How to make an Istio EnvoyFfilter apply to two different workloads using workloadSelector

I've written an Istio EnvoyFilter. I need to apply this to multiple different workloads in my cluster. It already uses the workloadSelector property to choose one of these using the app label on the pod, but I can't see how to extend this to select multiple different pods with different app labels.

The initial filter looks like this:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: set-forwarded-port-header-filter
  namespace: ${NAMESPACE}
spec:
  workloadSelector:
    labels:
      app: app1
..etc

Solution

You could do that by creating a new label (e.g. filter: my-port-header-filter or something similar), then apply that label to all workloads you want to apply your filter to.

Then, deploy the EnvoyFilter with a workload selector with the new label to the Istio config root namespace (istio-system by default).

With the reason in the root config namespace, the filters will be applied to workloads across the cluster that have that specific label set.