Introduce the TapByResource API (#778)

This changes the public api to have a new rpc type, `TapByResource`.
This api supersedes the Tap api. `TapByResource` is richer, more closely 
reflecting the proxy's capabilities.

The proxy's Tap api is extended to select over destination labels,
corresponding with those returned by the Destination api.

Now both `Tap` and `TapByResource`'s responses may include destination
labels.

This change avoids breaking backwards compatibility by:

* introducing the new `TapByResource` rpc type, opting not to change Tap
* extending the proxy's Match type with a new, optional, `destination_label` field.
* `TapEvent` is extended with a new, optional, `destination_meta`.

cli/cmd/tap.go

@@ -147,7 +147,7 @@ func writeTapEventsToBuffer(tapClient pb.Api_TapClient, w *tabwriter.Writer) err
 func renderTapEvent(event *common.TapEvent) string {
 	flow := fmt.Sprintf("src=%s dst=%s",
 		util.AddressToString(event.GetSource()),
-		util.AddressToString(event.GetTarget()),
+		util.AddressToString(event.GetDestination()),
 	)
 
 	http := event.GetHttp()

cli/cmd/tap_test.go

@@ -193,7 +193,7 @@ func TestEventToString(t *testing.T) {
 				Ip:   util.IPV4(1, 2, 3, 4),
 				Port: 5555,
 			},
-			Target: &common.TcpAddress{
+			Destination: &common.TcpAddress{
 				Ip:   util.IPV4(2, 3, 4, 5),
 				Port: 6666,
 			},
@@ -344,7 +344,7 @@ func createEvent(event_http *common.TapEvent_Http) common.TapEvent {
 				},
 			},
 		},
-		Target: &common.TcpAddress{
+		Destination: &common.TcpAddress{
 			Ip: &common.IPAddress{
 				Ip: &common.IPAddress_Ipv4{
 					Ipv4: uint32(9),

controller/api/public/client.go

@@ -76,6 +76,10 @@ func (c *grpcOverHttpClient) Tap(ctx context.Context, req *pb.TapRequest, _ ...g
 	return &tapClient{ctx: ctx, reader: bufio.NewReader(httpRsp.Body)}, nil
 }
 
+func (c *grpcOverHttpClient) TapByResource(ctx context.Context, req *pb.TapByResourceRequest, _ ...grpc.CallOption) (pb.Api_TapByResourceClient, error) {
+	return nil, fmt.Errorf("Unimplemented")
+}
+
 func (c *grpcOverHttpClient) apiRequest(ctx context.Context, endpoint string, req proto.Message, protoResponse proto.Message) error {
 	url := c.endpointNameToPublicApiUrl(endpoint)
 

controller/api/public/grpc_server.go

@@ -194,6 +194,29 @@ func (s *grpcServer) Tap(req *pb.TapRequest, stream pb.Api_TapServer) error {
 	}
 }
 
+// Pass through to tap service
+func (s *grpcServer) TapByResource(req *pb.TapByResourceRequest, stream pb.Api_TapByResourceServer) error {
+	tapStream := stream.(tapServer)
+	tapClient, err := s.tapClient.TapByResource(tapStream.Context(), req)
+	if err != nil {
+		//TODO: why not return the error?
+		log.Errorf("Unexpected error tapping [%v]: %v", req, err)
+		return nil
+	}
+	for {
+		select {
+		case <-tapStream.Context().Done():
+			return nil
+		default:
+			event, err := tapClient.Recv()
+			if err != nil {
+				return err
+			}
+			tapStream.Send(event)
+		}
+	}
+}
+
 func (s *grpcServer) shouldIgnore(pod *k8sV1.Pod) bool {
 	for _, namespace := range s.ignoredNamespaces {
 		if pod.Namespace == namespace {

controller/api/public/http_server_test.go

@@ -52,6 +52,17 @@ func (m *mockGrpcServer) Tap(req *pb.TapRequest, tapServer pb.Api_TapServer) err
 	return m.ErrorToReturn
 }
 
+func (m *mockGrpcServer) TapByResource(req *pb.TapByResourceRequest, tapServer pb.Api_TapByResourceServer) error {
+	m.LastRequestReceived = req
+	if m.ErrorToReturn == nil {
+		for _, msg := range m.TapStreamsToReturn {
+			tapServer.Send(msg)
+		}
+	}
+
+	return m.ErrorToReturn
+}
+
 type grpcCallTestCase struct {
 	expectedRequest  proto.Message
 	expectedResponse proto.Message
@@ -152,14 +163,14 @@ func TestServer(t *testing.T) {
 
 		expectedTapResponses := []*common.TapEvent{
 			{
-				Target: &common.TcpAddress{
+				Destination: &common.TcpAddress{
 					Port: 9999,
 				},
 				Source: &common.TcpAddress{
 					Port: 6666,
 				},
 			}, {
-				Target: &common.TcpAddress{
+				Destination: &common.TcpAddress{
 					Port: 2102,
 				},
 				Source: &common.TcpAddress{

controller/api/public/test_helper.go

@@ -14,12 +14,13 @@ import (
 )
 
 type MockConduitApiClient struct {
-	ErrorToReturn               error
+	ErrorToReturn                   error
-	VersionInfoToReturn         *pb.VersionInfo
+	VersionInfoToReturn             *pb.VersionInfo
-	ListPodsResponseToReturn    *pb.ListPodsResponse
+	ListPodsResponseToReturn        *pb.ListPodsResponse
-	StatSummaryResponseToReturn *pb.StatSummaryResponse
+	StatSummaryResponseToReturn     *pb.StatSummaryResponse
-	SelfCheckResponseToReturn   *healthcheckPb.SelfCheckResponse
+	SelfCheckResponseToReturn       *healthcheckPb.SelfCheckResponse
-	Api_TapClientToReturn       pb.Api_TapClient
+	Api_TapClientToReturn           pb.Api_TapClient
+	Api_TapByResourceClientToReturn pb.Api_TapByResourceClient
 }
 
 func (c *MockConduitApiClient) StatSummary(ctx context.Context, in *pb.StatSummaryRequest, opts ...grpc.CallOption) (*pb.StatSummaryResponse, error) {
@@ -38,6 +39,10 @@ func (c *MockConduitApiClient) Tap(ctx context.Context, in *pb.TapRequest, opts
 	return c.Api_TapClientToReturn, c.ErrorToReturn
 }
 
+func (c *MockConduitApiClient) TapByResource(ctx context.Context, in *pb.TapByResourceRequest, opts ...grpc.CallOption) (pb.Api_TapByResourceClient, error) {
+	return c.Api_TapByResourceClientToReturn, c.ErrorToReturn
+}
+
 func (c *MockConduitApiClient) SelfCheck(ctx context.Context, in *healthcheckPb.SelfCheckRequest, _ ...grpc.CallOption) (*healthcheckPb.SelfCheckResponse, error) {
 	return c.SelfCheckResponseToReturn, c.ErrorToReturn
 }

controller/gen/common/common.pb.go

@@ -635,8 +635,9 @@ func _Eos_OneofSizer(msg proto.Message) (n int) {
 }
 
 type TapEvent struct {
-	Source *TcpAddress `protobuf:"bytes,1,opt,name=source" json:"source,omitempty"`
+	Source          *TcpAddress            `protobuf:"bytes,1,opt,name=source" json:"source,omitempty"`
-	Target *TcpAddress `protobuf:"bytes,2,opt,name=target" json:"target,omitempty"`
+	Destination     *TcpAddress            `protobuf:"bytes,2,opt,name=destination" json:"destination,omitempty"`
+	DestinationMeta *TapEvent_EndpointMeta `protobuf:"bytes,4,opt,name=destination_meta,json=destinationMeta" json:"destination_meta,omitempty"`
 	// Types that are valid to be assigned to Event:
 	//	*TapEvent_Http_
 	Event isTapEvent_Event `protobuf_oneof:"event"`
@@ -669,9 +670,16 @@ func (m *TapEvent) GetSource() *TcpAddress {
 	return nil
 }
 
-func (m *TapEvent) GetTarget() *TcpAddress {
+func (m *TapEvent) GetDestination() *TcpAddress {
 	if m != nil {
-		return m.Target
+		return m.Destination
+	}
+	return nil
+}
+
+func (m *TapEvent) GetDestinationMeta() *TapEvent_EndpointMeta {
+	if m != nil {
+		return m.DestinationMeta
 	}
 	return nil
 }
@@ -738,6 +746,22 @@ func _TapEvent_OneofSizer(msg proto.Message) (n int) {
 	return n
 }
 
+type TapEvent_EndpointMeta struct {
+	Labels map[string]string `protobuf:"bytes,1,rep,name=labels" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+}
+
+func (m *TapEvent_EndpointMeta) Reset()                    { *m = TapEvent_EndpointMeta{} }
+func (m *TapEvent_EndpointMeta) String() string            { return proto.CompactTextString(m) }
+func (*TapEvent_EndpointMeta) ProtoMessage()               {}
+func (*TapEvent_EndpointMeta) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7, 0} }
+
+func (m *TapEvent_EndpointMeta) GetLabels() map[string]string {
+	if m != nil {
+		return m.Labels
+	}
+	return nil
+}
+
 type TapEvent_Http struct {
 	// Types that are valid to be assigned to Event:
 	//	*TapEvent_Http_RequestInit_
@@ -749,7 +773,7 @@ type TapEvent_Http struct {
 func (m *TapEvent_Http) Reset()                    { *m = TapEvent_Http{} }
 func (m *TapEvent_Http) String() string            { return proto.CompactTextString(m) }
 func (*TapEvent_Http) ProtoMessage()               {}
-func (*TapEvent_Http) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7, 0} }
+func (*TapEvent_Http) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7, 1} }
 
 type isTapEvent_Http_Event interface{ isTapEvent_Http_Event() }
 
@@ -898,7 +922,7 @@ type TapEvent_Http_StreamId struct {
 func (m *TapEvent_Http_StreamId) Reset()                    { *m = TapEvent_Http_StreamId{} }
 func (m *TapEvent_Http_StreamId) String() string            { return proto.CompactTextString(m) }
 func (*TapEvent_Http_StreamId) ProtoMessage()               {}
-func (*TapEvent_Http_StreamId) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7, 0, 0} }
+func (*TapEvent_Http_StreamId) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7, 1, 0} }
 
 func (m *TapEvent_Http_StreamId) GetBase() uint32 {
 	if m != nil {
@@ -925,7 +949,7 @@ type TapEvent_Http_RequestInit struct {
 func (m *TapEvent_Http_RequestInit) Reset()                    { *m = TapEvent_Http_RequestInit{} }
 func (m *TapEvent_Http_RequestInit) String() string            { return proto.CompactTextString(m) }
 func (*TapEvent_Http_RequestInit) ProtoMessage()               {}
-func (*TapEvent_Http_RequestInit) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7, 0, 1} }
+func (*TapEvent_Http_RequestInit) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7, 1, 1} }
 
 func (m *TapEvent_Http_RequestInit) GetId() *TapEvent_Http_StreamId {
 	if m != nil {
@@ -972,7 +996,7 @@ func (m *TapEvent_Http_ResponseInit) Reset()         { *m = TapEvent_Http_Respon
 func (m *TapEvent_Http_ResponseInit) String() string { return proto.CompactTextString(m) }
 func (*TapEvent_Http_ResponseInit) ProtoMessage()    {}
 func (*TapEvent_Http_ResponseInit) Descriptor() ([]byte, []int) {
-	return fileDescriptor0, []int{7, 0, 2}
+	return fileDescriptor0, []int{7, 1, 2}
 }
 
 func (m *TapEvent_Http_ResponseInit) GetId() *TapEvent_Http_StreamId {
@@ -1007,7 +1031,7 @@ type TapEvent_Http_ResponseEnd struct {
 func (m *TapEvent_Http_ResponseEnd) Reset()                    { *m = TapEvent_Http_ResponseEnd{} }
 func (m *TapEvent_Http_ResponseEnd) String() string            { return proto.CompactTextString(m) }
 func (*TapEvent_Http_ResponseEnd) ProtoMessage()               {}
-func (*TapEvent_Http_ResponseEnd) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7, 0, 3} }
+func (*TapEvent_Http_ResponseEnd) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7, 1, 3} }
 
 func (m *TapEvent_Http_ResponseEnd) GetId() *TapEvent_Http_StreamId {
 	if m != nil {
@@ -1053,6 +1077,7 @@ func init() {
 	proto.RegisterType((*Destination)(nil), "conduit.common.Destination")
 	proto.RegisterType((*Eos)(nil), "conduit.common.Eos")
 	proto.RegisterType((*TapEvent)(nil), "conduit.common.TapEvent")
+	proto.RegisterType((*TapEvent_EndpointMeta)(nil), "conduit.common.TapEvent.EndpointMeta")
 	proto.RegisterType((*TapEvent_Http)(nil), "conduit.common.TapEvent.Http")
 	proto.RegisterType((*TapEvent_Http_StreamId)(nil), "conduit.common.TapEvent.Http.StreamId")
 	proto.RegisterType((*TapEvent_Http_RequestInit)(nil), "conduit.common.TapEvent.Http.RequestInit")
@@ -1066,59 +1091,66 @@ func init() {
 func init() { proto.RegisterFile("common/common.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 863 bytes of a gzipped FileDescriptorProto
+	// 962 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xc4, 0x55, 0xcf, 0x6f, 0xe3, 0x44,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xc4, 0x55, 0xcf, 0x6e, 0xe3, 0xb6,
-	0x14, 0x8e, 0x1d, 0xc7, 0x49, 0x5e, 0xda, 0xca, 0x4c, 0xab, 0x55, 0x89, 0x58, 0xd8, 0x8d, 0x28,
+	0x13, 0xb6, 0xfe, 0x58, 0x8e, 0x47, 0x4e, 0x7e, 0xfa, 0x31, 0xc1, 0x22, 0x35, 0xba, 0x6d, 0xd6,
-	0xda, 0xf6, 0xe0, 0xa2, 0x2c, 0x8a, 0xc4, 0xb1, 0x49, 0xad, 0x26, 0x02, 0x5a, 0x33, 0x31, 0xe7,
+	0x68, 0x8a, 0x24, 0x07, 0xa5, 0xf5, 0x16, 0x46, 0xb7, 0xe8, 0x25, 0x76, 0x84, 0xd8, 0xe8, 0x6e,
-	0xc8, 0xb5, 0x67, 0x13, 0x4b, 0x8d, 0xc7, 0xcc, 0x8c, 0x2b, 0xf5, 0x9f, 0xe1, 0x0a, 0x47, 0xfe,
+	0xa2, 0xd2, 0xea, 0xd9, 0x90, 0x2d, 0x6e, 0x2c, 0xd4, 0x16, 0x55, 0x92, 0x0e, 0xe0, 0xf7, 0xe8,
-	0x1f, 0xfe, 0x0c, 0xc4, 0x1d, 0xcd, 0x8f, 0x38, 0x6e, 0x76, 0x69, 0x11, 0x1c, 0xf6, 0x94, 0x79,
+	0xad, 0x40, 0xaf, 0xbd, 0xf6, 0x7d, 0xfa, 0x18, 0x45, 0xef, 0x05, 0x29, 0x5a, 0x56, 0xb2, 0xbb,
-	0x6f, 0xbe, 0xf7, 0xe5, 0xfb, 0xe6, 0xcd, 0xf3, 0xc0, 0x61, 0x42, 0xd7, 0x6b, 0x9a, 0x9f, 0xeb,
+	0xd9, 0x45, 0x7b, 0xe8, 0x49, 0x9c, 0xe1, 0x37, 0x9f, 0xbe, 0xe1, 0x70, 0x86, 0xb0, 0x3f, 0xa3,
-	0x1f, 0xbf, 0x60, 0x54, 0x50, 0x74, 0x90, 0xd0, 0x3c, 0x2d, 0x33, 0xe1, 0xeb, 0x6c, 0xff, 0xf3,
+	0xcb, 0x25, 0xcd, 0xce, 0x8b, 0x8f, 0x9f, 0x33, 0x2a, 0x28, 0xda, 0x9b, 0xd1, 0x2c, 0x59, 0xa5,
-	0x25, 0xa5, 0xcb, 0x3b, 0x72, 0xae, 0x76, 0x6f, 0xcb, 0x77, 0xe7, 0x69, 0xc9, 0x62, 0x91, 0x6d,
+	0xc2, 0x2f, 0xbc, 0xed, 0x4f, 0x6e, 0x29, 0xbd, 0x5d, 0x90, 0x73, 0xb5, 0x3b, 0x5d, 0xbd, 0x3e,
-	0xf0, 0x83, 0x3f, 0x2d, 0x80, 0xa9, 0x10, 0xc5, 0x0f, 0x44, 0xac, 0x68, 0x8a, 0xae, 0x00, 0x18,
+	0x4f, 0x56, 0x2c, 0x16, 0xe9, 0x06, 0xdf, 0xf9, 0xd3, 0x00, 0x18, 0x0a, 0x91, 0xbf, 0x22, 0x62,
-	0x59, 0x66, 0x5c, 0x10, 0x46, 0xd2, 0x63, 0xeb, 0x95, 0xf5, 0xe6, 0x60, 0x78, 0xe2, 0x3f, 0xe6,
+	0x4e, 0x13, 0x74, 0x05, 0xc0, 0xc8, 0x6d, 0xca, 0x05, 0x61, 0x24, 0x39, 0x34, 0x8e, 0x8c, 0x93,
-	0xf4, 0xb7, 0x78, 0x1f, 0x57, 0xe0, 0x69, 0x03, 0xd7, 0x4a, 0xd1, 0x97, 0xb0, 0x57, 0xe6, 0x35,
+	0xbd, 0xee, 0xb1, 0x7f, 0x9f, 0xd3, 0xdf, 0xe2, 0x7d, 0x5c, 0x82, 0x87, 0x35, 0x5c, 0x09, 0x45,
-	0x2a, 0xfb, 0x95, 0xf5, 0xa6, 0x3b, 0x6d, 0xe0, 0x47, 0xd9, 0x41, 0x0e, 0xb0, 0x65, 0x40, 0x6d,
+	0x9f, 0x41, 0x6b, 0x95, 0x55, 0xa8, 0xcc, 0x23, 0xe3, 0xa4, 0x39, 0xac, 0xe1, 0x7b, 0xde, 0x4e,
-	0x68, 0x5e, 0x05, 0x91, 0xd7, 0x40, 0x1d, 0x70, 0xc2, 0x9b, 0x79, 0xe4, 0x59, 0x32, 0x15, 0xfe,
+	0x06, 0xb0, 0x65, 0x40, 0x0d, 0xb0, 0xae, 0x82, 0xc8, 0xab, 0xa1, 0x1d, 0xb0, 0xc3, 0x9b, 0x71,
-	0x14, 0x79, 0x36, 0x02, 0x70, 0x2f, 0x83, 0xef, 0x83, 0x28, 0xf0, 0x9a, 0xa8, 0x0b, 0xad, 0xf0,
+	0xe4, 0x19, 0xd2, 0x15, 0xfe, 0x10, 0x79, 0x26, 0x02, 0x70, 0x2e, 0x83, 0x97, 0x41, 0x14, 0x78,
-	0x22, 0x9a, 0x4c, 0x3d, 0x07, 0xf5, 0xa0, 0x7d, 0x13, 0x46, 0xb3, 0x9b, 0xeb, 0xb9, 0xd7, 0x92,
+	0x16, 0x6a, 0x42, 0x3d, 0xbc, 0x88, 0x06, 0x43, 0xcf, 0x46, 0x2e, 0x34, 0x6e, 0xc2, 0x68, 0x74,
-	0xc1, 0xe4, 0xe6, 0xfa, 0x3a, 0x98, 0x44, 0x9e, 0x2b, 0x39, 0xa6, 0xc1, 0xc5, 0xa5, 0xd7, 0x96,
+	0x73, 0x3d, 0xf6, 0xea, 0xd2, 0x18, 0xdc, 0x5c, 0x5f, 0x07, 0x83, 0xc8, 0x73, 0x24, 0xc7, 0x30,
-	0xf0, 0x08, 0x5f, 0x4c, 0x02, 0xaf, 0x33, 0x76, 0xc1, 0x11, 0x0f, 0x05, 0x19, 0xfc, 0x62, 0x81,
+	0xb8, 0xb8, 0xf4, 0x1a, 0x12, 0x1e, 0xe1, 0x8b, 0x41, 0xe0, 0xed, 0xf4, 0x1d, 0xb0, 0xc5, 0x3a,
-	0x3b, 0x4f, 0x56, 0x64, 0x4d, 0xd0, 0xe4, 0x03, 0x8e, 0x5f, 0xef, 0x3a, 0xd6, 0xd8, 0xff, 0xeb,
+	0x27, 0x9d, 0x5f, 0x0d, 0x70, 0xc6, 0xb3, 0x39, 0x59, 0x12, 0x34, 0x78, 0x4b, 0xc6, 0xcf, 0x1e,
-	0xf6, 0xf5, 0x23, 0xb7, 0x52, 0x60, 0x14, 0x85, 0x5e, 0x43, 0x0a, 0x94, 0xab, 0xb9, 0x67, 0x55,
+	0x66, 0x5c, 0x60, 0xff, 0x6d, 0xb6, 0xcf, 0xee, 0x65, 0x2b, 0x05, 0x46, 0x51, 0xe8, 0xd5, 0xa4,
-	0x02, 0xe7, 0xd0, 0x9d, 0x85, 0x17, 0x69, 0xca, 0x08, 0xe7, 0xe8, 0x08, 0x9c, 0xac, 0xb8, 0xff,
+	0x40, 0xb9, 0x1a, 0x7b, 0x46, 0x29, 0x70, 0x0c, 0xcd, 0x51, 0x78, 0x91, 0x24, 0x8c, 0x70, 0x8e,
-	0x46, 0x89, 0x6b, 0x4f, 0x1b, 0x58, 0x45, 0xe8, 0x4c, 0x65, 0x47, 0xea, 0xbf, 0x7a, 0xc3, 0xa3,
+	0x0e, 0xc0, 0x4e, 0xf3, 0xbb, 0xaf, 0x94, 0xb8, 0xc6, 0xb0, 0x86, 0x95, 0x85, 0xce, 0x94, 0xb7,
-	0x5d, 0xc9, 0xb3, 0xf0, 0x7e, 0x64, 0xb0, 0xa3, 0xb1, 0x03, 0x76, 0x56, 0x0c, 0xbe, 0x06, 0x47,
+	0xa7, 0xfe, 0xe5, 0x76, 0x0f, 0x1e, 0x4a, 0x1e, 0x85, 0x77, 0x3d, 0x8d, 0xed, 0xf5, 0x6d, 0x30,
-	0x66, 0xd1, 0x11, 0xb4, 0xde, 0x65, 0x8c, 0x0b, 0x45, 0xe8, 0x62, 0x1d, 0x20, 0x04, 0xce, 0x5d,
+	0xd3, 0xbc, 0xf3, 0x05, 0xd8, 0xd2, 0x8b, 0x0e, 0xa0, 0xfe, 0x3a, 0x65, 0x5c, 0x28, 0x42, 0x07,
-	0xcc, 0x85, 0xe2, 0x73, 0xb1, 0x5a, 0x0f, 0xbe, 0x03, 0x88, 0x92, 0x62, 0xa3, 0xe3, 0x54, 0xb2,
+	0x17, 0x06, 0x42, 0x60, 0x2f, 0x62, 0x2e, 0x14, 0x9f, 0x83, 0xd5, 0xba, 0xf3, 0x1d, 0x40, 0x34,
-	0xa8, 0xa2, 0xde, 0xf0, 0xd3, 0xf7, 0xff, 0xcf, 0xc0, 0xb0, 0x9d, 0x15, 0x92, 0xac, 0xa0, 0x4c,
+	0xcb, 0x37, 0x3a, 0x4e, 0x25, 0x8b, 0x0a, 0x72, 0xbb, 0x1f, 0xbd, 0xf9, 0x3f, 0x0d, 0xc3, 0x66,
-	0x93, 0xed, 0x63, 0xb5, 0x1e, 0x7c, 0x0b, 0xbd, 0x4b, 0xc2, 0x45, 0x96, 0xab, 0xfb, 0x87, 0x5e,
+	0x9a, 0x4b, 0xb2, 0x9c, 0xb2, 0x82, 0x6c, 0x17, 0xab, 0x75, 0xe7, 0x05, 0xb8, 0x97, 0x84, 0x8b,
-	0x80, 0xcb, 0xd5, 0xb1, 0x2a, 0xc6, 0x2e, 0x36, 0x91, 0x2a, 0x8d, 0xc5, 0x4a, 0x9f, 0x21, 0x56,
+	0x34, 0x53, 0xf7, 0x0f, 0x3d, 0x01, 0x87, 0xab, 0x63, 0x55, 0x8c, 0x4d, 0xac, 0x2d, 0x15, 0x1a,
-	0xeb, 0x41, 0x0a, 0xcd, 0x80, 0x72, 0x74, 0x06, 0xde, 0x92, 0x15, 0xc9, 0x82, 0x8b, 0x58, 0x94,
+	0x8b, 0x79, 0x71, 0x86, 0x58, 0xad, 0x3b, 0x09, 0x58, 0x01, 0xe5, 0xe8, 0x0c, 0xbc, 0x5b, 0x96,
-	0x7c, 0x91, 0xd0, 0x54, 0x17, 0xef, 0x4f, 0x1b, 0xf8, 0x40, 0xee, 0xcc, 0xd5, 0xc6, 0x84, 0xa6,
+	0xcf, 0x26, 0x5c, 0xc4, 0x62, 0xc5, 0x27, 0x33, 0x9a, 0x14, 0xc1, 0xbb, 0xc3, 0x1a, 0xde, 0x93,
-	0x44, 0x62, 0x19, 0xe1, 0x44, 0x2c, 0x08, 0x63, 0x94, 0x69, 0xac, 0xbd, 0xc1, 0xaa, 0x9d, 0x40,
+	0x3b, 0x63, 0xb5, 0x31, 0xa0, 0x09, 0x91, 0x58, 0x46, 0x38, 0x11, 0x13, 0xc2, 0x18, 0x65, 0x05,
-	0x6e, 0x48, 0xec, 0xb8, 0x05, 0x4d, 0x92, 0xa7, 0x83, 0xdf, 0xba, 0xd0, 0x89, 0xe2, 0x22, 0xb8,
+	0xd6, 0xdc, 0x60, 0xd5, 0x4e, 0x20, 0x37, 0x24, 0xb6, 0x5f, 0x07, 0x8b, 0x64, 0x49, 0xe7, 0x17,
-	0x27, 0xb9, 0x40, 0x43, 0x70, 0x39, 0x2d, 0x59, 0x42, 0x8c, 0xe1, 0xfe, 0xae, 0xe1, 0xed, 0xc1,
+	0x17, 0x76, 0xa2, 0x38, 0x0f, 0xee, 0x48, 0x26, 0x50, 0x17, 0x1c, 0x4e, 0x57, 0x6c, 0x46, 0x74,
-	0x60, 0x83, 0x94, 0x35, 0x22, 0x66, 0x4b, 0x22, 0x4c, 0x53, 0x9e, 0xac, 0xd1, 0x48, 0xf4, 0x16,
+	0xc2, 0xed, 0x87, 0x09, 0x6f, 0x0f, 0x06, 0x6b, 0x24, 0xfa, 0x16, 0xdc, 0x64, 0x9b, 0xa1, 0xae,
-	0x9c, 0x95, 0x10, 0xc5, 0x71, 0x53, 0x55, 0xbc, 0x7c, 0xaf, 0xc2, 0xe8, 0x51, 0x43, 0x27, 0xfb,
+	0xcc, 0x63, 0x81, 0x55, 0x38, 0x0a, 0xc1, 0xab, 0x98, 0x93, 0x25, 0x11, 0xf1, 0xa1, 0xad, 0x28,
-	0x29, 0xc1, 0xfd, 0xbf, 0xda, 0xe0, 0xc8, 0x04, 0xba, 0x86, 0x3d, 0x46, 0x7e, 0x2e, 0x09, 0x17,
+	0xde, 0xe8, 0xc0, 0x8d, 0x4a, 0x3f, 0xc8, 0x92, 0x9c, 0xa6, 0x99, 0x78, 0x45, 0x44, 0x8c, 0xff,
-	0x8b, 0x2c, 0xcf, 0x84, 0xd1, 0x7a, 0xfa, 0x24, 0x8b, 0x8f, 0x75, 0xc5, 0x2c, 0xcf, 0xc4, 0xb4,
+	0x57, 0x09, 0x97, 0x0e, 0xf4, 0x1c, 0xec, 0xb9, 0x10, 0xf9, 0xa1, 0xa5, 0x58, 0x9e, 0xbe, 0x93,
-	0x81, 0x7b, 0x6c, 0x1b, 0xa2, 0x1f, 0x61, 0x9f, 0x11, 0x5e, 0xd0, 0x9c, 0x13, 0x4d, 0xa8, 0x8d,
+	0x45, 0x36, 0xb4, 0xbc, 0x2b, 0x12, 0xdc, 0xfe, 0xd9, 0x80, 0x56, 0x95, 0x16, 0x8d, 0xc0, 0x59,
-	0x9c, 0x3d, 0x47, 0xa8, 0x4b, 0x0c, 0xe3, 0x1e, 0xab, 0xc5, 0x5a, 0xa2, 0xa1, 0x24, 0x79, 0x6a,
+	0xc4, 0x53, 0xb2, 0xe0, 0x87, 0xc6, 0x91, 0x75, 0xe2, 0x76, 0xbf, 0xfc, 0x20, 0x35, 0xfe, 0x4b,
-	0x8c, 0x9e, 0xfe, 0x3b, 0xc6, 0x20, 0x4f, 0xb5, 0xc4, 0x2a, 0xec, 0x8f, 0xa0, 0x33, 0x17, 0x8c,
+	0x15, 0x13, 0x64, 0x82, 0xad, 0xb1, 0x26, 0x68, 0xbf, 0x00, 0xb7, 0xe2, 0x46, 0x1e, 0x58, 0x3f,
-	0xc4, 0xeb, 0x59, 0x2a, 0xef, 0xca, 0x6d, 0xcc, 0xcd, 0x25, 0xc0, 0x6a, 0xad, 0xee, 0x95, 0xda,
+	0x92, 0xb5, 0xae, 0xbf, 0x5c, 0xca, 0xab, 0x79, 0x17, 0x2f, 0x56, 0x44, 0x57, 0xbf, 0x30, 0xbe,
-	0x57, 0xda, 0x1d, 0x6c, 0xa2, 0xfe, 0x1f, 0x16, 0xf4, 0x6a, 0xce, 0xd1, 0x08, 0xec, 0x2c, 0x35,
+	0x31, 0xbf, 0x36, 0xda, 0x7f, 0x35, 0xc0, 0x96, 0x3a, 0xd1, 0x35, 0xb4, 0x18, 0xf9, 0x69, 0x45,
-	0x07, 0xf6, 0xd5, 0xd3, 0x6a, 0x36, 0xff, 0x87, 0xed, 0x2c, 0x95, 0x4d, 0x5e, 0xab, 0x8f, 0xdf,
+	0xb8, 0x98, 0xa4, 0x59, 0x2a, 0x74, 0x79, 0x4e, 0x1f, 0x4d, 0xce, 0xc7, 0x45, 0xc4, 0x28, 0x4b,
-	0x3f, 0x35, 0x79, 0xfb, 0x79, 0xc4, 0x06, 0x89, 0xfc, 0xea, 0xae, 0x6b, 0xf7, 0x2f, 0x3e, 0xfc,
+	0xc5, 0xb0, 0x86, 0x5d, 0xb6, 0x35, 0xd1, 0xf7, 0xb0, 0xcb, 0x08, 0xcf, 0x69, 0xc6, 0x49, 0x41,
-	0x81, 0xa9, 0x66, 0xe0, 0x33, 0xe8, 0xc6, 0xa5, 0x58, 0x51, 0x96, 0x89, 0x87, 0x63, 0x47, 0x0d,
+	0x58, 0x94, 0xed, 0xec, 0x7d, 0x84, 0x45, 0x88, 0x66, 0x6c, 0xb1, 0x8a, 0x5d, 0x48, 0xd4, 0x94,
-	0xc2, 0x36, 0x51, 0x4d, 0x48, 0x6b, 0x3b, 0x21, 0xfd, 0xdf, 0x2d, 0xd8, 0xab, 0xb7, 0xe1, 0x3f,
+	0x24, 0x4b, 0xf4, 0xf9, 0x9f, 0x7e, 0x18, 0x63, 0x90, 0x25, 0x85, 0xc4, 0xd2, 0x6c, 0xf7, 0x60,
-	0xdb, 0xbb, 0x02, 0xc4, 0xb3, 0x3c, 0x21, 0x8b, 0x47, 0xf7, 0xca, 0x36, 0x43, 0xaf, 0x5f, 0x13,
+	0x67, 0x2c, 0x18, 0x89, 0x97, 0xa3, 0x44, 0xb6, 0xc7, 0x34, 0xe6, 0xfa, 0xde, 0x63, 0xb5, 0x56,
-	0x7f, 0xf3, 0x9a, 0xf8, 0x97, 0xe6, 0x35, 0xc1, 0x9e, 0x2a, 0xaa, 0x9f, 0xef, 0x17, 0xd0, 0x93,
+	0xad, 0xa4, 0xf6, 0x95, 0x76, 0x1b, 0x6b, 0xab, 0xfd, 0x87, 0x01, 0x6e, 0x25, 0x73, 0xd4, 0x03,
-	0x77, 0xd5, 0x0c, 0xab, 0x32, 0xbe, 0x8f, 0x41, 0xa6, 0xf4, 0x94, 0xf6, 0x7f, 0xb5, 0x65, 0x43,
+	0x33, 0x4d, 0xf4, 0x81, 0x7d, 0xfe, 0xb8, 0x9a, 0xcd, 0xff, 0xb0, 0x99, 0x26, 0xb2, 0x17, 0x96,
-	0xaa, 0xc6, 0x7e, 0x7c, 0xc5, 0x33, 0x38, 0xdc, 0x10, 0xd5, 0x47, 0xa0, 0xf9, 0x1c, 0xd3, 0x27,
+	0x6a, 0xde, 0xbf, 0xeb, 0x4a, 0x6f, 0x5f, 0x04, 0xac, 0x91, 0xc8, 0x2f, 0xdb, 0xbb, 0xc8, 0xfe,
-	0x86, 0xa9, 0x76, 0xfa, 0x27, 0x70, 0x50, 0x91, 0xdc, 0x3e, 0x08, 0xc2, 0x55, 0x17, 0x1d, 0x5c,
+	0xc9, 0xdb, 0x67, 0x6a, 0xd9, 0xf6, 0x1f, 0x43, 0x33, 0x5e, 0x89, 0x39, 0x65, 0xa9, 0x58, 0xab,
-	0x4d, 0xd7, 0x58, 0x26, 0xd1, 0x09, 0x34, 0x09, 0xe5, 0xaa, 0x91, 0xbd, 0xe1, 0xe1, 0xae, 0xe7,
+	0x6b, 0xdf, 0xc4, 0x5b, 0x47, 0x39, 0x14, 0xea, 0xdb, 0xa1, 0xd0, 0xfe, 0xdd, 0x80, 0x56, 0xb5,
-	0x80, 0x72, 0x2c, 0xf7, 0xc7, 0x6d, 0x68, 0x11, 0x69, 0xbe, 0x5a, 0x9c, 0xbd, 0x84, 0x4e, 0x28,
+	0x0c, 0xff, 0x38, 0xbd, 0x2b, 0x40, 0x3c, 0xcd, 0x66, 0x64, 0x72, 0xef, 0x5e, 0x99, 0x7a, 0xce,
-	0x75, 0x24, 0xf4, 0xae, 0xf6, 0x90, 0xb4, 0xa1, 0x19, 0x4d, 0x42, 0xcf, 0xba, 0x75, 0x95, 0xc8,
+	0x15, 0x0f, 0xa8, 0xbf, 0x79, 0x40, 0xfd, 0x4b, 0xfd, 0x80, 0x62, 0x4f, 0x05, 0x55, 0xcf, 0xf7,
-	0xb7, 0x7f, 0x07, 0x00, 0x00, 0xff, 0xff, 0x37, 0x93, 0x7d, 0x00, 0x23, 0x08, 0x00, 0x00,
+	0x53, 0x70, 0x65, 0x0b, 0xe9, 0xf9, 0xa4, 0x12, 0xdf, 0xc5, 0x20, 0x5d, 0xc5, 0x60, 0x6a, 0xff,
+	0x66, 0xca, 0x82, 0x94, 0x85, 0xfd, 0xef, 0x15, 0x8f, 0x60, 0x7f, 0x43, 0x54, 0x6d, 0x01, 0xeb,
+	0x7d, 0x4c, 0xff, 0xd7, 0x4c, 0x95, 0xd3, 0x3f, 0x86, 0xbd, 0x92, 0x64, 0xba, 0x16, 0x84, 0xab,
+	0x2a, 0xda, 0xb8, 0xec, 0xae, 0xbe, 0x74, 0xa2, 0x63, 0xb0, 0x08, 0xe5, 0xaa, 0x90, 0x6e, 0x77,
+	0xff, 0x61, 0xce, 0x01, 0xe5, 0x58, 0xee, 0xf7, 0x1b, 0x50, 0x27, 0x32, 0xf9, 0x72, 0x71, 0xf6,
+	0x14, 0x76, 0x42, 0xa9, 0x63, 0x46, 0x17, 0x95, 0xb7, 0xb3, 0x01, 0x56, 0x34, 0x08, 0x3d, 0x63,
+	0xea, 0x28, 0x91, 0xcf, 0xff, 0x0e, 0x00, 0x00, 0xff, 0xff, 0xa8, 0x49, 0x72, 0x40, 0x16, 0x09,
+	0x00, 0x00,
 }

