diff --git a/content/zh/docs/ops/ambient/getting-started/index.md b/content/zh/docs/ops/ambient/getting-started/index.md
index 4aa6687534..9fa9533e66 100644
--- a/content/zh/docs/ops/ambient/getting-started/index.md
+++ b/content/zh/docs/ops/ambient/getting-started/index.md
@@ -302,19 +302,19 @@ $ kubectl apply -f - <<EOF
 apiVersion: security.istio.io/v1beta1
 kind: AuthorizationPolicy
 metadata:
- name: productpage-viewer
- namespace: default
+  name: productpage-viewer
+  namespace: default
 spec:
- selector:
-   matchLabels:
-     app: productpage
- action: ALLOW
- rules:
- - from:
-   - source:
-       principals:
-       - cluster.local/ns/default/sa/sleep
-       - cluster.local/$GATEWAY_SERVICE_ACCOUNT
+  selector:
+    matchLabels:
+      app: productpage
+  action: ALLOW
+  rules:
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/default/sa/sleep
+        - cluster.local/$GATEWAY_SERVICE_ACCOUNT
 EOF
 {{< /text >}}
 
@@ -374,22 +374,23 @@ $ kubectl apply -f - <<EOF
 apiVersion: security.istio.io/v1beta1
 kind: AuthorizationPolicy
 metadata:
- name: productpage-viewer
- namespace: default
+  name: productpage-viewer
+  namespace: default
 spec:
- selector:
-   matchLabels:
-     istio.io/gateway-name: bookinfo-productpage
- action: ALLOW
- rules:
- - from:
-   - source:
-       principals:
-       - cluster.local/ns/default/sa/sleep
-       - cluster.local/$GATEWAY_SERVICE_ACCOUNT
-   to:
-   - operation:
-       methods: ["GET"]
+  targetRef:
+    kind: Gateway
+    group: gateway.networking.k8s.io
+    name: bookinfo-productpage
+  action: ALLOW
+  rules:
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/default/sa/sleep
+        - cluster.local/$GATEWAY_SERVICE_ACCOUNT
+    to:
+    - operation:
+        methods: ["GET"]
 EOF
 {{< /text >}}
 
diff --git a/content/zh/docs/tasks/security/authentication/authn-policy/index.md b/content/zh/docs/tasks/security/authentication/authn-policy/index.md
index 5984083457..2860f4505a 100644
--- a/content/zh/docs/tasks/security/authentication/authn-policy/index.md
+++ b/content/zh/docs/tasks/security/authentication/authn-policy/index.md
@@ -420,9 +420,10 @@ metadata:
   name: "jwt-example"
   namespace: foo
 spec:
-  selector:
-    matchLabels:
-      istio.io/gateway-name: httpbin-gateway
+  targetRef:
+    kind: Gateway
+    group: gateway.networking.k8s.io
+    name: httpbin-gateway
   jwtRules:
   - issuer: "testing@secure.istio.io"
     jwksUri: "{{< github_file >}}/security/tools/jwt/samples/jwks.json"
@@ -541,9 +542,10 @@ metadata:
   name: "frontend-ingress"
   namespace: foo
 spec:
-  selector:
-    matchLabels:
-      istio.io/gateway-name: httpbin-gateway
+  targetRef:
+    kind: Gateway
+    group: gateway.networking.k8s.io
+    name: httpbin-gateway
   action: DENY
   rules:
   - from:
@@ -607,9 +609,10 @@ metadata:
   name: "frontend-ingress"
   namespace: foo
 spec:
-  selector:
-    matchLabels:
-      istio.io/gateway-name: httpbin-gateway
+  targetRef:
+    kind: Gateway
+    group: gateway.networking.k8s.io
+    name: httpbin-gateway
   action: DENY
   rules:
   - from:
diff --git a/content/zh/docs/tasks/security/authorization/authz-ingress/index.md b/content/zh/docs/tasks/security/authorization/authz-ingress/index.md
index 30ae2c9f62..8ff9497eaa 100644
--- a/content/zh/docs/tasks/security/authorization/authz-ingress/index.md
+++ b/content/zh/docs/tasks/security/authorization/authz-ingress/index.md
@@ -377,9 +377,10 @@ metadata:
   name: ingress-policy
   namespace: foo
 spec:
-  selector:
-    matchLabels:
-      istio.io/gateway-name: httpbin-gateway
+  targetRef:
+    kind: Gateway
+    group: gateway.networking.k8s.io
+    name: httpbin-gateway
   action: ALLOW
   rules:
   - from:
@@ -398,9 +399,10 @@ metadata:
   name: ingress-policy
   namespace: foo
 spec:
-  selector:
-    matchLabels:
-      istio.io/gateway-name: httpbin-gateway
+  targetRef:
+    kind: Gateway
+    group: gateway.networking.k8s.io
+    name: httpbin-gateway
   action: ALLOW
   rules:
   - from:
@@ -524,9 +526,10 @@ metadata:
   name: ingress-policy
   namespace: foo
 spec:
-  selector:
-    matchLabels:
-      istio.io/gateway-name: httpbin-gateway
+  targetRef:
+    kind: Gateway
+    group: gateway.networking.k8s.io
+    name: httpbin-gateway
   action: ALLOW
   rules:
   - from:
@@ -545,9 +548,10 @@ metadata:
   name: ingress-policy
   namespace: foo
 spec:
-  selector:
-    matchLabels:
-      istio.io/gateway-name: httpbin-gateway
+  targetRef:
+    kind: Gateway
+    group: gateway.networking.k8s.io
+    name: httpbin-gateway
   action: ALLOW
   rules:
   - from:
@@ -630,9 +634,10 @@ metadata:
   name: ingress-policy
   namespace: foo
 spec:
-  selector:
-    matchLabels:
-      istio.io/gateway-name: httpbin-gateway
+  targetRef:
+    kind: Gateway
+    group: gateway.networking.k8s.io
+    name: httpbin-gateway
   action: DENY
   rules:
   - from:
@@ -651,9 +656,10 @@ metadata:
   name: ingress-policy
   namespace: foo
 spec:
-  selector:
-    matchLabels:
-      istio.io/gateway-name: httpbin-gateway
+  targetRef:
+    kind: Gateway
+    group: gateway.networking.k8s.io
+    name: httpbin-gateway
   action: DENY
   rules:
   - from: