors\x18\x01 \x01(\x05\x12+\n\x08interval\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x12\x62\x61se_ejection_time\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x1c\n\x14max_ejection_percent\x18\x04 \x01(\x05\x12\x1a\n\x12min_health_percent\x18\x05 \x01(\x05\"\xff\x01\n\x0bTLSSettings\x12<\n\x04mode\x18\x01 \x01(\x0e\x32..istio.networking.v1alpha3.TLSSettings.TLSmode\x12\x1a\n\x12\x63lient_certificate\x18\x02 \x01(\t\x12\x13\n\x0bprivate_key\x18\x03 \x01(\t\x12\x17\n\x0f\x63\x61_certificates\x18\x04 \x01(\t\x12\x19\n\x11subject_alt_names\x18\x05 \x03(\t\x12\x0b\n\x03sni\x18\x06 \x01(\t\"@\n\x07TLSmode\x12\x0b\n\x07\x44ISABLE\x10\x00\x12\n\n\x06SIMPLE\x10\x01\x12\n\n\x06MUTUAL\x10\x02\x12\x10\n\x0cISTIO_MUTUAL\x10\x03\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
+  serialized_pb=_b('\n*networking/v1alpha3/destination_rule.proto\x12\x19istio.networking.v1alpha3\x1a\x1egoogle/protobuf/duration.proto\x1a)networking/v1alpha3/virtual_service.proto\x1a\'networking/v1alpha3/network_scope.proto\x1a\x14gogoproto/gogo.proto\"\xd3\x01\n\x0f\x44\x65stinationRule\x12\x0c\n\x04host\x18\x01 \x01(\t\x12@\n\x0etraffic_policy\x18\x02 \x01(\x0b\x32(.istio.networking.v1alpha3.TrafficPolicy\x12\x32\n\x07subsets\x18\x03 \x03(\x0b\x32!.istio.networking.v1alpha3.Subset\x12<\n\x0c\x63onfig_scope\x18\x04 \x01(\x0e\x32&.istio.networking.v1alpha3.ConfigScope\"\xd7\x05\n\rTrafficPolicy\x12\x46\n\rload_balancer\x18\x01 \x01(\x0b\x32/.istio.networking.v1alpha3.LoadBalancerSettings\x12J\n\x0f\x63onnection_pool\x18\x02 \x01(\x0b\x32\x31.istio.networking.v1alpha3.ConnectionPoolSettings\x12\x46\n\x11outlier_detection\x18\x03 \x01(\x0b\x32+.istio.networking.v1alpha3.OutlierDetection\x12\x33\n\x03tls\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettings\x12W\n\x13port_level_settings\x18\x05 \x03(\x0b\x32:.istio.networking.v1alpha3.TrafficPolicy.PortTrafficPolicy\x1a\xdb\x02\n\x11PortTrafficPolicy\x12\x35\n\x04port\x18\x01 \x01(\x0b\x32\'.istio.networking.v1alpha3.PortSelector\x12\x46\n\rload_balancer\x18\x02 \x01(\x0b\x32/.istio.networking.v1alpha3.LoadBalancerSettings\x12J\n\x0f\x63onnection_pool\x18\x03 \x01(\x0b\x32\x31.istio.networking.v1alpha3.ConnectionPoolSettings\x12\x46\n\x11outlier_detection\x18\x04 \x01(\x0b\x32+.istio.networking.v1alpha3.OutlierDetection\x12\x33\n\x03tls\x18\x05 \x01(\x0b\x32&.istio.networking.v1alpha3.TLSSettings\"\xc6\x01\n\x06Subset\x12\x0c\n\x04name\x18\x01 \x01(\t\x12=\n\x06labels\x18\x02 \x03(\x0b\x32-.istio.networking.v1alpha3.Subset.LabelsEntry\x12@\n\x0etraffic_policy\x18\x03 \x01(\x0b\x32(.istio.networking.v1alpha3.TrafficPolicy\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xc3\x04\n\x14LoadBalancerSettings\x12J\n\x06simple\x18\x01 \x01(\x0e\x32\x38.istio.networking.v1alpha3.LoadBalancerSettings.SimpleLBH\x00\x12[\n\x0f\x63onsistent_hash\x18\x02 \x01(\x0b\x32@.istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLBH\x00\x1a\xaa\x02\n\x10\x43onsistentHashLB\x12\x1a\n\x10http_header_name\x18\x01 \x01(\tH\x00\x12\x62\n\x0bhttp_cookie\x18\x02 \x01(\x0b\x32K.istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLB.HTTPCookieH\x00\x12\x17\n\ruse_source_ip\x18\x03 \x01(\x08H\x00\x12\x19\n\x11minimum_ring_size\x18\x04 \x01(\x04\x1aV\n\nHTTPCookie\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0c\n\x04path\x18\x02 \x01(\t\x12,\n\x03ttl\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x04\x98\xdf\x1f\x01\x42\n\n\x08hash_key\"H\n\x08SimpleLB\x12\x0f\n\x0bROUND_ROBIN\x10\x00\x12\x0e\n\nLEAST_CONN\x10\x01\x12\n\n\x06RANDOM\x10\x02\x12\x0f\n\x0bPASSTHROUGH\x10\x03\x42\x0b\n\tlb_policy\"\xf3\x04\n\x16\x43onnectionPoolSettings\x12J\n\x03tcp\x18\x01 \x01(\x0b\x32=.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings\x12L\n\x04http\x18\x02 \x01(\x0b\x32>.istio.networking.v1alpha3.ConnectionPoolSettings.HTTPSettings\x1a\xb3\x02\n\x0bTCPSettings\x12\x17\n\x0fmax_connections\x18\x01 \x01(\x05\x12\x32\n\x0f\x63onnect_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x61\n\rtcp_keepalive\x18\x03 \x01(\x0b\x32J.istio.networking.v1alpha3.ConnectionPoolSettings.TCPSettings.TcpKeepalive\x1at\n\x0cTcpKeepalive\x12\x0e\n\x06probes\x18\x01 \x01(\r\x12\'\n\x04time\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12+\n\x08interval\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x1a\x88\x01\n\x0cHTTPSettings\x12\"\n\x1ahttp1_max_pending_requests\x18\x01 \x01(\x05\x12\x1a\n\x12http2_max_requests\x18\x02 \x01(\x05\x12#\n\x1bmax_requests_per_connection\x18\x03 \x01(\x05\x12\x13\n\x0bmax_retries\x18\x04 \x01(\x05\"\xcc\x01\n\x10OutlierDetection\x12\x1a\n\x12\x63onsecutive_errors\x18\x01 \x01(\x05\x12+\n\x08interval\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x12\x62\x61se_ejection_time\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x1c\n\x14max_ejection_percent\x18\x04 \x01(\x05\x12\x1a\n\x12min_health_percent\x18\x05 \x01(\x05\"\xff\x01\n\x0bTLSSettings\x12<\n\x04mode\x18\x01 \x01(\x0e\x32..istio.networking.v1alpha3.TLSSettings.TLSmode\x12\x1a\n\x12\x63lient_certificate\x18\x02 \x01(\t\x12\x13\n\x0bprivate_key\x18\x03 \x01(\t\x12\x17\n\x0f\x63\x61_certificates\x18\x04 \x01(\t\x12\x19\n\x11subject_alt_names\x18\x05 \x03(\t\x12\x0b\n\x03sni\x18\x06 \x01(\t\"@\n\x07TLSmode\x12\x0b\n\x07\x44ISABLE\x10\x00\x12\n\n\x06SIMPLE\x10\x01\x12\n\n\x06MUTUAL\x10\x02\x12\x10\n\x0cISTIO_MUTUAL\x10\x03\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
   ,
-  dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_virtual__service__pb2.DESCRIPTOR,gogoproto_dot_gogo__pb2.DESCRIPTOR,])
+  dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_virtual__service__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_network__scope__pb2.DESCRIPTOR,gogoproto_dot_gogo__pb2.DESCRIPTOR,])
 
 
 
@@ -53,8 +54,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=1748,
-  serialized_end=1820,
+  serialized_start=1851,
+  serialized_end=1923,
 )
 _sym_db.RegisterEnumDescriptor(_LOADBALANCERSETTINGS_SIMPLELB)
 
@@ -83,8 +84,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=2864,
-  serialized_end=2928,
+  serialized_start=2967,
+  serialized_end=3031,
 )
 _sym_db.RegisterEnumDescriptor(_TLSSETTINGS_TLSMODE)
 
@@ -117,6 +118,13 @@
       message_type=None, enum_type=None, containing_type=None,
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='config_scope', full_name='istio.networking.v1alpha3.DestinationRule.config_scope', index=3,
+      number=4, type=14, cpp_type=8, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
   ],
   extensions=[
   ],
@@ -129,8 +137,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=171,
-  serialized_end=320,
+  serialized_start=212,
+  serialized_end=423,
 )
 
 
@@ -188,8 +196,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=703,
-  serialized_end=1050,
+  serialized_start=806,
+  serialized_end=1153,
 )
 
 _TRAFFICPOLICY = _descriptor.Descriptor(
@@ -246,8 +254,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=323,
-  serialized_end=1050,
+  serialized_start=426,
+  serialized_end=1153,
 )
 
 
@@ -284,8 +292,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1206,
-  serialized_end=1251,
+  serialized_start=1309,
+  serialized_end=1354,
 )
 
 _SUBSET = _descriptor.Descriptor(
@@ -328,8 +336,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1053,
-  serialized_end=1251,
+  serialized_start=1156,
+  serialized_end=1354,
 )
 
 
@@ -373,8 +381,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1648,
-  serialized_end=1734,
+  serialized_start=1751,
+  serialized_end=1837,
 )
 
 _LOADBALANCERSETTINGS_CONSISTENTHASHLB = _descriptor.Descriptor(
@@ -427,8 +435,8 @@
       name='hash_key', full_name='istio.networking.v1alpha3.LoadBalancerSettings.ConsistentHashLB.hash_key',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=1448,
-  serialized_end=1746,
+  serialized_start=1551,
+  serialized_end=1849,
 )
 
 _LOADBALANCERSETTINGS = _descriptor.Descriptor(
@@ -468,8 +476,8 @@
       name='lb_policy', full_name='istio.networking.v1alpha3.LoadBalancerSettings.lb_policy',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=1254,
-  serialized_end=1833,
+  serialized_start=1357,
+  serialized_end=1936,
 )
 
 
@@ -513,8 +521,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2208,
-  serialized_end=2324,
+  serialized_start=2311,
+  serialized_end=2427,
 )
 
 _CONNECTIONPOOLSETTINGS_TCPSETTINGS = _descriptor.Descriptor(
@@ -557,8 +565,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2017,
-  serialized_end=2324,
+  serialized_start=2120,
+  serialized_end=2427,
 )
 
 _CONNECTIONPOOLSETTINGS_HTTPSETTINGS = _descriptor.Descriptor(
@@ -608,8 +616,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2327,
-  serialized_end=2463,
+  serialized_start=2430,
+  serialized_end=2566,
 )
 
 _CONNECTIONPOOLSETTINGS = _descriptor.Descriptor(
@@ -645,8 +653,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1836,
-  serialized_end=2463,
+  serialized_start=1939,
+  serialized_end=2566,
 )
 
 
@@ -704,8 +712,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2466,
-  serialized_end=2670,
+  serialized_start=2569,
+  serialized_end=2773,
 )
 
 
@@ -771,12 +779,13 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2673,
-  serialized_end=2928,
+  serialized_start=2776,
+  serialized_end=3031,
 )
 
 _DESTINATIONRULE.fields_by_name['traffic_policy'].message_type = _TRAFFICPOLICY
 _DESTINATIONRULE.fields_by_name['subsets'].message_type = _SUBSET
+_DESTINATIONRULE.fields_by_name['config_scope'].enum_type = networking_dot_v1alpha3_dot_network__scope__pb2._CONFIGSCOPE
 _TRAFFICPOLICY_PORTTRAFFICPOLICY.fields_by_name['port'].message_type = networking_dot_v1alpha3_dot_virtual__service__pb2._PORTSELECTOR
 _TRAFFICPOLICY_PORTTRAFFICPOLICY.fields_by_name['load_balancer'].message_type = _LOADBALANCERSETTINGS
 _TRAFFICPOLICY_PORTTRAFFICPOLICY.fields_by_name['connection_pool'].message_type = _CONNECTIONPOOLSETTINGS
diff --git a/python/istio_api/networking/v1alpha3/network_scope_pb2.py b/python/istio_api/networking/v1alpha3/network_scope_pb2.py
index 62d0fdbb76..2fd1a36238 100644
--- a/python/istio_api/networking/v1alpha3/network_scope_pb2.py
+++ b/python/istio_api/networking/v1alpha3/network_scope_pb2.py
@@ -20,7 +20,7 @@
   name='networking/v1alpha3/network_scope.proto',
   package='istio.networking.v1alpha3',
   syntax='proto3',
-  serialized_pb=_b('\n\'networking/v1alpha3/network_scope.proto\x12\x19istio.networking.v1alpha3\"\xd2\x01\n\x0cNetworkScope\x12H\n\x0c\x64\x65pendencies\x18\x01 \x03(\x0b\x32\x32.istio.networking.v1alpha3.NetworkScope.Dependency\x1a)\n\x06Import\x12\x11\n\tnamespace\x18\x01 \x01(\t\x12\x0c\n\x04host\x18\x02 \x01(\t\x1aM\n\nDependency\x12?\n\x07imports\x18\x02 \x03(\x0b\x32..istio.networking.v1alpha3.NetworkScope.Import*&\n\x0b\x43onfigScope\x12\n\n\x06PUBLIC\x10\x00\x12\x0b\n\x07PRIVATE\x10\x01\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
+  serialized_pb=_b('\n\'networking/v1alpha3/network_scope.proto\x12\x19istio.networking.v1alpha3\"\xfe\x02\n\x0cNetworkScope\x12H\n\x0c\x64\x65pendencies\x18\x01 \x03(\x0b\x32\x32.istio.networking.v1alpha3.NetworkScope.Dependency\x1a)\n\x06Import\x12\x11\n\tnamespace\x18\x01 \x01(\t\x12\x0c\n\x04host\x18\x02 \x01(\t\x1a\xf8\x01\n\nDependency\x12l\n\x16source_workload_labels\x18\x01 \x03(\x0b\x32L.istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry\x12?\n\x07imports\x18\x02 \x03(\x0b\x32..istio.networking.v1alpha3.NetworkScope.Import\x1a;\n\x19SourceWorkloadLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01*&\n\x0b\x43onfigScope\x12\n\n\x06PUBLIC\x10\x00\x12\x0b\n\x07PRIVATE\x10\x01\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
 )
 
 _CONFIGSCOPE = _descriptor.EnumDescriptor(
@@ -40,8 +40,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=283,
-  serialized_end=321,
+  serialized_start=455,
+  serialized_end=493,
 )
 _sym_db.RegisterEnumDescriptor(_CONFIGSCOPE)
 
@@ -88,6 +88,43 @@
   serialized_end=202,
 )
 
+_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY = _descriptor.Descriptor(
+  name='SourceWorkloadLabelsEntry',
+  full_name='istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='key', full_name='istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry.key', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='value', full_name='istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry.value', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=_b("").decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  options=_descriptor._ParseOptions(descriptor_pb2.MessageOptions(), _b('8\001')),
+  is_extendable=False,
+  syntax='proto3',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=394,
+  serialized_end=453,
+)
+
 _NETWORKSCOPE_DEPENDENCY = _descriptor.Descriptor(
   name='Dependency',
   full_name='istio.networking.v1alpha3.NetworkScope.Dependency',
@@ -96,7 +133,14 @@
   containing_type=None,
   fields=[
     _descriptor.FieldDescriptor(
-      name='imports', full_name='istio.networking.v1alpha3.NetworkScope.Dependency.imports', index=0,
+      name='source_workload_labels', full_name='istio.networking.v1alpha3.NetworkScope.Dependency.source_workload_labels', index=0,
+      number=1, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      options=None, file=DESCRIPTOR),
+    _descriptor.FieldDescriptor(
+      name='imports', full_name='istio.networking.v1alpha3.NetworkScope.Dependency.imports', index=1,
       number=2, type=11, cpp_type=10, label=3,
       has_default_value=False, default_value=[],
       message_type=None, enum_type=None, containing_type=None,
@@ -105,7 +149,7 @@
   ],
   extensions=[
   ],
-  nested_types=[],
+  nested_types=[_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY, ],
   enum_types=[
   ],
   options=None,
@@ -114,8 +158,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=204,
-  serialized_end=281,
+  serialized_start=205,
+  serialized_end=453,
 )
 
 _NETWORKSCOPE = _descriptor.Descriptor(
@@ -145,10 +189,12 @@
   oneofs=[
   ],
   serialized_start=71,
-  serialized_end=281,
+  serialized_end=453,
 )
 
 _NETWORKSCOPE_IMPORT.containing_type = _NETWORKSCOPE
+_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY.containing_type = _NETWORKSCOPE_DEPENDENCY
+_NETWORKSCOPE_DEPENDENCY.fields_by_name['source_workload_labels'].message_type = _NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY
 _NETWORKSCOPE_DEPENDENCY.fields_by_name['imports'].message_type = _NETWORKSCOPE_IMPORT
 _NETWORKSCOPE_DEPENDENCY.containing_type = _NETWORKSCOPE
 _NETWORKSCOPE.fields_by_name['dependencies'].message_type = _NETWORKSCOPE_DEPENDENCY
@@ -166,6 +212,13 @@
   ,
 
   Dependency = _reflection.GeneratedProtocolMessageType('Dependency', (_message.Message,), dict(
+
+    SourceWorkloadLabelsEntry = _reflection.GeneratedProtocolMessageType('SourceWorkloadLabelsEntry', (_message.Message,), dict(
+      DESCRIPTOR = _NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY,
+      __module__ = 'networking.v1alpha3.network_scope_pb2'
+      # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.NetworkScope.Dependency.SourceWorkloadLabelsEntry)
+      ))
+    ,
     DESCRIPTOR = _NETWORKSCOPE_DEPENDENCY,
     __module__ = 'networking.v1alpha3.network_scope_pb2'
     # @@protoc_insertion_point(class_scope:istio.networking.v1alpha3.NetworkScope.Dependency)
@@ -178,8 +231,11 @@
 _sym_db.RegisterMessage(NetworkScope)
 _sym_db.RegisterMessage(NetworkScope.Import)
 _sym_db.RegisterMessage(NetworkScope.Dependency)
+_sym_db.RegisterMessage(NetworkScope.Dependency.SourceWorkloadLabelsEntry)
 
 
 DESCRIPTOR.has_options = True
 DESCRIPTOR._options = _descriptor._ParseOptions(descriptor_pb2.FileOptions(), _b('Z istio.io/api/networking/v1alpha3'))
+_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY.has_options = True
+_NETWORKSCOPE_DEPENDENCY_SOURCEWORKLOADLABELSENTRY._options = _descriptor._ParseOptions(descriptor_pb2.MessageOptions(), _b('8\001'))
 # @@protoc_insertion_point(module_scope)
diff --git a/python/istio_api/networking/v1alpha3/service_entry_pb2.py b/python/istio_api/networking/v1alpha3/service_entry_pb2.py
index 3e3d1001bc..b9d58bd667 100644
--- a/python/istio_api/networking/v1alpha3/service_entry_pb2.py
+++ b/python/istio_api/networking/v1alpha3/service_entry_pb2.py
@@ -21,7 +21,7 @@
   name='networking/v1alpha3/service_entry.proto',
   package='istio.networking.v1alpha3',
   syntax='proto3',
-  serialized_pb=_b('\n\'networking/v1alpha3/service_entry.proto\x12\x19istio.networking.v1alpha3\x1a!networking/v1alpha3/gateway.proto\x1a\'networking/v1alpha3/network_scope.proto\"\x8f\x06\n\x0cServiceEntry\x12\r\n\x05hosts\x18\x01 \x03(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12.\n\x05ports\x18\x03 \x03(\x0b\x32\x1f.istio.networking.v1alpha3.Port\x12\x42\n\x08location\x18\x04 \x01(\x0e\x32\x30.istio.networking.v1alpha3.ServiceEntry.Location\x12\x46\n\nresolution\x18\x05 \x01(\x0e\x32\x32.istio.networking.v1alpha3.ServiceEntry.Resolution\x12\x43\n\tendpoints\x18\x06 \x03(\x0b\x32\x30.istio.networking.v1alpha3.ServiceEntry.Endpoint\x12\x35\n\x05scope\x18\x07 \x01(\x0e\x32&.istio.networking.v1alpha3.ConfigScope\x1a\xc5\x02\n\x08\x45ndpoint\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12J\n\x05ports\x18\x02 \x03(\x0b\x32;.istio.networking.v1alpha3.ServiceEntry.Endpoint.PortsEntry\x12L\n\x06labels\x18\x03 \x03(\x0b\x32<.istio.networking.v1alpha3.ServiceEntry.Endpoint.LabelsEntry\x12\x0f\n\x07network\x18\x04 \x01(\t\x12\x10\n\x08locality\x18\x05 \x01(\t\x12\x0e\n\x06weight\x18\x06 \x01(\r\x1a,\n\nPortsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\r:\x02\x38\x01\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"0\n\x08Location\x12\x11\n\rMESH_EXTERNAL\x10\x00\x12\x11\n\rMESH_INTERNAL\x10\x01\"+\n\nResolution\x12\x08\n\x04NONE\x10\x00\x12\n\n\x06STATIC\x10\x01\x12\x07\n\x03\x44NS\x10\x02\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
+  serialized_pb=_b('\n\'networking/v1alpha3/service_entry.proto\x12\x19istio.networking.v1alpha3\x1a!networking/v1alpha3/gateway.proto\x1a\'networking/v1alpha3/network_scope.proto\"\x96\x06\n\x0cServiceEntry\x12\r\n\x05hosts\x18\x01 \x03(\t\x12\x11\n\taddresses\x18\x02 \x03(\t\x12.\n\x05ports\x18\x03 \x03(\x0b\x32\x1f.istio.networking.v1alpha3.Port\x12\x42\n\x08location\x18\x04 \x01(\x0e\x32\x30.istio.networking.v1alpha3.ServiceEntry.Location\x12\x46\n\nresolution\x18\x05 \x01(\x0e\x32\x32.istio.networking.v1alpha3.ServiceEntry.Resolution\x12\x43\n\tendpoints\x18\x06 \x03(\x0b\x32\x30.istio.networking.v1alpha3.ServiceEntry.Endpoint\x12<\n\x0c\x63onfig_scope\x18\x07 \x01(\x0e\x32&.istio.networking.v1alpha3.ConfigScope\x1a\xc5\x02\n\x08\x45ndpoint\x12\x0f\n\x07\x61\x64\x64ress\x18\x01 \x01(\t\x12J\n\x05ports\x18\x02 \x03(\x0b\x32;.istio.networking.v1alpha3.ServiceEntry.Endpoint.PortsEntry\x12L\n\x06labels\x18\x03 \x03(\x0b\x32<.istio.networking.v1alpha3.ServiceEntry.Endpoint.LabelsEntry\x12\x0f\n\x07network\x18\x04 \x01(\t\x12\x10\n\x08locality\x18\x05 \x01(\t\x12\x0e\n\x06weight\x18\x06 \x01(\r\x1a,\n\nPortsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\r:\x02\x38\x01\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"0\n\x08Location\x12\x11\n\rMESH_EXTERNAL\x10\x00\x12\x11\n\rMESH_INTERNAL\x10\x01\"+\n\nResolution\x12\x08\n\x04NONE\x10\x00\x12\n\n\x06STATIC\x10\x01\x12\x07\n\x03\x44NS\x10\x02\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
   ,
   dependencies=[networking_dot_v1alpha3_dot_gateway__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_network__scope__pb2.DESCRIPTOR,])
 
@@ -44,8 +44,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=837,
-  serialized_end=885,
+  serialized_start=844,
+  serialized_end=892,
 )
 _sym_db.RegisterEnumDescriptor(_SERVICEENTRY_LOCATION)
 
@@ -70,8 +70,8 @@
   ],
   containing_type=None,
   options=None,
-  serialized_start=887,
-  serialized_end=930,
+  serialized_start=894,
+  serialized_end=937,
 )
 _sym_db.RegisterEnumDescriptor(_SERVICEENTRY_RESOLUTION)
 
@@ -109,8 +109,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=744,
-  serialized_end=788,
+  serialized_start=751,
+  serialized_end=795,
 )
 
 _SERVICEENTRY_ENDPOINT_LABELSENTRY = _descriptor.Descriptor(
@@ -146,8 +146,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=790,
-  serialized_end=835,
+  serialized_start=797,
+  serialized_end=842,
 )
 
 _SERVICEENTRY_ENDPOINT = _descriptor.Descriptor(
@@ -211,8 +211,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=510,
-  serialized_end=835,
+  serialized_start=517,
+  serialized_end=842,
 )
 
 _SERVICEENTRY = _descriptor.Descriptor(
@@ -265,7 +265,7 @@
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='scope', full_name='istio.networking.v1alpha3.ServiceEntry.scope', index=6,
+      name='config_scope', full_name='istio.networking.v1alpha3.ServiceEntry.config_scope', index=6,
       number=7, type=14, cpp_type=8, label=1,
       has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
@@ -286,7 +286,7 @@
   oneofs=[
   ],
   serialized_start=147,
-  serialized_end=930,
+  serialized_end=937,
 )
 
