Role of labels in istio's DestinationRule - kubernetes

Question

I am going through the traffic management section of istio 's documentation.
In a DestinationRule example, it configures several service subsets.
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: my-destination-rule
spec:
host: my-svc
trafficPolicy:
loadBalancer:
simple: RANDOM
subsets:
- name: v1
labels:
version: v1
- name: v2
labels:
version: v2
trafficPolicy:
loadBalancer:
simple: ROUND_ROBIN
- name: v3
labels:
version: v3
My question (since it is not clear on the documentation) is about the role of spec.subsets.name.labels
Do these labels refer to:
labels in the corresponding k8s Deployment ?
or
labels in the pods of the Deployment?
Where exactly (in terms of k8s manifests) do the above labels reside?

Answer 1

Istio sticks to the labeling paradigm on Kubernetes used to identify resources within the cluster.
Since this particular DestinationRule is intended to determine, at network level, which backends are to serve requests, is targeting pods in the Deployment instead of the Deployment itself (as that is an abstract resource without any network features).
A good example of this is in the Istio sample application repository:
The Deployment doesn't have any version: v1 labels. However, the pods grouped in it does:
apiVersion: apps/v1
kind: Deployment
metadata:
name: tcp-echo
spec:
replicas: 1
selector:
matchLabels:
app: tcp-echo
version: v1
template:
metadata:
labels:
app: tcp-echo
version: v1
spec:
containers:
- name: tcp-echo
image: docker.io/istio/tcp-echo-server:1.1
imagePullPolicy: IfNotPresent
args: [ "9000", "hello" ]
ports:
- containerPort: 9000
And the DestinationRule picks these objects by their version label:
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: tcp-echo-destination
spec:
host: tcp-echo
subsets:
- name: v1
labels:
version: v1
- name: v2
labels:
version: v2