controller/gen/controller/tap/tap.pb.go

@@ -45,6 +45,7 @@ const _ = grpc.SupportPackageIsVersion4
 
 type TapClient interface {
 	Tap(ctx context.Context, in *conduit_public.TapRequest, opts ...grpc.CallOption) (Tap_TapClient, error)
+	TapByResource(ctx context.Context, in *conduit_public.TapByResourceRequest, opts ...grpc.CallOption) (Tap_TapByResourceClient, error)
 }
 
 type tapClient struct {
@@ -87,10 +88,43 @@ func (x *tapTapClient) Recv() (*conduit_common.TapEvent, error) {
 	return m, nil
 }
 
+func (c *tapClient) TapByResource(ctx context.Context, in *conduit_public.TapByResourceRequest, opts ...grpc.CallOption) (Tap_TapByResourceClient, error) {
+	stream, err := grpc.NewClientStream(ctx, &_Tap_serviceDesc.Streams[1], c.cc, "/conduit.controller.tap.Tap/TapByResource", opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &tapTapByResourceClient{stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type Tap_TapByResourceClient interface {
+	Recv() (*conduit_common.TapEvent, error)
+	grpc.ClientStream
+}
+
+type tapTapByResourceClient struct {
+	grpc.ClientStream
+}
+
+func (x *tapTapByResourceClient) Recv() (*conduit_common.TapEvent, error) {
+	m := new(conduit_common.TapEvent)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
 // Server API for Tap service
 
 type TapServer interface {
 	Tap(*conduit_public.TapRequest, Tap_TapServer) error
+	TapByResource(*conduit_public.TapByResourceRequest, Tap_TapByResourceServer) error
 }
 
 func RegisterTapServer(s *grpc.Server, srv TapServer) {
@@ -118,6 +152,27 @@ func (x *tapTapServer) Send(m *conduit_common.TapEvent) error {
 	return x.ServerStream.SendMsg(m)
 }
 
+func _Tap_TapByResource_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(conduit_public.TapByResourceRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(TapServer).TapByResource(m, &tapTapByResourceServer{stream})
+}
+
+type Tap_TapByResourceServer interface {
+	Send(*conduit_common.TapEvent) error
+	grpc.ServerStream
+}
+
+type tapTapByResourceServer struct {
+	grpc.ServerStream
+}
+
+func (x *tapTapByResourceServer) Send(m *conduit_common.TapEvent) error {
+	return x.ServerStream.SendMsg(m)
+}
+
 var _Tap_serviceDesc = grpc.ServiceDesc{
 	ServiceName: "conduit.controller.tap.Tap",
 	HandlerType: (*TapServer)(nil),
@@ -128,6 +183,11 @@ var _Tap_serviceDesc = grpc.ServiceDesc{
 			Handler:       _Tap_Tap_Handler,
 			ServerStreams: true,
 		},
+		{
+			StreamName:    "TapByResource",
+			Handler:       _Tap_TapByResource_Handler,
+			ServerStreams: true,
+		},
 	},
 	Metadata: "controller/tap/tap.proto",
 }
@@ -135,14 +195,16 @@ var _Tap_serviceDesc = grpc.ServiceDesc{
 func init() { proto.RegisterFile("controller/tap/tap.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 142 bytes of a gzipped FileDescriptorProto
+	// 169 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x92, 0x48, 0xce, 0xcf, 0x2b,
 	0x29, 0xca, 0xcf, 0xc9, 0x49, 0x2d, 0xd2, 0x2f, 0x49, 0x2c, 0x00, 0x61, 0xbd, 0x82, 0xa2, 0xfc,
 	0x92, 0x7c, 0x21, 0xb1, 0xe4, 0xfc, 0xbc, 0x94, 0xd2, 0xcc, 0x12, 0x3d, 0x84, 0x0a, 0xbd, 0x92,
 	0xc4, 0x02, 0x29, 0xe1, 0xe4, 0xfc, 0xdc, 0xdc, 0xfc, 0x3c, 0x7d, 0x08, 0x05, 0x51, 0x2c, 0x25,
-	0x50, 0x50, 0x9a, 0x94, 0x93, 0x99, 0xac, 0x9f, 0x58, 0x90, 0x09, 0x11, 0x31, 0x72, 0xe3, 0x62,
+	0x50, 0x50, 0x9a, 0x94, 0x93, 0x99, 0xac, 0x9f, 0x58, 0x90, 0x09, 0x11, 0x31, 0x9a, 0xcd, 0xc8,
-	0x0e, 0x49, 0x2c, 0x10, 0xb2, 0x87, 0x50, 0x52, 0x7a, 0x30, 0xd3, 0x20, 0x0a, 0xf5, 0x42, 0x12,
+	0xc5, 0x1c, 0x92, 0x58, 0x20, 0x64, 0x0f, 0xa1, 0xa4, 0xf4, 0x60, 0xc6, 0x41, 0x54, 0xea, 0x85,
-	0x0b, 0x82, 0x52, 0x0b, 0x4b, 0x53, 0x8b, 0x4b, 0xa4, 0x24, 0xf4, 0x10, 0x36, 0x81, 0x8d, 0x0c,
+	0x24, 0x16, 0x04, 0xa5, 0x16, 0x96, 0xa6, 0x16, 0x97, 0x48, 0x49, 0xe8, 0x21, 0xac, 0x02, 0x9b,
-	0x49, 0x2c, 0x70, 0x2d, 0x4b, 0xcd, 0x2b, 0x51, 0x62, 0x30, 0x60, 0x4c, 0x62, 0x03, 0x1b, 0x67,
+	0x19, 0x92, 0x58, 0xe0, 0x5a, 0x96, 0x9a, 0x57, 0xa2, 0xc4, 0x60, 0xc0, 0x28, 0x14, 0xcc, 0xc5,
-	0x0c, 0x08, 0x00, 0x00, 0xff, 0xff, 0x17, 0x0c, 0x64, 0xf7, 0xa9, 0x00, 0x00, 0x00,
+	0x1b, 0x92, 0x58, 0xe0, 0x54, 0x19, 0x94, 0x5a, 0x9c, 0x5f, 0x5a, 0x94, 0x9c, 0x2a, 0xa4, 0x82,
+	0xc5, 0x28, 0x84, 0x34, 0x51, 0x86, 0x26, 0xb1, 0x81, 0x1d, 0x69, 0x0c, 0x08, 0x00, 0x00, 0xff,
+	0xff, 0xc0, 0x83, 0x2d, 0xea, 0xff, 0x00, 0x00, 0x00,
 }

controller/gen/proxy/tap/tap.pb.go

@@ -67,6 +67,7 @@ type ObserveRequest_Match struct {
 	//	*ObserveRequest_Match_Source
 	//	*ObserveRequest_Match_Destination
 	//	*ObserveRequest_Match_Http_
+	//	*ObserveRequest_Match_DestinationLabel
 	Match isObserveRequest_Match_Match `protobuf_oneof:"match"`
 }
 
@@ -95,13 +96,17 @@ type ObserveRequest_Match_Destination struct {
 type ObserveRequest_Match_Http_ struct {
 	Http *ObserveRequest_Match_Http `protobuf:"bytes,6,opt,name=http,oneof"`
 }
+type ObserveRequest_Match_DestinationLabel struct {
+	DestinationLabel *ObserveRequest_Match_Label `protobuf:"bytes,7,opt,name=destination_label,json=destinationLabel,oneof"`
+}
 
-func (*ObserveRequest_Match_All) isObserveRequest_Match_Match()         {}
+func (*ObserveRequest_Match_All) isObserveRequest_Match_Match()              {}
-func (*ObserveRequest_Match_Any) isObserveRequest_Match_Match()         {}
+func (*ObserveRequest_Match_Any) isObserveRequest_Match_Match()              {}
-func (*ObserveRequest_Match_Not) isObserveRequest_Match_Match()         {}
+func (*ObserveRequest_Match_Not) isObserveRequest_Match_Match()              {}
-func (*ObserveRequest_Match_Source) isObserveRequest_Match_Match()      {}
+func (*ObserveRequest_Match_Source) isObserveRequest_Match_Match()           {}
-func (*ObserveRequest_Match_Destination) isObserveRequest_Match_Match() {}
+func (*ObserveRequest_Match_Destination) isObserveRequest_Match_Match()      {}
-func (*ObserveRequest_Match_Http_) isObserveRequest_Match_Match()       {}
+func (*ObserveRequest_Match_Http_) isObserveRequest_Match_Match()            {}
+func (*ObserveRequest_Match_DestinationLabel) isObserveRequest_Match_Match() {}
 
 func (m *ObserveRequest_Match) GetMatch() isObserveRequest_Match_Match {
 	if m != nil {
@@ -152,6 +157,13 @@ func (m *ObserveRequest_Match) GetHttp() *ObserveRequest_Match_Http {
 	return nil
 }
 
+func (m *ObserveRequest_Match) GetDestinationLabel() *ObserveRequest_Match_Label {
+	if x, ok := m.GetMatch().(*ObserveRequest_Match_DestinationLabel); ok {
+		return x.DestinationLabel
+	}
+	return nil
+}
+
 // XXX_OneofFuncs is for the internal use of the proto package.
 func (*ObserveRequest_Match) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
 	return _ObserveRequest_Match_OneofMarshaler, _ObserveRequest_Match_OneofUnmarshaler, _ObserveRequest_Match_OneofSizer, []interface{}{
@@ -161,6 +173,7 @@ func (*ObserveRequest_Match) XXX_OneofFuncs() (func(msg proto.Message, b *proto.
 		(*ObserveRequest_Match_Source)(nil),
 		(*ObserveRequest_Match_Destination)(nil),
 		(*ObserveRequest_Match_Http_)(nil),
+		(*ObserveRequest_Match_DestinationLabel)(nil),
 	}
 }
 
@@ -198,6 +211,11 @@ func _ObserveRequest_Match_OneofMarshaler(msg proto.Message, b *proto.Buffer) er
 		if err := b.EncodeMessage(x.Http); err != nil {
 			return err
 		}
+	case *ObserveRequest_Match_DestinationLabel:
+		b.EncodeVarint(7<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.DestinationLabel); err != nil {
+			return err
+		}
 	case nil:
 	default:
 		return fmt.Errorf("ObserveRequest_Match.Match has unexpected type %T", x)
@@ -256,6 +274,14 @@ func _ObserveRequest_Match_OneofUnmarshaler(msg proto.Message, tag, wire int, b
 		err := b.DecodeMessage(msg)
 		m.Match = &ObserveRequest_Match_Http_{msg}
 		return true, err
+	case 7: // match.destination_label
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(ObserveRequest_Match_Label)
+		err := b.DecodeMessage(msg)
+		m.Match = &ObserveRequest_Match_DestinationLabel{msg}
+		return true, err
 	default:
 		return false, nil
 	}
@@ -295,6 +321,11 @@ func _ObserveRequest_Match_OneofSizer(msg proto.Message) (n int) {
 		n += proto.SizeVarint(6<<3 | proto.WireBytes)
 		n += proto.SizeVarint(uint64(s))
 		n += s
+	case *ObserveRequest_Match_DestinationLabel:
+		s := proto.Size(x.DestinationLabel)
+		n += proto.SizeVarint(7<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
 	case nil:
 	default:
 		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
@@ -318,6 +349,32 @@ func (m *ObserveRequest_Match_Seq) GetMatches() []*ObserveRequest_Match {
 	return nil
 }
 
+type ObserveRequest_Match_Label struct {
+	Key   string `protobuf:"bytes,1,opt,name=key" json:"key,omitempty"`
+	Value string `protobuf:"bytes,2,opt,name=value" json:"value,omitempty"`
+}
+
+func (m *ObserveRequest_Match_Label) Reset()         { *m = ObserveRequest_Match_Label{} }
+func (m *ObserveRequest_Match_Label) String() string { return proto.CompactTextString(m) }
+func (*ObserveRequest_Match_Label) ProtoMessage()    {}
+func (*ObserveRequest_Match_Label) Descriptor() ([]byte, []int) {
+	return fileDescriptor0, []int{0, 0, 1}
+}
+
+func (m *ObserveRequest_Match_Label) GetKey() string {
+	if m != nil {
+		return m.Key
+	}
+	return ""
+}
+
+func (m *ObserveRequest_Match_Label) GetValue() string {
+	if m != nil {
+		return m.Value
+	}
+	return ""
+}
+
 type ObserveRequest_Match_Tcp struct {
 	// Types that are valid to be assigned to Match:
 	//	*ObserveRequest_Match_Tcp_Netmask_
@@ -328,7 +385,7 @@ type ObserveRequest_Match_Tcp struct {
 func (m *ObserveRequest_Match_Tcp) Reset()                    { *m = ObserveRequest_Match_Tcp{} }
 func (m *ObserveRequest_Match_Tcp) String() string            { return proto.CompactTextString(m) }
 func (*ObserveRequest_Match_Tcp) ProtoMessage()               {}
-func (*ObserveRequest_Match_Tcp) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0, 0, 1} }
+func (*ObserveRequest_Match_Tcp) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0, 0, 2} }
 
 type isObserveRequest_Match_Tcp_Match interface{ isObserveRequest_Match_Tcp_Match() }
 