 _SERVICEENTRY_ENDPOINT_PORTSENTRY.containing_type = _SERVICEENTRY_ENDPOINT
@@ -298,7 +298,7 @@
 _SERVICEENTRY.fields_by_name['location'].enum_type = _SERVICEENTRY_LOCATION
 _SERVICEENTRY.fields_by_name['resolution'].enum_type = _SERVICEENTRY_RESOLUTION
 _SERVICEENTRY.fields_by_name['endpoints'].message_type = _SERVICEENTRY_ENDPOINT
-_SERVICEENTRY.fields_by_name['scope'].enum_type = networking_dot_v1alpha3_dot_network__scope__pb2._CONFIGSCOPE
+_SERVICEENTRY.fields_by_name['config_scope'].enum_type = networking_dot_v1alpha3_dot_network__scope__pb2._CONFIGSCOPE
 _SERVICEENTRY_LOCATION.containing_type = _SERVICEENTRY
 _SERVICEENTRY_RESOLUTION.containing_type = _SERVICEENTRY
 DESCRIPTOR.message_types_by_name['ServiceEntry'] = _SERVICEENTRY
diff --git a/python/istio_api/networking/v1alpha3/virtual_service_pb2.py b/python/istio_api/networking/v1alpha3/virtual_service_pb2.py
index c61fc09a42..9a6433a753 100644
--- a/python/istio_api/networking/v1alpha3/virtual_service_pb2.py
+++ b/python/istio_api/networking/v1alpha3/virtual_service_pb2.py
@@ -22,7 +22,7 @@
   name='networking/v1alpha3/virtual_service.proto',
   package='istio.networking.v1alpha3',
   syntax='proto3',
-  serialized_pb=_b('\n)networking/v1alpha3/virtual_service.proto\x12\x19istio.networking.v1alpha3\x1a\x1egoogle/protobuf/duration.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a\'networking/v1alpha3/network_scope.proto\"\x80\x02\n\x0eVirtualService\x12\r\n\x05hosts\x18\x01 \x03(\t\x12\x10\n\x08gateways\x18\x02 \x03(\t\x12\x32\n\x04http\x18\x03 \x03(\x0b\x32$.istio.networking.v1alpha3.HTTPRoute\x12\x30\n\x03tls\x18\x05 \x03(\x0b\x32#.istio.networking.v1alpha3.TLSRoute\x12\x30\n\x03tcp\x18\x04 \x03(\x0b\x32#.istio.networking.v1alpha3.TCPRoute\x12\x35\n\x05scope\x18\x06 \x01(\x0e\x32&.istio.networking.v1alpha3.ConfigScope\"b\n\x0b\x44\x65stination\x12\x0c\n\x04host\x18\x01 \x01(\t\x12\x0e\n\x06subset\x18\x02 \x01(\t\x12\x35\n\x04port\x18\x03 \x01(\x0b\x32\'.istio.networking.v1alpha3.PortSelector\"\xf9\x08\n\tHTTPRoute\x12:\n\x05match\x18\x01 \x03(\x0b\x32+.istio.networking.v1alpha3.HTTPMatchRequest\x12>\n\x05route\x18\x02 \x03(\x0b\x32/.istio.networking.v1alpha3.HTTPRouteDestination\x12\x39\n\x08redirect\x18\x03 \x01(\x0b\x32\'.istio.networking.v1alpha3.HTTPRedirect\x12\x37\n\x07rewrite\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.HTTPRewrite\x12\x19\n\x11websocket_upgrade\x18\x05 \x01(\x08\x12*\n\x07timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x07retries\x18\x07 \x01(\x0b\x32$.istio.networking.v1alpha3.HTTPRetry\x12<\n\x05\x66\x61ult\x18\x08 \x01(\x0b\x32-.istio.networking.v1alpha3.HTTPFaultInjection\x12\x36\n\x06mirror\x18\t \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12:\n\x0b\x63ors_policy\x18\n \x01(\x0b\x32%.istio.networking.v1alpha3.CorsPolicy\x12S\n\x0e\x61ppend_headers\x18\x0b \x03(\x0b\x32\x37.istio.networking.v1alpha3.HTTPRoute.AppendHeadersEntryB\x02\x18\x01\x12#\n\x17remove_response_headers\x18\x0c \x03(\tB\x02\x18\x01\x12\x64\n\x17\x61ppend_response_headers\x18\r \x03(\x0b\x32?.istio.networking.v1alpha3.HTTPRoute.AppendResponseHeadersEntryB\x02\x18\x01\x12\"\n\x16remove_request_headers\x18\x0e \x03(\tB\x02\x18\x01\x12\x62\n\x16\x61ppend_request_headers\x18\x0f \x03(\x0b\x32>.istio.networking.v1alpha3.HTTPRoute.AppendRequestHeadersEntryB\x02\x18\x01\x12\x33\n\x07headers\x18\x10 \x01(\x0b\x32\".istio.networking.v1alpha3.Headers\x1a\x34\n\x12\x41ppendHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a<\n\x1a\x41ppendResponseHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a;\n\x19\x41ppendRequestHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xa9\x03\n\x07Headers\x12\x44\n\x07request\x18\x01 \x01(\x0b\x32\x33.istio.networking.v1alpha3.Headers.HeaderOperations\x12\x45\n\x08response\x18\x02 \x01(\x0b\x32\x33.istio.networking.v1alpha3.Headers.HeaderOperations\x1a\x90\x02\n\x10HeaderOperations\x12I\n\x03set\x18\x01 \x03(\x0b\x32<.istio.networking.v1alpha3.Headers.HeaderOperations.SetEntry\x12I\n\x03\x61\x64\x64\x18\x02 \x03(\x0b\x32<.istio.networking.v1alpha3.Headers.HeaderOperations.AddEntry\x12\x0e\n\x06remove\x18\x03 \x03(\t\x1a*\n\x08SetEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a*\n\x08\x41\x64\x64\x45ntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x84\x01\n\x08TLSRoute\x12<\n\x05match\x18\x01 \x03(\x0b\x32-.istio.networking.v1alpha3.TLSMatchAttributes\x12:\n\x05route\x18\x02 \x03(\x0b\x32+.istio.networking.v1alpha3.RouteDestination\"\x83\x01\n\x08TCPRoute\x12;\n\x05match\x18\x01 \x03(\x0b\x32,.istio.networking.v1alpha3.L4MatchAttributes\x12:\n\x05route\x18\x02 \x03(\x0b\x32+.istio.networking.v1alpha3.RouteDestination\"\xc0\x04\n\x10HTTPMatchRequest\x12\x33\n\x03uri\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x36\n\x06scheme\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x36\n\x06method\x18\x03 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x39\n\tauthority\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12I\n\x07headers\x18\x05 \x03(\x0b\x32\x38.istio.networking.v1alpha3.HTTPMatchRequest.HeadersEntry\x12\x0c\n\x04port\x18\x06 \x01(\r\x12T\n\rsource_labels\x18\x07 \x03(\x0b\x32=.istio.networking.v1alpha3.HTTPMatchRequest.