Whitelisting IP addresses for network traffic through Istio gateways

kubernetes istio whitelist

You confuse one thing that, in above rule, match: source.labels["app"] == "my-app" is not referring to any resource's label, but to pod's label.

sourceLabels | Refers to source pod labels. attributebindings can refer to this field using $out.sourcelabels

And you can verify by looking for resources with "app=istio-ingressgateway" label via:

kubectl get pods,svc -n istio-system -l "app=istio-ingressgateway" --show-labels

You can check this blog from istio about Mixer Adapter Model, to understand complete mixer model, its handlers,instances and rules.

Hope it helps!

CodeHunter