@@ -446,7 +503,7 @@ func (m *ObserveRequest_Match_Tcp_Netmask) Reset()         { *m = ObserveRequest
 func (m *ObserveRequest_Match_Tcp_Netmask) String() string { return proto.CompactTextString(m) }
 func (*ObserveRequest_Match_Tcp_Netmask) ProtoMessage()    {}
 func (*ObserveRequest_Match_Tcp_Netmask) Descriptor() ([]byte, []int) {
-	return fileDescriptor0, []int{0, 0, 1, 0}
+	return fileDescriptor0, []int{0, 0, 2, 0}
 }
 
 func (m *ObserveRequest_Match_Tcp_Netmask) GetIp() *conduit_common.IPAddress {
@@ -476,7 +533,7 @@ func (m *ObserveRequest_Match_Tcp_PortRange) Reset()         { *m = ObserveReque
 func (m *ObserveRequest_Match_Tcp_PortRange) String() string { return proto.CompactTextString(m) }
 func (*ObserveRequest_Match_Tcp_PortRange) ProtoMessage()    {}
 func (*ObserveRequest_Match_Tcp_PortRange) Descriptor() ([]byte, []int) {
-	return fileDescriptor0, []int{0, 0, 1, 1}
+	return fileDescriptor0, []int{0, 0, 2, 1}
 }
 
 func (m *ObserveRequest_Match_Tcp_PortRange) GetMin() uint32 {
@@ -505,7 +562,7 @@ type ObserveRequest_Match_Http struct {
 func (m *ObserveRequest_Match_Http) Reset()                    { *m = ObserveRequest_Match_Http{} }
 func (m *ObserveRequest_Match_Http) String() string            { return proto.CompactTextString(m) }
 func (*ObserveRequest_Match_Http) ProtoMessage()               {}
-func (*ObserveRequest_Match_Http) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0, 0, 2} }
+func (*ObserveRequest_Match_Http) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0, 0, 3} }
 
 type isObserveRequest_Match_Http_Match interface{ isObserveRequest_Match_Http_Match() }
 
@@ -685,7 +742,7 @@ func (m *ObserveRequest_Match_Http_StringMatch) Reset()         { *m = ObserveRe
 func (m *ObserveRequest_Match_Http_StringMatch) String() string { return proto.CompactTextString(m) }
 func (*ObserveRequest_Match_Http_StringMatch) ProtoMessage()    {}
 func (*ObserveRequest_Match_Http_StringMatch) Descriptor() ([]byte, []int) {
-	return fileDescriptor0, []int{0, 0, 2, 0}
+	return fileDescriptor0, []int{0, 0, 3, 0}
 }
 
 type isObserveRequest_Match_Http_StringMatch_Match interface{ isObserveRequest_Match_Http_StringMatch_Match() }
@@ -791,6 +848,7 @@ func init() {
 	proto.RegisterType((*ObserveRequest)(nil), "conduit.proxy.tap.ObserveRequest")
 	proto.RegisterType((*ObserveRequest_Match)(nil), "conduit.proxy.tap.ObserveRequest.Match")
 	proto.RegisterType((*ObserveRequest_Match_Seq)(nil), "conduit.proxy.tap.ObserveRequest.Match.Seq")
+	proto.RegisterType((*ObserveRequest_Match_Label)(nil), "conduit.proxy.tap.ObserveRequest.Match.Label")
 	proto.RegisterType((*ObserveRequest_Match_Tcp)(nil), "conduit.proxy.tap.ObserveRequest.Match.Tcp")
 	proto.RegisterType((*ObserveRequest_Match_Tcp_Netmask)(nil), "conduit.proxy.tap.ObserveRequest.Match.Tcp.Netmask")
 	proto.RegisterType((*ObserveRequest_Match_Tcp_PortRange)(nil), "conduit.proxy.tap.ObserveRequest.Match.Tcp.PortRange")
@@ -900,40 +958,43 @@ var _Tap_serviceDesc = grpc.ServiceDesc{
 func init() { proto.RegisterFile("proxy/tap/tap.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 553 bytes of a gzipped FileDescriptorProto
+	// 606 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x94, 0xc1, 0x6e, 0xd3, 0x4c,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x94, 0xcf, 0x6e, 0xd3, 0x40,
-	0x10, 0xc7, 0x13, 0x3b, 0x76, 0x94, 0x89, 0xbe, 0x4f, 0x30, 0x45, 0x95, 0xf1, 0xa9, 0xf4, 0x42,
+	0x10, 0xc6, 0x93, 0x38, 0x4e, 0x94, 0x89, 0x40, 0xed, 0x14, 0x55, 0xc6, 0xa7, 0xd2, 0x0b, 0x45,
-	0x11, 0xc8, 0xa9, 0x52, 0x90, 0x90, 0x10, 0x42, 0xad, 0x54, 0xc9, 0x20, 0xa5, 0x29, 0x4e, 0x0e,
+	0x80, 0x53, 0xb5, 0x20, 0x21, 0x21, 0x84, 0x5a, 0xa9, 0x92, 0x41, 0xf4, 0x0f, 0x9b, 0x1c, 0x38,
-	0x5c, 0xb7, 0xce, 0x52, 0x5b, 0xc4, 0xbb, 0x1b, 0x7b, 0x52, 0x25, 0x4f, 0xc1, 0x73, 0xf0, 0x6c,
+	0x20, 0xa1, 0xad, 0xb3, 0xd4, 0x56, 0xed, 0xdd, 0xad, 0x3d, 0xa9, 0x9a, 0x17, 0xe0, 0x31, 0xb8,
-	0x3c, 0x00, 0x57, 0xb4, 0xeb, 0x4d, 0x28, 0xe9, 0x81, 0x1a, 0x0e, 0x96, 0x67, 0x77, 0xe7, 0xff,
+	0xf3, 0x6c, 0xbc, 0x04, 0xda, 0xf5, 0xa6, 0x84, 0xf6, 0x40, 0x0d, 0x87, 0x28, 0xb3, 0xbb, 0xf3,
-	0xdb, 0xd9, 0x99, 0x9d, 0x85, 0x3d, 0x55, 0xca, 0xd5, 0x7a, 0x40, 0x4c, 0xe9, 0x2f, 0x52, 0xa5,
+	0xfd, 0x3c, 0x1e, 0x7f, 0xb3, 0xb0, 0xa6, 0x4b, 0x75, 0x35, 0x1f, 0x11, 0xd7, 0xe6, 0x17, 0xe9,
-	0x24, 0x89, 0x0f, 0x53, 0x29, 0x66, 0xcb, 0x9c, 0x22, 0xb3, 0x18, 0x11, 0x53, 0xe1, 0x5e, 0x2a,
+	0x52, 0x91, 0xc2, 0xd5, 0x44, 0xc9, 0xe9, 0x2c, 0xa3, 0xc8, 0x1e, 0x46, 0xc4, 0x75, 0xb8, 0x96,
-	0x8b, 0x42, 0x8a, 0x41, 0xfd, 0xab, 0xfd, 0x0e, 0x7f, 0xf4, 0xe0, 0xff, 0xf1, 0x55, 0xc5, 0xcb,
+	0xa8, 0xa2, 0x50, 0x72, 0x54, 0xff, 0xd5, 0x79, 0x9b, 0xdf, 0x86, 0x70, 0xff, 0xf8, 0xb4, 0x12,
-	0x1b, 0x9e, 0xf0, 0xc5, 0x92, 0x57, 0x84, 0x8f, 0xc0, 0x9b, 0xe7, 0x45, 0x4e, 0x41, 0xfb, 0xa0,
+	0xe5, 0xa5, 0x60, 0xe2, 0x62, 0x26, 0x2a, 0xc2, 0x07, 0xe0, 0xe7, 0x59, 0x91, 0x51, 0xd0, 0xde,
-	0x7d, 0xf4, 0x5f, 0x52, 0x0f, 0xf0, 0x2d, 0x78, 0x05, 0xa3, 0x34, 0x0b, 0x9c, 0x83, 0xf6, 0x51,
+	0x68, 0x6f, 0xdd, 0x63, 0xf5, 0x02, 0xdf, 0x80, 0x5f, 0x70, 0x4a, 0xd2, 0xa0, 0xb3, 0xd1, 0xde,
-	0x7f, 0xf8, 0x34, 0xba, 0xb3, 0x41, 0xf4, 0x3b, 0x27, 0x1a, 0x69, 0xf7, 0xa4, 0x56, 0x85, 0x5f,
+	0x1a, 0xee, 0x3c, 0x8e, 0x6e, 0x3d, 0x20, 0xfa, 0x93, 0x13, 0x1d, 0x9a, 0x74, 0x56, 0xab, 0xc2,
-	0x7b, 0xe0, 0x99, 0x09, 0x7c, 0x07, 0x2e, 0x9b, 0xcf, 0x0d, 0xbc, 0x3f, 0x7c, 0x7e, 0x4f, 0x4c,
+	0xef, 0x00, 0xbe, 0xdd, 0xc0, 0xb7, 0xe0, 0xf1, 0x3c, 0xb7, 0xf0, 0xe1, 0xce, 0xd3, 0x3b, 0x62,
-	0x34, 0xe1, 0x8b, 0xb8, 0x95, 0x68, 0xa5, 0x01, 0x88, 0xb5, 0x8d, 0xa3, 0x31, 0x40, 0xac, 0xf1,
+	0xa2, 0xb1, 0xb8, 0x88, 0x5b, 0xcc, 0x28, 0x2d, 0x40, 0xce, 0x5d, 0x1d, 0x8d, 0x01, 0x72, 0x8e,
-	0x0d, 0xb8, 0x42, 0x52, 0xe0, 0x36, 0x3a, 0x88, 0x16, 0x0b, 0x49, 0x78, 0x0e, 0x7e, 0x25, 0x97,
+	0xaf, 0xc1, 0x93, 0x8a, 0x02, 0xaf, 0xd1, 0x8b, 0x18, 0xb1, 0x54, 0x84, 0x07, 0xd0, 0xab, 0xd4,
-	0x65, 0xca, 0x83, 0x4e, 0xb3, 0x00, 0xa6, 0xa9, 0x8a, 0x5b, 0x89, 0x15, 0xe3, 0x18, 0xfa, 0x33,
+	0xac, 0x4c, 0x44, 0xd0, 0x6d, 0x56, 0xc0, 0x24, 0xd1, 0x71, 0x8b, 0x39, 0x31, 0x1e, 0xc3, 0x70,
-	0x5e, 0x51, 0x2e, 0x18, 0xe5, 0x52, 0x04, 0xde, 0xdf, 0xb0, 0x6e, 0x13, 0xf0, 0x0c, 0x3a, 0x19,
+	0x2a, 0x2a, 0xca, 0x24, 0xa7, 0x4c, 0xc9, 0xc0, 0xff, 0x17, 0xd6, 0x32, 0x01, 0xf7, 0xa1, 0x9b,
-	0x91, 0x0a, 0x7c, 0x43, 0x7a, 0x71, 0x5f, 0x52, 0x4c, 0xa4, 0x51, 0x46, 0x1b, 0xc6, 0xe0, 0x4e,
+	0x12, 0xe9, 0xa0, 0x67, 0x49, 0xcf, 0xee, 0x4a, 0x8a, 0x89, 0x0c, 0xca, 0x6a, 0xf1, 0x33, 0xac,
-	0xf8, 0x02, 0x4f, 0xa1, 0x6b, 0x8a, 0xc6, 0xab, 0xa0, 0x7d, 0xe0, 0x36, 0x29, 0xf6, 0x46, 0x17,
+	0x2e, 0x21, 0xbf, 0xe4, 0xfc, 0x54, 0xe4, 0x41, 0xdf, 0x02, 0x9f, 0xdf, 0x15, 0xf8, 0xc1, 0x88,
-	0x7e, 0x73, 0xc0, 0x9d, 0xa6, 0x0a, 0xc7, 0xd0, 0x15, 0x9c, 0x0a, 0x56, 0x7d, 0xb1, 0x05, 0x3f,
+	0xe2, 0x16, 0x5b, 0x59, 0x22, 0xd9, 0xbd, 0x30, 0x06, 0x6f, 0x2c, 0x2e, 0x70, 0x0f, 0xfa, 0xd6,
-	0x69, 0x70, 0xc4, 0xe8, 0xa2, 0x96, 0xc6, 0xad, 0x64, 0x43, 0xc1, 0x11, 0x78, 0x4a, 0x96, 0x54,
+	0x12, 0xa2, 0x0a, 0xda, 0x1b, 0x5e, 0x13, 0x2b, 0x2d, 0x74, 0xe1, 0x08, 0x7c, 0x8b, 0xc4, 0x15,
-	0xd9, 0xea, 0xbd, 0x6a, 0x82, 0xbb, 0x94, 0x25, 0x25, 0x4c, 0x5c, 0xf3, 0xb8, 0x95, 0xd4, 0x94,
+	0xf0, 0xce, 0xc5, 0xdc, 0x7a, 0x69, 0xc0, 0x4c, 0x68, 0xcc, 0x7b, 0xc9, 0xf3, 0x99, 0xb0, 0xf6,
-	0x30, 0x86, 0xae, 0xdd, 0x04, 0x9f, 0x81, 0x93, 0x2b, 0x1b, 0xe5, 0xe3, 0x2d, 0xd6, 0x36, 0xcb,
+	0x18, 0xb0, 0x7a, 0x11, 0xfe, 0xe8, 0x80, 0x37, 0x49, 0x34, 0x1e, 0x43, 0x5f, 0x0a, 0x2a, 0x78,
-	0xfb, 0xcb, 0xd3, 0xd9, 0xac, 0xe4, 0x55, 0x95, 0x38, 0xb9, 0x42, 0x84, 0x8e, 0x39, 0x92, 0x63,
+	0x75, 0xee, 0xfc, 0xb7, 0xdb, 0xa0, 0xe3, 0xd1, 0x51, 0x2d, 0x8d, 0x5b, 0x6c, 0x41, 0xc1, 0x43,
-	0x1a, 0xc4, 0xd8, 0xe1, 0x00, 0x7a, 0x5b, 0x3e, 0x3e, 0x00, 0xb7, 0xc8, 0x85, 0x6d, 0x20, 0x6d,
+	0xf0, 0xb5, 0x2a, 0xa9, 0x72, 0x66, 0x7a, 0xd9, 0x04, 0x77, 0xa2, 0x4a, 0x62, 0x5c, 0x9e, 0x89,
-	0x9a, 0x19, 0xb6, 0xb2, 0x0a, 0x6d, 0x9e, 0x75, 0x6d, 0x43, 0x85, 0xdf, 0x1d, 0xe8, 0xe8, 0x32,
+	0xb8, 0xc5, 0x6a, 0x4a, 0x18, 0x43, 0xdf, 0x3d, 0x04, 0x9f, 0x40, 0x27, 0xd3, 0xae, 0xca, 0x87,
-	0xe0, 0x31, 0xf8, 0x55, 0x9a, 0xf1, 0x82, 0xdb, 0x28, 0xf6, 0x77, 0xa3, 0x98, 0x98, 0x55, 0x73,
+	0xd7, 0x58, 0x37, 0xbb, 0xef, 0x4e, 0xf6, 0xa6, 0xd3, 0x52, 0x54, 0x15, 0xeb, 0x64, 0x1a, 0x11,
-	0x8b, 0x8c, 0x85, 0x2f, 0xc1, 0x2f, 0x38, 0x65, 0x72, 0x66, 0xd3, 0x11, 0xee, 0x2a, 0x34, 0x77,
+	0xba, 0xf6, 0x95, 0x3a, 0x76, 0x5e, 0x6d, 0x1c, 0x8e, 0x60, 0x70, 0xcd, 0x37, 0x6d, 0x2a, 0x32,
-	0x64, 0x3c, 0xb4, 0xaa, 0xf6, 0xc5, 0x4f, 0xd0, 0x63, 0x4b, 0xca, 0x64, 0x99, 0xd3, 0xa6, 0x8d,
+	0xe9, 0xe6, 0xd9, 0x84, 0x76, 0x87, 0x5f, 0x39, 0x85, 0x09, 0xf7, 0xfb, 0x6e, 0xbe, 0xc3, 0x9f,
-	0x5e, 0x37, 0xb9, 0x2f, 0xd1, 0x84, 0xca, 0x5c, 0x5c, 0x6f, 0xda, 0xe2, 0x17, 0x0c, 0x2f, 0xa0,
+	0x1d, 0xe8, 0x1a, 0x57, 0xe0, 0x36, 0xf4, 0xaa, 0x24, 0x15, 0x85, 0x70, 0x55, 0xac, 0xdf, 0xac,
-	0xa3, 0x18, 0x65, 0xb6, 0x35, 0xfe, 0x05, 0x6a, 0x38, 0x61, 0x0c, 0xfd, 0x5b, 0xd3, 0xb8, 0x0f,
+	0x62, 0x6c, 0x4f, 0xad, 0xa9, 0x6d, 0x84, 0x2f, 0xa0, 0x57, 0x08, 0x4a, 0xd5, 0xd4, 0xb5, 0x23,
-	0x1e, 0x5f, 0xb1, 0xb4, 0x7e, 0x99, 0x7a, 0xba, 0x8a, 0x66, 0x88, 0x01, 0xf8, 0xaa, 0xe4, 0x9f,
+	0xbc, 0xa9, 0x30, 0xdc, 0x43, 0x9b, 0x61, 0x54, 0x75, 0x2e, 0x7e, 0x82, 0x01, 0x9f, 0x51, 0xaa,
-	0xf3, 0x3a, 0xbf, 0x7a, 0xc1, 0x8e, 0xb7, 0x49, 0xbe, 0x6b, 0x0c, 0x3f, 0x82, 0x3b, 0x65, 0x0a,
+	0xca, 0x8c, 0x16, 0x53, 0xfd, 0xaa, 0x89, 0x7d, 0xa3, 0x31, 0x95, 0x99, 0x3c, 0x5b, 0x4c, 0xe9,
-	0x3f, 0x40, 0xd7, 0xc6, 0x84, 0x4f, 0xfe, 0x18, 0x6f, 0x18, 0xec, 0x26, 0x78, 0xca, 0xd4, 0xf9,
+	0x6f, 0x18, 0x1e, 0x41, 0x57, 0x73, 0x4a, 0xdd, 0xa4, 0xfe, 0x0f, 0xd4, 0x72, 0xc2, 0x18, 0x86,
-	0x0d, 0x17, 0x74, 0xd8, 0x3a, 0x6e, 0x5f, 0xf9, 0xe6, 0x4d, 0x3d, 0xf9, 0x19, 0x00, 0x00, 0xff,
+	0x4b, 0xdb, 0xb8, 0x0e, 0xbe, 0xb8, 0xe2, 0x49, 0x7d, 0x51, 0x0e, 0xcc, 0x57, 0xb4, 0x4b, 0x0c,
-	0xff, 0x72, 0x21, 0x20, 0xc9, 0x92, 0x05, 0x00, 0x00,
+	0xa0, 0xa7, 0x4b, 0xf1, 0x35, 0xab, 0xfb, 0x6b, 0x0e, 0xdc, 0xfa, 0xba, 0xc9, 0xb7, 0x83, 0x9d,
+	0x8f, 0xe0, 0x4d, 0xb8, 0xc6, 0xf7, 0xd0, 0x77, 0x35, 0xe1, 0xa3, 0xbf, 0xd6, 0x1b, 0x06, 0x37,
+	0x1b, 0x3c, 0xe1, 0xfa, 0xe0, 0x52, 0x48, 0xda, 0x6c, 0x6d, 0xb7, 0x4f, 0x7b, 0xf6, 0x8a, 0xdf,
+	0xfd, 0x15, 0x00, 0x00, 0xff, 0xff, 0x72, 0xb2, 0x8e, 0x8f, 0x21, 0x06, 0x00, 0x00,
 }