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x08 \x03(\t\x1aV\n\x0cHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\x35\n\x05value\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch:\x02\x38\x01\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xbc\x04\n\x14HTTPRouteDestination\x12;\n\x0b\x64\x65stination\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12\x0e\n\x06weight\x18\x02 \x01(\x05\x12#\n\x17remove_response_headers\x18\x03 \x03(\tB\x02\x18\x01\x12o\n\x17\x61ppend_response_headers\x18\x04 \x03(\x0b\x32J.istio.networking.v1alpha3.HTTPRouteDestination.AppendResponseHeadersEntryB\x02\x18\x01\x12\"\n\x16remove_request_headers\x18\x05 \x03(\tB\x02\x18\x01\x12m\n\x16\x61ppend_request_headers\x18\x06 \x03(\x0b\x32I.istio.networking.v1alpha3.HTTPRouteDestination.AppendRequestHeadersEntryB\x02\x18\x01\x12\x33\n\x07headers\x18\x07 \x01(\x0b\x32\".istio.networking.v1alpha3.Headers\x1a<\n\x1a\x41ppendResponseHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a;\n\x19\x41ppendRequestHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"_\n\x10RouteDestination\x12;\n\x0b\x64\x65stination\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12\x0e\n\x06weight\x18\x02 \x01(\x05\"\xf3\x01\n\x11L4MatchAttributes\x12\x1b\n\x13\x64\x65stination_subnets\x18\x01 \x03(\t\x12\x0c\n\x04port\x18\x02 \x01(\r\x12\x15\n\rsource_subnet\x18\x03 \x01(\t\x12U\n\rsource_labels\x18\x04 \x03(\x0b\x32>.istio.networking.v1alpha3.L4MatchAttributes.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x05 \x03(\t\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x88\x02\n\x12TLSMatchAttributes\x12\x11\n\tsni_hosts\x18\x01 \x03(\t\x12\x1b\n\x13\x64\x65stination_subnets\x18\x02 \x03(\t\x12\x0c\n\x04port\x18\x03 \x01(\r\x12\x15\n\rsource_subnet\x18\x04 \x01(\t\x12V\n\rsource_labels\x18\x05 \x03(\x0b\x32?.istio.networking.v1alpha3.TLSMatchAttributes.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x06 \x03(\t\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\".\n\x0cHTTPRedirect\x12\x0b\n\x03uri\x18\x01 \x01(\t\x12\x11\n\tauthority\x18\x02 \x01(\t\"-\n\x0bHTTPRewrite\x12\x0b\n\x03uri\x18\x01 \x01(\t\x12\x11\n\tauthority\x18\x02 \x01(\t\"O\n\x0bStringMatch\x12\x0f\n\x05\x65xact\x18\x01 \x01(\tH\x00\x12\x10\n\x06prefix\x18\x02 \x01(\tH\x00\x12\x0f\n\x05regex\x18\x03 \x01(\tH\x00\x42\x0c\n\nmatch_type\"c\n\tHTTPRetry\x12\x10\n\x08\x61ttempts\x18\x01 \x01(\x05\x12\x32\n\x0fper_try_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x10\n\x08retry_on\x18\x03 \x01(\t\"\xcb\x01\n\nCorsPolicy\x12\x14\n\x0c\x61llow_origin\x18\x01 \x03(\t\x12\x15\n\rallow_methods\x18\x02 \x03(\t\x12\x15\n\rallow_headers\x18\x03 \x03(\t\x12\x16\n\x0e\x65xpose_headers\x18\x04 \x03(\t\x12*\n\x07max_age\x18\x05 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x11\x61llow_credentials\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.BoolValue\"\x9a\x04\n\x12HTTPFaultInjection\x12\x42\n\x05\x64\x65lay\x18\x01 \x01(\x0b\x32\x33.istio.networking.v1alpha3.HTTPFaultInjection.Delay\x12\x42\n\x05\x61\x62ort\x18\x02 \x01(\x0b\x32\x33.istio.networking.v1alpha3.HTTPFaultInjection.Abort\x1a\xd1\x01\n\x05\x44\x65lay\x12\x13\n\x07percent\x18\x01 \x01(\x05\x42\x02\x18\x01\x12\x30\n\x0b\x66ixed_delay\x18\x02 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12\x36\n\x11\x65xponential_delay\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12\x36\n\npercentage\x18\x05 \x01(\x0b\x32\".istio.networking.v1alpha3.PercentB\x11\n\x0fhttp_delay_type\x1a\xa7\x01\n\x05\x41\x62ort\x12\x13\n\x07percent\x18\x01 \x01(\x05\x42\x02\x18\x01\x12\x15\n\x0bhttp_status\x18\x02 \x01(\x05H\x00\x12\x15\n\x0bgrpc_status\x18\x03 \x01(\tH\x00\x12\x15\n\x0bhttp2_error\x18\x04 \x01(\tH\x00\x12\x36\n\npercentage\x18\x05 \x01(\x0b\x32\".istio.networking.v1alpha3.PercentB\x0c\n\nerror_type\"8\n\x0cPortSelector\x12\x10\n\x06number\x18\x01 \x01(\rH\x00\x12\x0e\n\x04name\x18\x02 \x01(\tH\x00\x42\x06\n\x04port\"\x18\n\x07Percent\x12\r\n\x05value\x18\x01 \x01(\x01\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
+  serialized_pb=_b('\n)networking/v1alpha3/virtual_service.proto\x12\x19istio.networking.v1alpha3\x1a\x1egoogle/protobuf/duration.proto\x1a\x1egoogle/protobuf/wrappers.proto\x1a\'networking/v1alpha3/network_scope.proto\"\x87\x02\n\x0eVirtualService\x12\r\n\x05hosts\x18\x01 \x03(\t\x12\x10\n\x08gateways\x18\x02 \x03(\t\x12\x32\n\x04http\x18\x03 \x03(\x0b\x32$.istio.networking.v1alpha3.HTTPRoute\x12\x30\n\x03tls\x18\x05 \x03(\x0b\x32#.istio.networking.v1alpha3.TLSRoute\x12\x30\n\x03tcp\x18\x04 \x03(\x0b\x32#.istio.networking.v1alpha3.TCPRoute\x12<\n\x0c\x63onfig_scope\x18\x06 \x01(\x0e\x32&.istio.networking.v1alpha3.ConfigScope\"b\n\x0b\x44\x65stination\x12\x0c\n\x04host\x18\x01 \x01(\t\x12\x0e\n\x06subset\x18\x02 \x01(\t\x12\x35\n\x04port\x18\x03 \x01(\x0b\x32\'.istio.networking.v1alpha3.PortSelector\"\xf9\x08\n\tHTTPRoute\x12:\n\x05match\x18\x01 \x03(\x0b\x32+.istio.networking.v1alpha3.HTTPMatchRequest\x12>\n\x05route\x18\x02 \x03(\x0b\x32/.istio.networking.v1alpha3.HTTPRouteDestination\x12\x39\n\x08redirect\x18\x03 \x01(\x0b\x32\'.istio.networking.v1alpha3.HTTPRedirect\x12\x37\n\x07rewrite\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.HTTPRewrite\x12\x19\n\x11websocket_upgrade\x18\x05 \x01(\x08\x12*\n\x07timeout\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x07retries\x18\x07 \x01(\x0b\x32$.istio.networking.v1alpha3.HTTPRetry\x12<\n\x05\x66\x61ult\x18\x08 \x01(\x0b\x32-.istio.networking.v1alpha3.HTTPFaultInjection\x12\x36\n\x06mirror\x18\t \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12:\n\x0b\x63ors_policy\x18\n \x01(\x0b\x32%.istio.networking.v1alpha3.CorsPolicy\x12S\n\x0e\x61ppend_headers\x18\x0b \x03(\x0b\x32\x37.istio.networking.v1alpha3.HTTPRoute.AppendHeadersEntryB\x02\x18\x01\x12#\n\x17remove_response_headers\x18\x0c \x03(\tB\x02\x18\x01\x12\x64\n\x17\x61ppend_response_headers\x18\r \x03(\x0b\x32?.istio.networking.v1alpha3.HTTPRoute.AppendResponseHeadersEntryB\x02\x18\x01\x12\"\n\x16remove_request_headers\x18\x0e \x03(\tB\x02\x18\x01\x12\x62\n\x16\x61ppend_request_headers\x18\x0f \x03(\x0b\x32>.istio.networking.v1alpha3.HTTPRoute.AppendRequestHeadersEntryB\x02\x18\x01\x12\x33\n\x07headers\x18\x10 \x01(\x0b\x32\".istio.networking.v1alpha3.Headers\x1a\x34\n\x12\x41ppendHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a<\n\x1a\x41ppendResponseHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a;\n\x19\x41ppendRequestHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xa9\x03\n\x07Headers\x12\x44\n\x07request\x18\x01 \x01(\x0b\x32\x33.istio.networking.v1alpha3.Headers.HeaderOperations\x12\x45\n\x08response\x18\x02 \x01(\x0b\x32\x33.istio.networking.v1alpha3.Headers.HeaderOperations\x1a\x90\x02\n\x10HeaderOperations\x12I\n\x03set\x18\x01 \x03(\x0b\x32<.istio.networking.v1alpha3.Headers.HeaderOperations.SetEntry\x12I\n\x03\x61\x64\x64\x18\x02 \x03(\x0b\x32<.istio.networking.v1alpha3.Headers.HeaderOperations.AddEntry\x12\x0e\n\x06remove\x18\x03 \x03(\t\x1a*\n\x08SetEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a*\n\x08\x41\x64\x64\x45ntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x84\x01\n\x08TLSRoute\x12<\n\x05match\x18\x01 \x03(\x0b\x32-.istio.networking.v1alpha3.TLSMatchAttributes\x12:\n\x05route\x18\x02 \x03(\x0b\x32+.istio.networking.v1alpha3.RouteDestination\"\x83\x01\n\x08TCPRoute\x12;\n\x05match\x18\x01 \x03(\x0b\x32,.istio.networking.v1alpha3.L4MatchAttributes\x12:\n\x05route\x18\x02 \x03(\x0b\x32+.istio.networking.v1alpha3.RouteDestination\"\xc0\x04\n\x10HTTPMatchRequest\x12\x33\n\x03uri\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x36\n\x06scheme\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x36\n\x06method\x18\x03 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12\x39\n\tauthority\x18\x04 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch\x12I\n\x07headers\x18\x05 \x03(\x0b\x32\x38.istio.networking.v1alpha3.HTTPMatchRequest.HeadersEntry\x12\x0c\n\x04port\x18\x06 \x01(\r\x12T\n\rsource_labels\x18\x07 \x03(\x0b\x32=.istio.networking.v1alpha3.HTTPMatchRequest.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x08 \x03(\t\x1aV\n\x0cHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\x35\n\x05value\x18\x02 \x01(\x0b\x32&.istio.networking.v1alpha3.StringMatch:\x02\x38\x01\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xbc\x04\n\x14HTTPRouteDestination\x12;\n\x0b\x64\x65stination\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12\x0e\n\x06weight\x18\x02 \x01(\x05\x12#\n\x17remove_response_headers\x18\x03 \x03(\tB\x02\x18\x01\x12o\n\x17\x61ppend_response_headers\x18\x04 \x03(\x0b\x32J.istio.networking.v1alpha3.HTTPRouteDestination.AppendResponseHeadersEntryB\x02\x18\x01\x12\"\n\x16remove_request_headers\x18\x05 \x03(\tB\x02\x18\x01\x12m\n\x16\x61ppend_request_headers\x18\x06 \x03(\x0b\x32I.istio.networking.v1alpha3.HTTPRouteDestination.AppendRequestHeadersEntryB\x02\x18\x01\x12\x33\n\x07headers\x18\x07 \x01(\x0b\x32\".istio.networking.v1alpha3.Headers\x1a<\n\x1a\x41ppendResponseHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a;\n\x19\x41ppendRequestHeadersEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"_\n\x10RouteDestination\x12;\n\x0b\x64\x65stination\x18\x01 \x01(\x0b\x32&.istio.networking.v1alpha3.Destination\x12\x0e\n\x06weight\x18\x02 \x01(\x05\"\xf3\x01\n\x11L4MatchAttributes\x12\x1b\n\x13\x64\x65stination_subnets\x18\x01 \x03(\t\x12\x0c\n\x04port\x18\x02 \x01(\r\x12\x15\n\rsource_subnet\x18\x03 \x01(\t\x12U\n\rsource_labels\x18\x04 \x03(\x0b\x32>.istio.networking.v1alpha3.L4MatchAttributes.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x05 \x03(\t\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x88\x02\n\x12TLSMatchAttributes\x12\x11\n\tsni_hosts\x18\x01 \x03(\t\x12\x1b\n\x13\x64\x65stination_subnets\x18\x02 \x03(\t\x12\x0c\n\x04port\x18\x03 \x01(\r\x12\x15\n\rsource_subnet\x18\x04 \x01(\t\x12V\n\rsource_labels\x18\x05 \x03(\x0b\x32?.istio.networking.v1alpha3.TLSMatchAttributes.SourceLabelsEntry\x12\x10\n\x08gateways\x18\x06 \x03(\t\x1a\x33\n\x11SourceLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\".\n\x0cHTTPRedirect\x12\x0b\n\x03uri\x18\x01 \x01(\t\x12\x11\n\tauthority\x18\x02 \x01(\t\"-\n\x0bHTTPRewrite\x12\x0b\n\x03uri\x18\x01 \x01(\t\x12\x11\n\tauthority\x18\x02 \x01(\t\"O\n\x0bStringMatch\x12\x0f\n\x05\x65xact\x18\x01 \x01(\tH\x00\x12\x10\n\x06prefix\x18\x02 \x01(\tH\x00\x12\x0f\n\x05regex\x18\x03 \x01(\tH\x00\x42\x0c\n\nmatch_type\"c\n\tHTTPRetry\x12\x10\n\x08\x61ttempts\x18\x01 \x01(\x05\x12\x32\n\x0fper_try_timeout\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x10\n\x08retry_on\x18\x03 \x01(\t\"\xcb\x01\n\nCorsPolicy\x12\x14\n\x0c\x61llow_origin\x18\x01 \x03(\t\x12\x15\n\rallow_methods\x18\x02 \x03(\t\x12\x15\n\rallow_headers\x18\x03 \x03(\t\x12\x16\n\x0e\x65xpose_headers\x18\x04 \x03(\t\x12*\n\x07max_age\x18\x05 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x35\n\x11\x61llow_credentials\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.BoolValue\"\x9a\x04\n\x12HTTPFaultInjection\x12\x42\n\x05\x64\x65lay\x18\x01 \x01(\x0b\x32\x33.istio.networking.v1alpha3.HTTPFaultInjection.Delay\x12\x42\n\x05\x61\x62ort\x18\x02 \x01(\x0b\x32\x33.istio.networking.v1alpha3.HTTPFaultInjection.Abort\x1a\xd1\x01\n\x05\x44\x65lay\x12\x13\n\x07percent\x18\x01 \x01(\x05\x42\x02\x18\x01\x12\x30\n\x0b\x66ixed_delay\x18\x02 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12\x36\n\x11\x65xponential_delay\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationH\x00\x12\x36\n\npercentage\x18\x05 \x01(\x0b\x32\".istio.networking.v1alpha3.PercentB\x11\n\x0fhttp_delay_type\x1a\xa7\x01\n\x05\x41\x62ort\x12\x13\n\x07percent\x18\x01 \x01(\x05\x42\x02\x18\x01\x12\x15\n\x0bhttp_status\x18\x02 \x01(\x05H\x00\x12\x15\n\x0bgrpc_status\x18\x03 \x01(\tH\x00\x12\x15\n\x0bhttp2_error\x18\x04 \x01(\tH\x00\x12\x36\n\npercentage\x18\x05 \x01(\x0b\x32\".istio.networking.v1alpha3.PercentB\x0c\n\nerror_type\"8\n\x0cPortSelector\x12\x10\n\x06number\x18\x01 \x01(\rH\x00\x12\x0e\n\x04name\x18\x02 \x01(\tH\x00\x42\x06\n\x04port\"\x18\n\x07Percent\x12\r\n\x05value\x18\x01 \x01(\x01\x42\"Z istio.io/api/networking/v1alpha3b\x06proto3')
   ,
   dependencies=[google_dot_protobuf_dot_duration__pb2.DESCRIPTOR,google_dot_protobuf_dot_wrappers__pb2.DESCRIPTOR,networking_dot_v1alpha3_dot_network__scope__pb2.DESCRIPTOR,])
 
@@ -72,7 +72,7 @@
       is_extension=False, extension_scope=None,
       options=None, file=DESCRIPTOR),
     _descriptor.FieldDescriptor(
-      name='scope', full_name='istio.networking.v1alpha3.VirtualService.scope', index=5,
+      name='config_scope', full_name='istio.networking.v1alpha3.VirtualService.config_scope', index=5,
       number=6, type=14, cpp_type=8, label=1,
       has_default_value=False, default_value=0,
       message_type=None, enum_type=None, containing_type=None,
@@ -91,7 +91,7 @@
   oneofs=[
   ],
   serialized_start=178,
-  serialized_end=434,
+  serialized_end=441,
 )
 
 
@@ -135,8 +135,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=436,
-  serialized_end=534,
+  serialized_start=443,
+  serialized_end=541,
 )
 
 
@@ -173,8 +173,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1507,
-  serialized_end=1559,
+  serialized_start=1514,
+  serialized_end=1566,
 )
 
 _HTTPROUTE_APPENDRESPONSEHEADERSENTRY = _descriptor.Descriptor(
@@ -210,8 +210,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1561,
-  serialized_end=1621,
+  serialized_start=1568,
+  serialized_end=1628,
 )
 
 _HTTPROUTE_APPENDREQUESTHEADERSENTRY = _descriptor.Descriptor(
@@ -247,8 +247,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1623,
-  serialized_end=1682,
+  serialized_start=1630,
+  serialized_end=1689,
 )
 
 _HTTPROUTE = _descriptor.Descriptor(
@@ -382,8 +382,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=537,
-  serialized_end=1682,
+  serialized_start=544,
+  serialized_end=1689,
 )
 
 
@@ -420,8 +420,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2024,
-  serialized_end=2066,
+  serialized_start=2031,
+  serialized_end=2073,
 )
 
 _HEADERS_HEADEROPERATIONS_ADDENTRY = _descriptor.Descriptor(
@@ -457,8 +457,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2068,
-  serialized_end=2110,
+  serialized_start=2075,
+  serialized_end=2117,
 )
 
 _HEADERS_HEADEROPERATIONS = _descriptor.Descriptor(
@@ -501,8 +501,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1838,
-  serialized_end=2110,
+  serialized_start=1845,
+  serialized_end=2117,
 )
 
 _HEADERS = _descriptor.Descriptor(
@@ -538,8 +538,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1685,
-  serialized_end=2110,
+  serialized_start=1692,
+  serialized_end=2117,
 )
 
 
@@ -576,8 +576,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2113,
-  serialized_end=2245,
+  serialized_start=2120,
+  serialized_end=2252,
 )
 
 
@@ -614,8 +614,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2248,
-  serialized_end=2379,
+  serialized_start=2255,
+  serialized_end=2386,
 )
 
 
@@ -652,8 +652,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2819,
-  serialized_end=2905,
+  serialized_start=2826,
+  serialized_end=2912,
 )
 
 _HTTPMATCHREQUEST_SOURCELABELSENTRY = _descriptor.Descriptor(
@@ -689,8 +689,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2907,
-  serialized_end=2958,
+  serialized_start=2914,
+  serialized_end=2965,
 )
 
 _HTTPMATCHREQUEST = _descriptor.Descriptor(
@@ -768,8 +768,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2382,
-  serialized_end=2958,
+  serialized_start=2389,
+  serialized_end=2965,
 )
 
 
@@ -806,8 +806,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1561,
-  serialized_end=1621,
+  serialized_start=1568,
+  serialized_end=1628,
 )
 
 _HTTPROUTEDESTINATION_APPENDREQUESTHEADERSENTRY = _descriptor.Descriptor(
@@ -843,8 +843,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=1623,
-  serialized_end=1682,
+  serialized_start=1630,
+  serialized_end=1689,
 )
 
 _HTTPROUTEDESTINATION = _descriptor.Descriptor(
@@ -915,8 +915,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2961,
-  serialized_end=3533,
+  serialized_start=2968,
+  serialized_end=3540,
 )
 
 
@@ -953,8 +953,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3535,
-  serialized_end=3630,
+  serialized_start=3542,
+  serialized_end=3637,
 )
 
 
@@ -991,8 +991,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2907,
-  serialized_end=2958,
+  serialized_start=2914,
+  serialized_end=2965,
 )
 
 _L4MATCHATTRIBUTES = _descriptor.Descriptor(
@@ -1049,8 +1049,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3633,
-  serialized_end=3876,
+  serialized_start=3640,
+  serialized_end=3883,
 )
 
 
@@ -1087,8 +1087,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=2907,
-  serialized_end=2958,
+  serialized_start=2914,
+  serialized_end=2965,
 )
 
 _TLSMATCHATTRIBUTES = _descriptor.Descriptor(
@@ -1152,8 +1152,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=3879,
-  serialized_end=4143,
+  serialized_start=3886,
+  serialized_end=4150,
 )
 
 
@@ -1190,8 +1190,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4145,
-  serialized_end=4191,
+  serialized_start=4152,
+  serialized_end=4198,
 )
 
 
@@ -1228,8 +1228,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4193,
-  serialized_end=4238,
+  serialized_start=4200,
+  serialized_end=4245,
 )
 
 
@@ -1276,8 +1276,8 @@
       name='match_type', full_name='istio.networking.v1alpha3.StringMatch.match_type',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=4240,
-  serialized_end=4319,
+  serialized_start=4247,
+  serialized_end=4326,
 )
 
 
@@ -1321,8 +1321,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4321,
-  serialized_end=4420,
+  serialized_start=4328,
+  serialized_end=4427,
 )
 
 
@@ -1387,8 +1387,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4423,
-  serialized_end=4626,
+  serialized_start=4430,
+  serialized_end=4633,
 )
 
 
@@ -1442,8 +1442,8 @@
       name='http_delay_type', full_name='istio.networking.v1alpha3.HTTPFaultInjection.Delay.http_delay_type',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=4788,
-  serialized_end=4997,
+  serialized_start=4795,
+  serialized_end=5004,
 )
 
 _HTTPFAULTINJECTION_ABORT = _descriptor.Descriptor(
@@ -1503,8 +1503,8 @@
       name='error_type', full_name='istio.networking.v1alpha3.HTTPFaultInjection.Abort.error_type',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=5000,
-  serialized_end=5167,
+  serialized_start=5007,
+  serialized_end=5174,
 )
 
 _HTTPFAULTINJECTION = _descriptor.Descriptor(
@@ -1540,8 +1540,8 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=4629,
-  serialized_end=5167,
+  serialized_start=4636,
+  serialized_end=5174,
 )
 
 
@@ -1581,8 +1581,8 @@
       name='port', full_name='istio.networking.v1alpha3.PortSelector.port',
       index=0, containing_type=None, fields=[]),
   ],
-  serialized_start=5169,
-  serialized_end=5225,
+  serialized_start=5176,
+  serialized_end=5232,
 )
 
 
@@ -1612,14 +1612,14 @@
   extension_ranges=[],
   oneofs=[
   ],
-  serialized_start=5227,
-  serialized_end=5251,
+  serialized_start=5234,
+  serialized_end=5258,
 )
 
 _VIRTUALSERVICE.fields_by_name['http'].message_type = _HTTPROUTE
 _VIRTUALSERVICE.fields_by_name['tls'].message_type = _TLSROUTE
 _VIRTUALSERVICE.fields_by_name['tcp'].message_type = _TCPROUTE
-_VIRTUALSERVICE.fields_by_name['scope'].enum_type = networking_dot_v1alpha3_dot_network__scope__pb2._CONFIGSCOPE
+_VIRTUALSERVICE.fields_by_name['config_scope'].enum_type = networking_dot_v1alpha3_dot_network__scope__pb2._CONFIGSCOPE
 _DESTINATION.fields_by_name['port'].message_type = _PORTSELECTOR
 _HTTPROUTE_APPENDHEADERSENTRY.containing_type = _HTTPROUTE
 _HTTPROUTE_APPENDRESPONSEHEADERSENTRY.containing_type = _HTTPROUTE