controller/gen/public/api.pb.go

@@ -13,6 +13,7 @@ It has these top-level messages:
 	ListPodsResponse
 	Pod
 	TapRequest
+	TapByResourceRequest
 	ApiError
 	Resource
 	ResourceSelection
@@ -359,6 +360,439 @@ func _TapRequest_OneofSizer(msg proto.Message) (n int) {
 	return n
 }
 
+// A tap request over kubernetes resources.
+type TapByResourceRequest struct {
+	// Describes the kubernetes pods that should be tapped.
+	Target *ResourceSelection `protobuf:"bytes,1,opt,name=target" json:"target,omitempty"`
+	// Selects over events to be reported.
+	Match *TapByResourceRequest_Match `protobuf:"bytes,2,opt,name=match" json:"match,omitempty"`
+	// Limits the number of events to be inspected.
+	MaxRps float32 `protobuf:"fixed32,3,opt,name=maxRps" json:"maxRps,omitempty"`
+}
+
+func (m *TapByResourceRequest) Reset()                    { *m = TapByResourceRequest{} }
+func (m *TapByResourceRequest) String() string            { return proto.CompactTextString(m) }
+func (*TapByResourceRequest) ProtoMessage()               {}
+func (*TapByResourceRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{5} }
+
+func (m *TapByResourceRequest) GetTarget() *ResourceSelection {
+	if m != nil {
+		return m.Target
+	}
+	return nil
+}
+
+func (m *TapByResourceRequest) GetMatch() *TapByResourceRequest_Match {
+	if m != nil {
+		return m.Match
+	}
+	return nil
+}
+
+func (m *TapByResourceRequest) GetMaxRps() float32 {
+	if m != nil {
+		return m.MaxRps
+	}
+	return 0
+}
+
+type TapByResourceRequest_Match struct {
+	// Types that are valid to be assigned to Match:
+	//	*TapByResourceRequest_Match_All
+	//	*TapByResourceRequest_Match_Any
+	//	*TapByResourceRequest_Match_Not
+	//	*TapByResourceRequest_Match_Destinations
+	//	*TapByResourceRequest_Match_Http_
+	Match isTapByResourceRequest_Match_Match `protobuf_oneof:"match"`
+}
+
+func (m *TapByResourceRequest_Match) Reset()                    { *m = TapByResourceRequest_Match{} }
+func (m *TapByResourceRequest_Match) String() string            { return proto.CompactTextString(m) }
+func (*TapByResourceRequest_Match) ProtoMessage()               {}
+func (*TapByResourceRequest_Match) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{5, 0} }
+
+type isTapByResourceRequest_Match_Match interface{ isTapByResourceRequest_Match_Match() }
+
+type TapByResourceRequest_Match_All struct {
+	All *TapByResourceRequest_Match_Seq `protobuf:"bytes,1,opt,name=all,oneof"`
+}
+type TapByResourceRequest_Match_Any struct {
+	Any *TapByResourceRequest_Match_Seq `protobuf:"bytes,2,opt,name=any,oneof"`
+}
+type TapByResourceRequest_Match_Not struct {
+	Not *TapByResourceRequest_Match `protobuf:"bytes,3,opt,name=not,oneof"`
+}
+type TapByResourceRequest_Match_Destinations struct {
+	Destinations *ResourceSelection `protobuf:"bytes,4,opt,name=destinations,oneof"`
+}
+type TapByResourceRequest_Match_Http_ struct {
+	Http *TapByResourceRequest_Match_Http `protobuf:"bytes,5,opt,name=http,oneof"`
+}
+
+func (*TapByResourceRequest_Match_All) isTapByResourceRequest_Match_Match()          {}
+func (*TapByResourceRequest_Match_Any) isTapByResourceRequest_Match_Match()          {}
+func (*TapByResourceRequest_Match_Not) isTapByResourceRequest_Match_Match()          {}
+func (*TapByResourceRequest_Match_Destinations) isTapByResourceRequest_Match_Match() {}
+func (*TapByResourceRequest_Match_Http_) isTapByResourceRequest_Match_Match()        {}
+
+func (m *TapByResourceRequest_Match) GetMatch() isTapByResourceRequest_Match_Match {
+	if m != nil {
+		return m.Match
+	}
+	return nil
+}
+
+func (m *TapByResourceRequest_Match) GetAll() *TapByResourceRequest_Match_Seq {
+	if x, ok := m.GetMatch().(*TapByResourceRequest_Match_All); ok {
+		return x.All
+	}
+	return nil
+}
+
+func (m *TapByResourceRequest_Match) GetAny() *TapByResourceRequest_Match_Seq {
+	if x, ok := m.GetMatch().(*TapByResourceRequest_Match_Any); ok {
+		return x.Any
+	}
+	return nil
+}
+
+func (m *TapByResourceRequest_Match) GetNot() *TapByResourceRequest_Match {
+	if x, ok := m.GetMatch().(*TapByResourceRequest_Match_Not); ok {
+		return x.Not
+	}
+	return nil
+}
+
+func (m *TapByResourceRequest_Match) GetDestinations() *ResourceSelection {
+	if x, ok := m.GetMatch().(*TapByResourceRequest_Match_Destinations); ok {
+		return x.Destinations
+	}
+	return nil
+}
+
+func (m *TapByResourceRequest_Match) GetHttp() *TapByResourceRequest_Match_Http {
+	if x, ok := m.GetMatch().(*TapByResourceRequest_Match_Http_); ok {
+		return x.Http
+	}
+	return nil
+}
+
+// XXX_OneofFuncs is for the internal use of the proto package.
+func (*TapByResourceRequest_Match) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
+	return _TapByResourceRequest_Match_OneofMarshaler, _TapByResourceRequest_Match_OneofUnmarshaler, _TapByResourceRequest_Match_OneofSizer, []interface{}{
+		(*TapByResourceRequest_Match_All)(nil),
+		(*TapByResourceRequest_Match_Any)(nil),
+		(*TapByResourceRequest_Match_Not)(nil),
+		(*TapByResourceRequest_Match_Destinations)(nil),
+		(*TapByResourceRequest_Match_Http_)(nil),
+	}
+}
+
+func _TapByResourceRequest_Match_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
+	m := msg.(*TapByResourceRequest_Match)
+	// match
+	switch x := m.Match.(type) {
+	case *TapByResourceRequest_Match_All:
+		b.EncodeVarint(1<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.All); err != nil {
+			return err
+		}
+	case *TapByResourceRequest_Match_Any:
+		b.EncodeVarint(2<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Any); err != nil {
+			return err
+		}
+	case *TapByResourceRequest_Match_Not:
+		b.EncodeVarint(3<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Not); err != nil {
+			return err
+		}
+	case *TapByResourceRequest_Match_Destinations:
+		b.EncodeVarint(4<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Destinations); err != nil {
+			return err
+		}
+	case *TapByResourceRequest_Match_Http_:
+		b.EncodeVarint(5<<3 | proto.WireBytes)
+		if err := b.EncodeMessage(x.Http); err != nil {
+			return err
+		}
+	case nil:
+	default:
+		return fmt.Errorf("TapByResourceRequest_Match.Match has unexpected type %T", x)
+	}
+	return nil
+}
+
+func _TapByResourceRequest_Match_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
+	m := msg.(*TapByResourceRequest_Match)
+	switch tag {
+	case 1: // match.all
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(TapByResourceRequest_Match_Seq)
+		err := b.DecodeMessage(msg)
+		m.Match = &TapByResourceRequest_Match_All{msg}
+		return true, err
+	case 2: // match.any
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(TapByResourceRequest_Match_Seq)
+		err := b.DecodeMessage(msg)
+		m.Match = &TapByResourceRequest_Match_Any{msg}
+		return true, err
+	case 3: // match.not
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(TapByResourceRequest_Match)
+		err := b.DecodeMessage(msg)
+		m.Match = &TapByResourceRequest_Match_Not{msg}
+		return true, err
+	case 4: // match.destinations
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(ResourceSelection)
+		err := b.DecodeMessage(msg)
+		m.Match = &TapByResourceRequest_Match_Destinations{msg}
+		return true, err
+	case 5: // match.http
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		msg := new(TapByResourceRequest_Match_Http)
+		err := b.DecodeMessage(msg)
+		m.Match = &TapByResourceRequest_Match_Http_{msg}
+		return true, err
+	default:
+		return false, nil
+	}
+}
+
+func _TapByResourceRequest_Match_OneofSizer(msg proto.Message) (n int) {
+	m := msg.(*TapByResourceRequest_Match)
+	// match
+	switch x := m.Match.(type) {
+	case *TapByResourceRequest_Match_All:
+		s := proto.Size(x.All)
+		n += proto.SizeVarint(1<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *TapByResourceRequest_Match_Any:
+		s := proto.Size(x.Any)
+		n += proto.SizeVarint(2<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *TapByResourceRequest_Match_Not:
+		s := proto.Size(x.Not)
+		n += proto.SizeVarint(3<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *TapByResourceRequest_Match_Destinations:
+		s := proto.Size(x.Destinations)
+		n += proto.SizeVarint(4<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case *TapByResourceRequest_Match_Http_:
+		s := proto.Size(x.Http)
+		n += proto.SizeVarint(5<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(s))
+		n += s
+	case nil:
+	default:
+		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
+	}
+	return n
+}
+
+type TapByResourceRequest_Match_Seq struct {
+	Matches []*TapByResourceRequest_Match `protobuf:"bytes,1,rep,name=matches" json:"matches,omitempty"`
+}
+
+func (m *TapByResourceRequest_Match_Seq) Reset()         { *m = TapByResourceRequest_Match_Seq{} }
+func (m *TapByResourceRequest_Match_Seq) String() string { return proto.CompactTextString(m) }
+func (*TapByResourceRequest_Match_Seq) ProtoMessage()    {}
+func (*TapByResourceRequest_Match_Seq) Descriptor() ([]byte, []int) {
+	return fileDescriptor0, []int{5, 0, 0}
+}
+
+func (m *TapByResourceRequest_Match_Seq) GetMatches() []*TapByResourceRequest_Match {
+	if m != nil {
+		return m.Matches
+	}
+	return nil
+}
+
+type TapByResourceRequest_Match_Http struct {
+	// Types that are valid to be assigned to Match:
+	//	*TapByResourceRequest_Match_Http_Scheme
+	//	*TapByResourceRequest_Match_Http_Method
+	//	*TapByResourceRequest_Match_Http_Authority
+	//	*TapByResourceRequest_Match_Http_Path
+	Match isTapByResourceRequest_Match_Http_Match `protobuf_oneof:"match"`
+}
+
+func (m *TapByResourceRequest_Match_Http) Reset()         { *m = TapByResourceRequest_Match_Http{} }
+func (m *TapByResourceRequest_Match_Http) String() string { return proto.CompactTextString(m) }
+func (*TapByResourceRequest_Match_Http) ProtoMessage()    {}
+func (*TapByResourceRequest_Match_Http) Descriptor() ([]byte, []int) {
+	return fileDescriptor0, []int{5, 0, 1}
+}
+
+type isTapByResourceRequest_Match_Http_Match interface{ isTapByResourceRequest_Match_Http_Match() }
+
+type TapByResourceRequest_Match_Http_Scheme struct {
+	Scheme string `protobuf:"bytes,1,opt,name=scheme,oneof"`
+}
+type TapByResourceRequest_Match_Http_Method struct {
+	Method string `protobuf:"bytes,2,opt,name=method,oneof"`
+}
+type TapByResourceRequest_Match_Http_Authority struct {
+	Authority string `protobuf:"bytes,3,opt,name=authority,oneof"`
+}
+type TapByResourceRequest_Match_Http_Path struct {
+	Path string `protobuf:"bytes,4,opt,name=path,oneof"`
+}
+
+func (*TapByResourceRequest_Match_Http_Scheme) isTapByResourceRequest_Match_Http_Match()    {}
+func (*TapByResourceRequest_Match_Http_Method) isTapByResourceRequest_Match_Http_Match()    {}
+func (*TapByResourceRequest_Match_Http_Authority) isTapByResourceRequest_Match_Http_Match() {}
+func (*TapByResourceRequest_Match_Http_Path) isTapByResourceRequest_Match_Http_Match()      {}
+
+func (m *TapByResourceRequest_Match_Http) GetMatch() isTapByResourceRequest_Match_Http_Match {
+	if m != nil {
+		return m.Match
+	}
+	return nil
+}
+
+func (m *TapByResourceRequest_Match_Http) GetScheme() string {
+	if x, ok := m.GetMatch().(*TapByResourceRequest_Match_Http_Scheme); ok {
+		return x.Scheme
+	}
+	return ""
+}
+
+func (m *TapByResourceRequest_Match_Http) GetMethod() string {
+	if x, ok := m.GetMatch().(*TapByResourceRequest_Match_Http_Method); ok {
+		return x.Method
+	}
+	return ""
+}
+
+func (m *TapByResourceRequest_Match_Http) GetAuthority() string {
+	if x, ok := m.GetMatch().(*TapByResourceRequest_Match_Http_Authority); ok {
+		return x.Authority
+	}
+	return ""
+}
+
+func (m *TapByResourceRequest_Match_Http) GetPath() string {
+	if x, ok := m.GetMatch().(*TapByResourceRequest_Match_Http_Path); ok {
+		return x.Path
+	}
+	return ""
+}
+
+// XXX_OneofFuncs is for the internal use of the proto package.
+func (*TapByResourceRequest_Match_Http) XXX_OneofFuncs() (func(msg proto.Message, b *proto.Buffer) error, func(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error), func(msg proto.Message) (n int), []interface{}) {
+	return _TapByResourceRequest_Match_Http_OneofMarshaler, _TapByResourceRequest_Match_Http_OneofUnmarshaler, _TapByResourceRequest_Match_Http_OneofSizer, []interface{}{
+		(*TapByResourceRequest_Match_Http_Scheme)(nil),
+		(*TapByResourceRequest_Match_Http_Method)(nil),
+		(*TapByResourceRequest_Match_Http_Authority)(nil),
+		(*TapByResourceRequest_Match_Http_Path)(nil),
+	}
+}
+
+func _TapByResourceRequest_Match_Http_OneofMarshaler(msg proto.Message, b *proto.Buffer) error {
+	m := msg.(*TapByResourceRequest_Match_Http)
+	// match
+	switch x := m.Match.(type) {
+	case *TapByResourceRequest_Match_Http_Scheme:
+		b.EncodeVarint(1<<3 | proto.WireBytes)
+		b.EncodeStringBytes(x.Scheme)
+	case *TapByResourceRequest_Match_Http_Method:
+		b.EncodeVarint(2<<3 | proto.WireBytes)
+		b.EncodeStringBytes(x.Method)
+	case *TapByResourceRequest_Match_Http_Authority:
+		b.EncodeVarint(3<<3 | proto.WireBytes)
+		b.EncodeStringBytes(x.Authority)
+	case *TapByResourceRequest_Match_Http_Path:
+		b.EncodeVarint(4<<3 | proto.WireBytes)
+		b.EncodeStringBytes(x.Path)
+	case nil:
+	default:
+		return fmt.Errorf("TapByResourceRequest_Match_Http.Match has unexpected type %T", x)
+	}
+	return nil
+}
+
+func _TapByResourceRequest_Match_Http_OneofUnmarshaler(msg proto.Message, tag, wire int, b *proto.Buffer) (bool, error) {
+	m := msg.(*TapByResourceRequest_Match_Http)
+	switch tag {
+	case 1: // match.scheme
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeStringBytes()
+		m.Match = &TapByResourceRequest_Match_Http_Scheme{x}
+		return true, err
+	case 2: // match.method
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeStringBytes()
+		m.Match = &TapByResourceRequest_Match_Http_Method{x}
+		return true, err
+	case 3: // match.authority
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeStringBytes()
+		m.Match = &TapByResourceRequest_Match_Http_Authority{x}
+		return true, err
+	case 4: // match.path
+		if wire != proto.WireBytes {
+			return true, proto.ErrInternalBadWireType
+		}
+		x, err := b.DecodeStringBytes()
+		m.Match = &TapByResourceRequest_Match_Http_Path{x}
+		return true, err
+	default:
+		return false, nil
+	}
+}
+
+func _TapByResourceRequest_Match_Http_OneofSizer(msg proto.Message) (n int) {
+	m := msg.(*TapByResourceRequest_Match_Http)
+	// match
+	switch x := m.Match.(type) {
+	case *TapByResourceRequest_Match_Http_Scheme:
+		n += proto.SizeVarint(1<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(len(x.Scheme)))
+		n += len(x.Scheme)
+	case *TapByResourceRequest_Match_Http_Method:
+		n += proto.SizeVarint(2<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(len(x.Method)))
+		n += len(x.Method)
+	case *TapByResourceRequest_Match_Http_Authority:
+		n += proto.SizeVarint(3<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(len(x.Authority)))
+		n += len(x.Authority)
+	case *TapByResourceRequest_Match_Http_Path:
+		n += proto.SizeVarint(4<<3 | proto.WireBytes)
+		n += proto.SizeVarint(uint64(len(x.Path)))
+		n += len(x.Path)
+	case nil:
+	default:
+		panic(fmt.Sprintf("proto: unexpected type %T in oneof", x))
+	}
+	return n
+}
+
 type ApiError struct {
 	Error string `protobuf:"bytes,1,opt,name=error" json:"error,omitempty"`
 }
@@ -366,7 +800,7 @@ type ApiError struct {
 func (m *ApiError) Reset()                    { *m = ApiError{} }
 func (m *ApiError) String() string            { return proto.CompactTextString(m) }
 func (*ApiError) ProtoMessage()               {}
-func (*ApiError) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{5} }
+func (*ApiError) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{6} }
 
 func (m *ApiError) GetError() string {
 	if m != nil {
@@ -376,15 +810,24 @@ func (m *ApiError) GetError() string {
 }
 
 type Resource struct {
+	// The namespace the resource is in.
+	//
+	// If empty, indicates all namespaces should be considered.
 	Namespace string `protobuf:"bytes,1,opt,name=namespace" json:"namespace,omitempty"`
-	Type      string `protobuf:"bytes,2,opt,name=type" json:"type,omitempty"`
+	// The type of Kubernetes resource.
-	Name      string `protobuf:"bytes,3,opt,name=name" json:"name,omitempty"`
+	//
+	// E.g. pod, deployment, service, ...
+	//
+	// If `all` refers, to all resource types.
+	Type string `protobuf:"bytes,2,opt,name=type" json:"type,omitempty"`
+	// An optional Kubernetes resource name.
+	Name string `protobuf:"bytes,3,opt,name=name" json:"name,omitempty"`
 }
 
 func (m *Resource) Reset()                    { *m = Resource{} }
 func (m *Resource) String() string            { return proto.CompactTextString(m) }
 func (*Resource) ProtoMessage()               {}
-func (*Resource) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{6} }
+func (*Resource) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7} }
 
 func (m *Resource) GetNamespace() string {
 	if m != nil {
@@ -408,14 +851,20 @@ func (m *Resource) GetName() string {
 }
 
 type ResourceSelection struct {
-	Resource      *Resource `protobuf:"bytes,1,opt,name=resource" json:"resource,omitempty"`
+	// Identifies a Kubernetes resource.
-	LabelSelector string    `protobuf:"bytes,2,opt,name=label_selector,json=labelSelector" json:"label_selector,omitempty"`
+	Resource *Resource `protobuf:"bytes,1,opt,name=resource" json:"resource,omitempty"`
+	// A string-formatted Kubernetes label selector as passed to `kubectl get
+	// --selector`.
+	//
+	// XXX in the future this may be superceded by a data structure that more
+	// richly describes a parsed label selector.
+	LabelSelector string `protobuf:"bytes,2,opt,name=label_selector,json=labelSelector" json:"label_selector,omitempty"`
 }
 
 func (m *ResourceSelection) Reset()                    { *m = ResourceSelection{} }
 func (m *ResourceSelection) String() string            { return proto.CompactTextString(m) }
 func (*ResourceSelection) ProtoMessage()               {}
-func (*ResourceSelection) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{7} }
+func (*ResourceSelection) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{8} }
 
 func (m *ResourceSelection) GetResource() *Resource {
 	if m != nil {
@@ -439,7 +888,7 @@ type ResourceError struct {
 func (m *ResourceError) Reset()                    { *m = ResourceError{} }
 func (m *ResourceError) String() string            { return proto.CompactTextString(m) }
 func (*ResourceError) ProtoMessage()               {}
-func (*ResourceError) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{8} }
+func (*ResourceError) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{9} }
 
 func (m *ResourceError) GetResource() *Resource {
 	if m != nil {
@@ -468,7 +917,7 @@ type StatSummaryRequest struct {
 func (m *StatSummaryRequest) Reset()                    { *m = StatSummaryRequest{} }
 func (m *StatSummaryRequest) String() string            { return proto.CompactTextString(m) }
 func (*StatSummaryRequest) ProtoMessage()               {}
-func (*StatSummaryRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{9} }
+func (*StatSummaryRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{10} }
 
 type isStatSummaryRequest_Outbound interface{ isStatSummaryRequest_Outbound() }
 
@@ -631,7 +1080,7 @@ type StatSummaryResponse struct {
 func (m *StatSummaryResponse) Reset()                    { *m = StatSummaryResponse{} }
 func (m *StatSummaryResponse) String() string            { return proto.CompactTextString(m) }
 func (*StatSummaryResponse) ProtoMessage()               {}
-func (*StatSummaryResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{10} }
+func (*StatSummaryResponse) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{11} }
 
 type isStatSummaryResponse_Response interface{ isStatSummaryResponse_Response() }
 
@@ -747,7 +1196,7 @@ type StatSummaryResponse_Ok struct {
 func (m *StatSummaryResponse_Ok) Reset()                    { *m = StatSummaryResponse_Ok{} }
 func (m *StatSummaryResponse_Ok) String() string            { return proto.CompactTextString(m) }
 func (*StatSummaryResponse_Ok) ProtoMessage()               {}
-func (*StatSummaryResponse_Ok) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{10, 0} }
+func (*StatSummaryResponse_Ok) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{11, 0} }
 
 func (m *StatSummaryResponse_Ok) GetStatTables() []*StatTable {
 	if m != nil {
@@ -767,7 +1216,7 @@ type BasicStats struct {
 func (m *BasicStats) Reset()                    { *m = BasicStats{} }
 func (m *BasicStats) String() string            { return proto.CompactTextString(m) }
 func (*BasicStats) ProtoMessage()               {}
-func (*BasicStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{11} }
+func (*BasicStats) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{12} }
 
 func (m *BasicStats) GetSuccessCount() uint64 {
 	if m != nil {
@@ -813,7 +1262,7 @@ type StatTable struct {
 func (m *StatTable) Reset()                    { *m = StatTable{} }
 func (m *StatTable) String() string            { return proto.CompactTextString(m) }
 func (*StatTable) ProtoMessage()               {}
-func (*StatTable) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{12} }
+func (*StatTable) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{13} }
 
 type isStatTable_Table interface{ isStatTable_Table() }
 
@@ -899,7 +1348,7 @@ type StatTable_PodGroup struct {
 func (m *StatTable_PodGroup) Reset()                    { *m = StatTable_PodGroup{} }
 func (m *StatTable_PodGroup) String() string            { return proto.CompactTextString(m) }
 func (*StatTable_PodGroup) ProtoMessage()               {}
-func (*StatTable_PodGroup) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{12, 0} }
+func (*StatTable_PodGroup) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{13, 0} }
 
 func (m *StatTable_PodGroup) GetRows() []*StatTable_PodGroup_Row {
 	if m != nil {
@@ -919,7 +1368,7 @@ type StatTable_PodGroup_Row struct {
 func (m *StatTable_PodGroup_Row) Reset()                    { *m = StatTable_PodGroup_Row{} }
 func (m *StatTable_PodGroup_Row) String() string            { return proto.CompactTextString(m) }
 func (*StatTable_PodGroup_Row) ProtoMessage()               {}
-func (*StatTable_PodGroup_Row) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{12, 0, 0} }
+func (*StatTable_PodGroup_Row) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{13, 0, 0} }
 
 func (m *StatTable_PodGroup_Row) GetResource() *Resource {
 	if m != nil {
@@ -962,6 +1411,10 @@ func init() {
 	proto.RegisterType((*ListPodsResponse)(nil), "conduit.public.ListPodsResponse")
 	proto.RegisterType((*Pod)(nil), "conduit.public.Pod")
 	proto.RegisterType((*TapRequest)(nil), "conduit.public.TapRequest")
+	proto.RegisterType((*TapByResourceRequest)(nil), "conduit.public.TapByResourceRequest")
+	proto.RegisterType((*TapByResourceRequest_Match)(nil), "conduit.public.TapByResourceRequest.Match")
+	proto.RegisterType((*TapByResourceRequest_Match_Seq)(nil), "conduit.public.TapByResourceRequest.Match.Seq")
+	proto.RegisterType((*TapByResourceRequest_Match_Http)(nil), "conduit.public.TapByResourceRequest.Match.Http")
 	proto.RegisterType((*ApiError)(nil), "conduit.public.ApiError")
 	proto.RegisterType((*Resource)(nil), "conduit.public.Resource")
 	proto.RegisterType((*ResourceSelection)(nil), "conduit.public.ResourceSelection")
@@ -987,10 +1440,13 @@ const _ = grpc.SupportPackageIsVersion4
 
 type ApiClient interface {
 	StatSummary(ctx context.Context, in *StatSummaryRequest, opts ...grpc.CallOption) (*StatSummaryResponse, error)
-	Version(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*VersionInfo, error)
 	ListPods(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*ListPodsResponse, error)
-	SelfCheck(ctx context.Context, in *conduit_common_healthcheck.SelfCheckRequest, opts ...grpc.CallOption) (*conduit_common_healthcheck.SelfCheckResponse, error)
+	// Superceded by `TapByResource`.
 	Tap(ctx context.Context, in *TapRequest, opts ...grpc.CallOption) (Api_TapClient, error)
+	// Executes tapping over Kubernetes resources.
+	TapByResource(ctx context.Context, in *TapByResourceRequest, opts ...grpc.CallOption) (Api_TapByResourceClient, error)
+	Version(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*VersionInfo, error)
+	SelfCheck(ctx context.Context, in *conduit_common_healthcheck.SelfCheckRequest, opts ...grpc.CallOption) (*conduit_common_healthcheck.SelfCheckResponse, error)
 }
 
 type apiClient struct {
@@ -1010,15 +1466,6 @@ func (c *apiClient) StatSummary(ctx context.Context, in *StatSummaryRequest, opt
 	return out, nil
 }
 
-func (c *apiClient) Version(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*VersionInfo, error) {
-	out := new(VersionInfo)
-	err := grpc.Invoke(ctx, "/conduit.public.Api/Version", in, out, c.cc, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *apiClient) ListPods(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*ListPodsResponse, error) {
 	out := new(ListPodsResponse)
 	err := grpc.Invoke(ctx, "/conduit.public.Api/ListPods", in, out, c.cc, opts...)
@@ -1028,15 +1475,6 @@ func (c *apiClient) ListPods(ctx context.Context, in *Empty, opts ...grpc.CallOp
 	return out, nil
 }
 
-func (c *apiClient) SelfCheck(ctx context.Context, in *conduit_common_healthcheck.SelfCheckRequest, opts ...grpc.CallOption) (*conduit_common_healthcheck.SelfCheckResponse, error) {
-	out := new(conduit_common_healthcheck.SelfCheckResponse)
-	err := grpc.Invoke(ctx, "/conduit.public.Api/SelfCheck", in, out, c.cc, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *apiClient) Tap(ctx context.Context, in *TapRequest, opts ...grpc.CallOption) (Api_TapClient, error) {
 	stream, err := grpc.NewClientStream(ctx, &_Api_serviceDesc.Streams[0], c.cc, "/conduit.public.Api/Tap", opts...)
 	if err != nil {
@@ -1069,14 +1507,67 @@ func (x *apiTapClient) Recv() (*conduit_common.TapEvent, error) {
 	return m, nil
 }
 
+func (c *apiClient) TapByResource(ctx context.Context, in *TapByResourceRequest, opts ...grpc.CallOption) (Api_TapByResourceClient, error) {
+	stream, err := grpc.NewClientStream(ctx, &_Api_serviceDesc.Streams[1], c.cc, "/conduit.public.Api/TapByResource", opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &apiTapByResourceClient{stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type Api_TapByResourceClient interface {
+	Recv() (*conduit_common.TapEvent, error)
+	grpc.ClientStream
+}
+
+type apiTapByResourceClient struct {
+	grpc.ClientStream
+}
+
+func (x *apiTapByResourceClient) Recv() (*conduit_common.TapEvent, error) {
+	m := new(conduit_common.TapEvent)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func (c *apiClient) Version(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*VersionInfo, error) {
+	out := new(VersionInfo)
+	err := grpc.Invoke(ctx, "/conduit.public.Api/Version", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *apiClient) SelfCheck(ctx context.Context, in *conduit_common_healthcheck.SelfCheckRequest, opts ...grpc.CallOption) (*conduit_common_healthcheck.SelfCheckResponse, error) {
+	out := new(conduit_common_healthcheck.SelfCheckResponse)
+	err := grpc.Invoke(ctx, "/conduit.public.Api/SelfCheck", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // Server API for Api service
 
 type ApiServer interface {
 	StatSummary(context.Context, *StatSummaryRequest) (*StatSummaryResponse, error)
-	Version(context.Context, *Empty) (*VersionInfo, error)
 	ListPods(context.Context, *Empty) (*ListPodsResponse, error)
-	SelfCheck(context.Context, *conduit_common_healthcheck.SelfCheckRequest) (*conduit_common_healthcheck.SelfCheckResponse, error)
+	// Superceded by `TapByResource`.
 	Tap(*TapRequest, Api_TapServer) error
+	// Executes tapping over Kubernetes resources.
+	TapByResource(*TapByResourceRequest, Api_TapByResourceServer) error
+	Version(context.Context, *Empty) (*VersionInfo, error)
+	SelfCheck(context.Context, *conduit_common_healthcheck.SelfCheckRequest) (*conduit_common_healthcheck.SelfCheckResponse, error)
 }
 
 func RegisterApiServer(s *grpc.Server, srv ApiServer) {
@@ -1101,24 +1592,6 @@ func _Api_StatSummary_Handler(srv interface{}, ctx context.Context, dec func(int
 	return interceptor(ctx, in, info, handler)
 }
 
-func _Api_Version_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(Empty)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ApiServer).Version(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/conduit.public.Api/Version",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ApiServer).Version(ctx, req.(*Empty))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _Api_ListPods_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(Empty)
 	if err := dec(in); err != nil {
@@ -1137,24 +1610,6 @@ func _Api_ListPods_Handler(srv interface{}, ctx context.Context, dec func(interf
 	return interceptor(ctx, in, info, handler)
 }
 
-func _Api_SelfCheck_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(conduit_common_healthcheck.SelfCheckRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(ApiServer).SelfCheck(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/conduit.public.Api/SelfCheck",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ApiServer).SelfCheck(ctx, req.(*conduit_common_healthcheck.SelfCheckRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _Api_Tap_Handler(srv interface{}, stream grpc.ServerStream) error {
 	m := new(TapRequest)
 	if err := stream.RecvMsg(m); err != nil {
@@ -1176,6 +1631,63 @@ func (x *apiTapServer) Send(m *conduit_common.TapEvent) error {
 	return x.ServerStream.SendMsg(m)
 }
 
+func _Api_TapByResource_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(TapByResourceRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(ApiServer).TapByResource(m, &apiTapByResourceServer{stream})
+}
+
+type Api_TapByResourceServer interface {
+	Send(*conduit_common.TapEvent) error
+	grpc.ServerStream
+}
+
+type apiTapByResourceServer struct {
+	grpc.ServerStream
+}
+
+func (x *apiTapByResourceServer) Send(m *conduit_common.TapEvent) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+func _Api_Version_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ApiServer).Version(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/conduit.public.Api/Version",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ApiServer).Version(ctx, req.(*Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Api_SelfCheck_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(conduit_common_healthcheck.SelfCheckRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ApiServer).SelfCheck(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/conduit.public.Api/SelfCheck",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ApiServer).SelfCheck(ctx, req.(*conduit_common_healthcheck.SelfCheckRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 var _Api_serviceDesc = grpc.ServiceDesc{
 	ServiceName: "conduit.public.Api",
 	HandlerType: (*ApiServer)(nil),
@@ -1184,14 +1696,14 @@ var _Api_serviceDesc = grpc.ServiceDesc{
 			MethodName: "StatSummary",
 			Handler:    _Api_StatSummary_Handler,
 		},
-		{
-			MethodName: "Version",
-			Handler:    _Api_Version_Handler,
-		},
 		{
 			MethodName: "ListPods",
 			Handler:    _Api_ListPods_Handler,
 		},
+		{
+			MethodName: "Version",
+			Handler:    _Api_Version_Handler,
+		},
 		{
 			MethodName: "SelfCheck",
 			Handler:    _Api_SelfCheck_Handler,
@@ -1203,6 +1715,11 @@ var _Api_serviceDesc = grpc.ServiceDesc{
 			Handler:       _Api_Tap_Handler,
 			ServerStreams: true,
 		},
+		{
+			StreamName:    "TapByResource",
+			Handler:       _Api_TapByResource_Handler,
+			ServerStreams: true,
+		},
 	},
 	Metadata: "public/api.proto",
 }
@@ -1210,77 +1727,90 @@ var _Api_serviceDesc = grpc.ServiceDesc{
 func init() { proto.RegisterFile("public/api.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 1141 bytes of a gzipped FileDescriptorProto
+	// 1346 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x56, 0xdf, 0x6e, 0x1b, 0xc5,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x57, 0xdd, 0x6e, 0x1b, 0x45,
-	0x17, 0xb6, 0xd7, 0x76, 0xb2, 0x3e, 0x8e, 0xd3, 0xfe, 0x26, 0x3f, 0xd0, 0xd6, 0x40, 0x31, 0xdb,
+	0x14, 0xb6, 0xbd, 0x76, 0x62, 0x1f, 0xc7, 0x69, 0x99, 0x14, 0xb4, 0x35, 0x50, 0xcc, 0xb6, 0x84,
-	0x12, 0x22, 0x01, 0x4e, 0x64, 0x88, 0x44, 0x5a, 0xa1, 0xd2, 0xb4, 0x11, 0x89, 0x54, 0xe8, 0x6a,
+	0x88, 0x1f, 0x27, 0x32, 0x44, 0x22, 0xad, 0xa0, 0x6d, 0xda, 0xa8, 0x8e, 0x68, 0xa9, 0x35, 0x8e,
-	0x12, 0x01, 0x12, 0x17, 0xd6, 0x78, 0x77, 0x12, 0x2f, 0xd9, 0xdd, 0x99, 0xee, 0xcc, 0x12, 0x7c,
+	0x00, 0x89, 0x0b, 0x6b, 0xbc, 0x3b, 0x89, 0x97, 0xec, 0xee, 0x4c, 0x76, 0x66, 0x09, 0xbe, 0xe6,
-	0xcd, 0x2b, 0x70, 0xc1, 0x13, 0x20, 0x21, 0x5e, 0x84, 0x07, 0xe0, 0x01, 0x78, 0x14, 0x34, 0x7f,
+	0x25, 0x78, 0x02, 0x24, 0xc4, 0x0d, 0x8f, 0xc1, 0x03, 0x70, 0x8d, 0xb8, 0xe5, 0x2d, 0xd0, 0xfc,
-	0x76, 0x63, 0x6f, 0x93, 0xa6, 0xea, 0x95, 0xe7, 0x7c, 0xf3, 0x9d, 0x33, 0xe7, 0x9c, 0xef, 0xcc,
+	0xec, 0xc6, 0x76, 0x93, 0x26, 0xed, 0x95, 0xe7, 0x7c, 0xf3, 0x9d, 0x99, 0xf3, 0x3f, 0x5e, 0xb8,
-	0x7a, 0xe0, 0x36, 0x2f, 0xa6, 0x49, 0x1c, 0x6e, 0x13, 0x1e, 0x8f, 0x78, 0xce, 0x24, 0x43, 0xeb,
+	0xce, 0xb3, 0x71, 0x14, 0xfa, 0x9b, 0x84, 0x87, 0x5d, 0x9e, 0x32, 0xc9, 0xd0, 0xaa, 0xcf, 0x92,
-	0x21, 0xcb, 0xa2, 0x22, 0x96, 0x23, 0xb3, 0x33, 0xb8, 0x7b, 0xc6, 0xd8, 0x59, 0x42, 0xb7, 0xf5,
+	0x20, 0x0b, 0x65, 0xd7, 0xec, 0xb4, 0x6f, 0x1d, 0x31, 0x76, 0x14, 0xd1, 0x4d, 0xbd, 0x3b, 0xce,
-	0xee, 0xb4, 0x38, 0xdd, 0x8e, 0x8a, 0x9c, 0xc8, 0x98, 0x65, 0x86, 0x3f, 0xd8, 0x08, 0x59, 0x9a,
+	0x0e, 0x37, 0x83, 0x2c, 0x25, 0x32, 0x64, 0x89, 0xe1, 0xb7, 0xd7, 0x7c, 0x16, 0xc7, 0x2c, 0xd9,
-	0xb2, 0x6c, 0xdb, 0xfc, 0x58, 0xf0, 0xbe, 0x05, 0x67, 0x94, 0x24, 0x72, 0x16, 0xce, 0x68, 0x78,
+	0x34, 0x3f, 0x16, 0xbc, 0x63, 0xc1, 0x09, 0x25, 0x91, 0x9c, 0xf8, 0x13, 0xea, 0x1f, 0xcf, 0xae,
-	0xbe, 0xb8, 0x36, 0x2c, 0x7f, 0x15, 0x3a, 0x07, 0x29, 0x97, 0x73, 0xff, 0x05, 0xf4, 0xbe, 0xa3,
+	0x0d, 0xcb, 0x5b, 0x86, 0xda, 0x5e, 0xcc, 0xe5, 0xd4, 0x3b, 0x81, 0xe6, 0xb7, 0x34, 0x15, 0x21,
-	0xb9, 0x88, 0x59, 0x76, 0x94, 0x9d, 0x32, 0xf4, 0x2e, 0x74, 0xcf, 0x98, 0x05, 0xbc, 0xe6, 0xb0,
+	0x4b, 0xf6, 0x93, 0x43, 0x86, 0xde, 0x81, 0xc6, 0x11, 0xb3, 0x80, 0x5b, 0xee, 0x94, 0x37, 0x1a,
-	0xb9, 0xd5, 0xc5, 0x97, 0x80, 0xda, 0x9d, 0x16, 0x71, 0x12, 0x3d, 0x25, 0x92, 0x7a, 0x8e, 0xd9,
+	0xf8, 0x0c, 0x50, 0xbb, 0xe3, 0x2c, 0x8c, 0x82, 0xc7, 0x44, 0x52, 0xb7, 0x62, 0x76, 0x0b, 0x00,
-	0xad, 0x00, 0xb4, 0x09, 0xeb, 0x39, 0x4d, 0x28, 0x11, 0xb4, 0x0c, 0xd0, 0xd2, 0x94, 0x1a, 0xea,
+	0xad, 0xc3, 0x6a, 0x4a, 0x23, 0x4a, 0x04, 0xcd, 0x0f, 0x70, 0x34, 0x65, 0x01, 0xf5, 0xee, 0xc1,
-	0x3f, 0x84, 0xdb, 0xcf, 0x62, 0x21, 0x03, 0x16, 0x09, 0x4c, 0x05, 0x67, 0x99, 0xa0, 0xe8, 0x23,
+	0xf5, 0xa7, 0xa1, 0x90, 0x03, 0x16, 0x08, 0x4c, 0x05, 0x67, 0x89, 0xa0, 0xe8, 0x43, 0xa8, 0x72,
-	0x68, 0x73, 0x16, 0x09, 0xaf, 0x39, 0x6c, 0x6d, 0xf5, 0xc6, 0x1b, 0xa3, 0xe5, 0x4e, 0x8c, 0x02,
+	0x16, 0x08, 0xb7, 0xdc, 0x71, 0x36, 0x9a, 0xbd, 0xb5, 0xee, 0x7c, 0x24, 0xba, 0x03, 0x16, 0x60,
-	0x16, 0x61, 0x4d, 0xf0, 0x7f, 0x77, 0xa0, 0x15, 0xb0, 0x08, 0x21, 0x68, 0x67, 0x24, 0xa5, 0x36,
+	0x4d, 0xf0, 0x7e, 0xad, 0x80, 0x33, 0x60, 0x01, 0x42, 0x50, 0x4d, 0x48, 0x4c, 0xad, 0x8d, 0x7a,
-	0x47, 0xbd, 0x46, 0xff, 0x87, 0x0e, 0x67, 0xd1, 0x51, 0x60, 0x53, 0x33, 0x06, 0xba, 0x0b, 0x10,
+	0x8d, 0x6e, 0x40, 0x8d, 0xb3, 0x60, 0x7f, 0x60, 0x4d, 0x33, 0x02, 0xba, 0x05, 0x10, 0x50, 0x1e,
-	0x51, 0x9e, 0xb0, 0x79, 0x4a, 0x33, 0x69, 0x53, 0x5a, 0x40, 0xd0, 0xdb, 0xb0, 0x22, 0x24, 0x91,
+	0xb1, 0x69, 0x4c, 0x13, 0x69, 0x4d, 0x9a, 0x41, 0xd0, 0x5b, 0xb0, 0x24, 0x24, 0x91, 0x99, 0x70,
-	0x85, 0xf0, 0xda, 0x7a, 0xcf, 0x5a, 0x2a, 0x1a, 0x89, 0x22, 0x1a, 0x79, 0x9d, 0x61, 0x73, 0xcb,
+	0xab, 0x7a, 0xcf, 0x4a, 0xea, 0x34, 0x12, 0x04, 0x34, 0x70, 0x6b, 0x9d, 0xf2, 0x46, 0x1d, 0x1b,
-	0xc5, 0xc6, 0x40, 0x4f, 0xe0, 0x96, 0x88, 0xb3, 0x90, 0x3e, 0x23, 0x42, 0x62, 0xca, 0x59, 0x2e,
+	0x01, 0x3d, 0x82, 0x6b, 0x22, 0x4c, 0x7c, 0xfa, 0x94, 0x08, 0x89, 0x29, 0x67, 0xa9, 0x74, 0x97,
-	0xbd, 0x95, 0x61, 0x73, 0xab, 0x37, 0xbe, 0x33, 0x32, 0x6a, 0x8d, 0x4a, 0xb5, 0x46, 0x4f, 0xad,
+	0x3a, 0xe5, 0x8d, 0x66, 0xef, 0x66, 0xd7, 0x64, 0xab, 0x9b, 0x67, 0xab, 0xfb, 0xd8, 0x66, 0x0b,
-	0x5a, 0xb8, 0xee, 0x81, 0x76, 0x60, 0x23, 0x64, 0x99, 0xcc, 0x59, 0x92, 0xd0, 0xfc, 0x5b, 0x92,
+	0x2f, 0x6a, 0xa0, 0x2d, 0x58, 0xf3, 0x59, 0x22, 0x53, 0x16, 0x45, 0x34, 0xfd, 0x86, 0xc4, 0x54,
-	0x52, 0xc1, 0x49, 0x48, 0xbd, 0x55, 0x7d, 0xfe, 0x55, 0x5b, 0xc8, 0x87, 0x35, 0x0b, 0x07, 0x09,
+	0x70, 0xe2, 0x53, 0x77, 0x59, 0xdf, 0x7f, 0xde, 0x16, 0xf2, 0x60, 0xc5, 0xc2, 0x83, 0x88, 0x24,
-	0xc9, 0xa8, 0xe7, 0xea, 0x9c, 0x96, 0x30, 0xff, 0x0f, 0x07, 0xe0, 0x84, 0x70, 0x4c, 0x5f, 0x14,
+	0xd4, 0xad, 0x6b, 0x9b, 0xe6, 0x30, 0xef, 0xb7, 0x0a, 0xc0, 0x01, 0xe1, 0x98, 0x9e, 0x64, 0x54,
-	0x54, 0x48, 0x84, 0xa0, 0xc5, 0x59, 0x64, 0x1a, 0x74, 0xd8, 0xc0, 0xca, 0x40, 0xc3, 0xa5, 0x5e,
+	0x48, 0x84, 0xc0, 0xe1, 0x2c, 0x30, 0x01, 0xea, 0x97, 0xb0, 0x12, 0x50, 0x67, 0x2e, 0x16, 0x15,
-	0x38, 0x76, 0xab, 0xd6, 0x8d, 0x94, 0xfc, 0x82, 0xb9, 0xd0, 0x9d, 0x72, 0xb0, 0xb5, 0x14, 0x2e,
+	0xbb, 0xb5, 0x10, 0x8d, 0x98, 0xfc, 0x8c, 0xb9, 0xd0, 0x91, 0xaa, 0x60, 0x2b, 0x29, 0x5c, 0xb2,
-	0x59, 0xa0, 0xca, 0x55, 0x5d, 0xea, 0x63, 0x6b, 0x29, 0x1d, 0x24, 0x3b, 0x0a, 0x74, 0x93, 0xba,
+	0x81, 0x72, 0x57, 0x45, 0xa9, 0x85, 0xad, 0xa4, 0xf2, 0x20, 0xd9, 0xfe, 0x40, 0x07, 0xa9, 0x81,
-	0x58, 0xaf, 0xd1, 0x00, 0xdc, 0xd3, 0x9c, 0xa5, 0x41, 0xd9, 0x9c, 0x3e, 0xae, 0x6c, 0x15, 0x47,
+	0xf5, 0x1a, 0xb5, 0xa1, 0x7e, 0x98, 0xb2, 0x78, 0x90, 0x07, 0xa7, 0x85, 0x0b, 0x59, 0x9d, 0xa3,
-	0xad, 0x8f, 0x02, 0x5b, 0xad, 0xb5, 0xb4, 0x0a, 0xe1, 0x8c, 0xa6, 0xa6, 0x34, 0xa5, 0x82, 0xb6,
+	0xd6, 0xfb, 0x03, 0xeb, 0xad, 0x95, 0x74, 0x16, 0xfc, 0x09, 0x8d, 0x8d, 0x6b, 0x2a, 0x0b, 0x5a,
-	0x74, 0x3e, 0x54, 0xce, 0x58, 0xe4, 0x75, 0x0d, 0x6e, 0x2c, 0x35, 0x8a, 0xa4, 0x90, 0x33, 0x96,
+	0xd2, 0xf6, 0x50, 0x39, 0x61, 0x81, 0xdb, 0x30, 0xb8, 0x91, 0x54, 0x29, 0x92, 0x4c, 0x4e, 0x58,
-	0xc7, 0x72, 0xee, 0x81, 0x19, 0xc5, 0x0a, 0x50, 0x59, 0x71, 0x22, 0x67, 0x5e, 0xcf, 0x64, 0xa5,
+	0x1a, 0xca, 0xa9, 0x0b, 0xa6, 0x14, 0x0b, 0x40, 0x59, 0xc5, 0x89, 0x9c, 0xb8, 0x4d, 0x63, 0x95,
-	0xd6, 0xfb, 0x2e, 0xac, 0x48, 0x92, 0x9f, 0x51, 0xe9, 0x0f, 0xc1, 0x7d, 0xcc, 0xe3, 0x83, 0x3c,
+	0x5a, 0xef, 0xd6, 0x61, 0x49, 0x92, 0xf4, 0x88, 0x4a, 0xef, 0x9f, 0x1a, 0xdc, 0x38, 0x20, 0x7c,
-	0x67, 0xb9, 0x52, 0x99, 0xaa, 0x85, 0x1d, 0x24, 0x63, 0xf8, 0x01, 0xb8, 0x98, 0x0a, 0x56, 0xe4,
+	0x77, 0x8a, 0xa9, 0x60, 0x59, 0xea, 0xd3, 0x3c, 0x64, 0x3b, 0x39, 0x45, 0x47, 0xad, 0xd9, 0x7b,
-	0x21, 0x55, 0x27, 0x65, 0x95, 0x44, 0xf6, 0x4a, 0x54, 0x80, 0xae, 0x7f, 0xce, 0xcb, 0xdb, 0xa0,
+	0x7f, 0xb1, 0x0e, 0x73, 0x85, 0x21, 0x8d, 0xa8, 0xaf, 0x73, 0x6b, 0x15, 0xd0, 0x03, 0xa8, 0xc5,
-	0xd7, 0xd5, 0x6c, 0xb6, 0x2e, 0x67, 0xd3, 0xe7, 0xf0, 0xbf, 0x32, 0xe2, 0x31, 0x4d, 0x68, 0xa8,
+	0x44, 0xfa, 0x13, 0x1d, 0xd4, 0x66, 0xef, 0xa3, 0x45, 0xcd, 0xf3, 0xee, 0xeb, 0x3e, 0x53, 0x1a,
-	0x06, 0x03, 0x7d, 0x0e, 0x6e, 0x6e, 0x41, 0x1d, 0xb9, 0x37, 0xf6, 0xea, 0x93, 0x5f, 0x3a, 0xe1,
+	0xd8, 0x28, 0x5e, 0x14, 0xf9, 0xf6, 0x9f, 0x55, 0xa8, 0x69, 0x22, 0xda, 0x05, 0x87, 0x44, 0x91,
-	0x8a, 0x89, 0x3e, 0x84, 0xf5, 0x84, 0x4c, 0x69, 0x32, 0x11, 0x3a, 0x10, 0xcb, 0xed, 0xe1, 0x7d,
+	0xb5, 0xad, 0x7b, 0xf5, 0x1b, 0xba, 0x43, 0x7a, 0xa2, 0x2a, 0x80, 0x44, 0x91, 0x3e, 0x23, 0x99,
-	0x8d, 0x1e, 0x5b, 0xd0, 0xff, 0x11, 0xfa, 0xa5, 0xb3, 0x29, 0xf5, 0xcd, 0x4e, 0xab, 0x1a, 0xe4,
+	0x5a, 0x2b, 0x5f, 0xe7, 0x8c, 0x64, 0x8a, 0xbe, 0x02, 0x27, 0x61, 0xa6, 0x95, 0x5e, 0xc9, 0x53,
-	0x2c, 0x36, 0xe8, 0x2f, 0x07, 0xd0, 0xb1, 0x24, 0xf2, 0xb8, 0x48, 0x53, 0x92, 0xcf, 0xcb, 0x99,
+	0xa5, 0x9f, 0x30, 0x89, 0x9e, 0xc0, 0x4a, 0x40, 0x85, 0x0c, 0x13, 0xdd, 0x1e, 0xa6, 0xef, 0xae,
-	0xfb, 0x12, 0xdc, 0x2a, 0x29, 0x73, 0xc4, 0x07, 0xd7, 0x1d, 0x51, 0x75, 0x01, 0x57, 0x2e, 0xe8,
+	0x12, 0xec, 0x7e, 0x09, 0xcf, 0x29, 0xa2, 0x3d, 0xa8, 0x4e, 0xa4, 0xe4, 0xba, 0xf8, 0x9a, 0xbd,
-	0x7d, 0xe8, 0xc9, 0x38, 0xa5, 0x93, 0x8b, 0x38, 0x8b, 0xd8, 0x85, 0x3d, 0x11, 0x14, 0xf4, 0xbd,
+	0xcd, 0x57, 0xf0, 0xa6, 0x2f, 0x25, 0xef, 0x97, 0xb0, 0x56, 0x6f, 0x7f, 0x0d, 0xce, 0x90, 0x9e,
-	0x46, 0xd0, 0xc7, 0xd0, 0xce, 0x58, 0x66, 0x3a, 0xdb, 0x1b, 0xbf, 0x55, 0x8f, 0xad, 0x3f, 0x69,
+	0xa0, 0xc7, 0xb0, 0xac, 0x33, 0x41, 0xf3, 0x31, 0xf4, 0x2a, 0x49, 0xcc, 0x55, 0xdb, 0x53, 0xa8,
-	0x87, 0x0d, 0xac, 0x49, 0xe8, 0x21, 0xf4, 0x24, 0x9b, 0x54, 0x25, 0xb7, 0x5f, 0x5d, 0xb2, 0xba,
+	0xaa, 0xc3, 0x91, 0x5b, 0x14, 0x74, 0xde, 0x81, 0x79, 0x49, 0xbb, 0x45, 0x49, 0xe7, 0x0d, 0x98,
-	0x07, 0x92, 0x55, 0xaa, 0x3f, 0x82, 0xbe, 0x9a, 0xcc, 0x4b, 0xf7, 0xce, 0x8d, 0xee, 0x6b, 0xca,
+	0x17, 0xf5, 0xad, 0xd9, 0xa2, 0x76, 0xec, 0xe6, 0x4c, 0x59, 0xdf, 0xb0, 0x65, 0x5d, 0xb5, 0x5b,
-	0xa1, 0xb4, 0xf7, 0x01, 0x5c, 0x56, 0xc8, 0x29, 0x2b, 0xb2, 0xc8, 0xff, 0xa7, 0x09, 0x1b, 0x4b,
+	0xa6, 0xb0, 0x97, 0x6d, 0xe9, 0x15, 0x0b, 0xaf, 0x03, 0xf5, 0x87, 0x3c, 0xdc, 0x4b, 0x53, 0x96,
-	0xdd, 0xb2, 0x5f, 0xbd, 0x2f, 0xc0, 0x61, 0xe7, 0xb6, 0x51, 0x9b, 0xf5, 0xc8, 0x57, 0x38, 0x8c,
+	0xaa, 0x31, 0x46, 0xd5, 0xc2, 0x4e, 0x4a, 0x23, 0x78, 0x03, 0xa8, 0xe7, 0x7e, 0xa8, 0x56, 0x4a,
-	0x9e, 0x9f, 0x1f, 0x36, 0xb0, 0xc3, 0xce, 0xd1, 0xee, 0xa2, 0x2a, 0xbd, 0xf1, 0x7b, 0xd7, 0xa5,
+	0x8a, 0x19, 0x64, 0x67, 0x7e, 0x01, 0xe8, 0x06, 0x9f, 0xf2, 0x7c, 0xdc, 0xeb, 0x75, 0x31, 0x7c,
-	0xa5, 0x95, 0x3f, 0x6c, 0x58, 0xd9, 0x06, 0x5f, 0x81, 0xf3, 0xfc, 0x1c, 0x3d, 0x80, 0x9e, 0xfa,
+	0x9d, 0xb3, 0xe1, 0xeb, 0x71, 0x78, 0xe3, 0x85, 0x84, 0xa1, 0xcf, 0xa1, 0x9e, 0x5a, 0xd0, 0x96,
-	0xc6, 0x4d, 0x24, 0x99, 0x26, 0xb4, 0xfc, 0xe6, 0xde, 0xb9, 0xea, 0xfc, 0x13, 0xc5, 0xc0, 0x20,
+	0xad, 0x7b, 0x51, 0x96, 0x71, 0xc1, 0x44, 0x1f, 0xc0, 0x6a, 0x44, 0xc6, 0x34, 0x1a, 0x09, 0x7d,
-	0xca, 0xa5, 0x50, 0x65, 0xe5, 0x36, 0x1b, 0xff, 0xef, 0x26, 0xc0, 0x3e, 0x11, 0x71, 0xa8, 0xa8,
+	0x10, 0x4b, 0xed, 0xe5, 0x2d, 0x8d, 0x0e, 0x2d, 0xe8, 0xfd, 0x00, 0xad, 0x5c, 0xd9, 0xb8, 0xfa,
-	0x02, 0xdd, 0x83, 0xbe, 0x28, 0xc2, 0x90, 0x0a, 0x31, 0x09, 0x59, 0x91, 0x49, 0x5d, 0x58, 0x1b,
+	0x7a, 0xb7, 0x15, 0x01, 0xaa, 0xcc, 0x06, 0xe8, 0x8f, 0x0a, 0xa0, 0xa1, 0x24, 0x72, 0x98, 0xc5,
-	0xaf, 0x59, 0xf0, 0x89, 0xc2, 0x14, 0xe9, 0x94, 0xc4, 0x49, 0x91, 0x53, 0x4b, 0x72, 0x0c, 0xc9,
+	0x31, 0x49, 0xa7, 0xf9, 0x84, 0xf8, 0x12, 0xea, 0x85, 0x51, 0x57, 0x9e, 0x11, 0x85, 0x0a, 0x7a,
-	0x82, 0x86, 0x74, 0x5f, 0x4d, 0xb8, 0xa4, 0x59, 0x38, 0x9f, 0xa4, 0x62, 0xc2, 0x77, 0x77, 0xb4,
+	0x0f, 0x9a, 0x32, 0x8c, 0xe9, 0xe8, 0x34, 0x4c, 0x02, 0x76, 0x6a, 0x6f, 0x04, 0x05, 0x7d, 0xa7,
-	0xe0, 0x6d, 0xbc, 0x66, 0xd1, 0x6f, 0x44, 0xb0, 0xbb, 0x53, 0x67, 0xed, 0xed, 0x6a, 0x89, 0x97,
+	0x11, 0xf4, 0x31, 0x54, 0x13, 0x96, 0x50, 0xdb, 0x5b, 0x6f, 0x2e, 0x9e, 0xad, 0xdf, 0x6c, 0x95,
-	0x58, 0x7b, 0xbb, 0x2f, 0xb1, 0xf6, 0xb4, 0x92, 0xcb, 0xac, 0x3d, 0xff, 0xd7, 0x16, 0x74, 0xab,
+	0x78, 0x45, 0x42, 0xf7, 0xa0, 0x29, 0xd9, 0xa8, 0x70, 0xb9, 0xfa, 0x72, 0x97, 0xd5, 0xa0, 0x97,
-	0x82, 0xd1, 0x63, 0xe8, 0x72, 0x16, 0x4d, 0xce, 0x72, 0x56, 0x70, 0x2b, 0x8f, 0x7f, 0x6d, 0x7b,
+	0xac, 0xc8, 0xfa, 0x7d, 0x68, 0xa9, 0xd1, 0x7b, 0xa6, 0x5e, 0xbb, 0x54, 0x7d, 0x45, 0x29, 0xe4,
-	0xd4, 0x9f, 0xd3, 0xd7, 0x8a, 0x79, 0xd8, 0xc0, 0x2e, 0xb7, 0xeb, 0xc1, 0x9f, 0x0e, 0xb8, 0xe5,
+	0xf2, 0x2e, 0x40, 0x9d, 0x65, 0x72, 0xcc, 0xb2, 0x24, 0xf0, 0xfe, 0x2e, 0xc3, 0xda, 0x5c, 0xb4,
-	0x06, 0x7a, 0x00, 0xed, 0x9c, 0x5d, 0x94, 0x9d, 0xde, 0xbc, 0x39, 0xd4, 0x08, 0xb3, 0x0b, 0xac,
+	0xec, 0xb3, 0xfe, 0x05, 0x54, 0xd8, 0xb1, 0x0d, 0xd4, 0xfa, 0xe2, 0xc9, 0xe7, 0x28, 0x74, 0x9f,
-	0x7d, 0x06, 0xff, 0x36, 0xa1, 0x85, 0xd9, 0xc5, 0x1b, 0xde, 0xde, 0x1b, 0x6f, 0xd4, 0x16, 0xdc,
+	0x1f, 0xf7, 0x4b, 0xb8, 0xc2, 0x8e, 0xd1, 0xf6, 0x6c, 0x56, 0x9a, 0xbd, 0x77, 0x2f, 0x32, 0x4b,
-	0x4e, 0xa9, 0x98, 0xd1, 0x68, 0xa2, 0x2a, 0x36, 0x92, 0x98, 0x66, 0xaf, 0x1b, 0x3c, 0x60, 0x91,
+	0x67, 0xbe, 0x5f, 0xb2, 0x69, 0x6b, 0x3f, 0x80, 0xca, 0xf3, 0x63, 0x74, 0x17, 0x9a, 0xea, 0x11,
-	0x11, 0x65, 0x13, 0x6e, 0x49, 0x26, 0x49, 0xb2, 0x40, 0x34, 0xfd, 0xee, 0x6b, 0xb8, 0xe2, 0xed,
+	0x1f, 0x49, 0x32, 0x8e, 0x8a, 0x6e, 0xbe, 0x79, 0xde, 0xfd, 0x07, 0x8a, 0x81, 0x41, 0xe4, 0x4b,
-	0x40, 0x47, 0xcd, 0x8b, 0xb0, 0x37, 0x66, 0x50, 0xcf, 0xf2, 0x72, 0x62, 0xb0, 0x21, 0xee, 0xaf,
+	0xa1, 0xdc, 0x4a, 0xad, 0x35, 0xde, 0x5f, 0x65, 0x80, 0x5d, 0x22, 0x42, 0x5f, 0x51, 0x05, 0xba,
-	0x42, 0x47, 0x8f, 0xe2, 0xf8, 0xb7, 0x16, 0xb4, 0x1e, 0xf3, 0x18, 0xfd, 0x00, 0xbd, 0x85, 0xe9,
+	0x0d, 0x2d, 0x91, 0xf9, 0x3e, 0x15, 0x62, 0xe4, 0xb3, 0x2c, 0x31, 0xaf, 0x44, 0x15, 0xaf, 0x58,
-	0x47, 0xfe, 0x2b, 0xaf, 0x86, 0xfe, 0xf2, 0x0c, 0xee, 0xbd, 0xc6, 0xf5, 0xf1, 0x1b, 0xe8, 0x11,
+	0xf0, 0x91, 0xc2, 0x14, 0xe9, 0x90, 0x84, 0x51, 0x96, 0x52, 0x4b, 0xaa, 0x18, 0x92, 0x05, 0x0d,
-	0xac, 0x96, 0x8f, 0x99, 0xab, 0xbf, 0x1e, 0x83, 0x77, 0xea, 0xf0, 0xc2, 0xf3, 0xc8, 0x6f, 0xa0,
+	0xe9, 0x8e, 0xaa, 0x70, 0x49, 0x13, 0x7f, 0x3a, 0x8a, 0xc5, 0x88, 0x6f, 0x6f, 0xe9, 0x84, 0x57,
-	0x03, 0x70, 0xcb, 0xc7, 0xcb, 0x75, 0x11, 0x86, 0x75, 0xb8, 0xfe, 0xda, 0xf1, 0x1b, 0xe8, 0x27,
+	0xf1, 0x8a, 0x45, 0x9f, 0x89, 0xc1, 0xf6, 0xd6, 0x22, 0x6b, 0x67, 0x5b, 0xa7, 0x78, 0x8e, 0xb5,
-	0xe8, 0x1e, 0xd3, 0xe4, 0xf4, 0x89, 0x7a, 0x92, 0xa1, 0x4f, 0x2a, 0x07, 0xfb, 0x92, 0x5b, 0x7c,
+	0xb3, 0xfd, 0x02, 0x6b, 0x47, 0x67, 0x72, 0x9e, 0xb5, 0xe3, 0xfd, 0xe2, 0x40, 0xa3, 0x70, 0x18,
-	0xaf, 0x55, 0xb4, 0xb2, 0xd2, 0x4f, 0x5f, 0x93, 0xbd, 0x50, 0x73, 0xeb, 0x84, 0x70, 0xf4, 0x92,
+	0x3d, 0x84, 0x06, 0x67, 0xc1, 0xe8, 0x28, 0x65, 0x19, 0xb7, 0xe9, 0xf1, 0x2e, 0x0c, 0x8f, 0xfa,
-	0x10, 0x97, 0x6f, 0x85, 0x81, 0x57, 0x8f, 0x79, 0x42, 0xf8, 0xc1, 0xcf, 0x34, 0x93, 0x7e, 0x63,
+	0xf7, 0xf5, 0x44, 0x31, 0xfb, 0x25, 0x5c, 0xe7, 0x76, 0xdd, 0xfe, 0xbd, 0x02, 0xf5, 0x7c, 0x03,
-	0xa7, 0x39, 0x5d, 0xd1, 0x4f, 0x9a, 0xcf, 0xfe, 0x0b, 0x00, 0x00, 0xff, 0xff, 0xf2, 0x65, 0x7b,
+	0xdd, 0x85, 0x6a, 0xca, 0x4e, 0xf3, 0x48, 0xaf, 0x5f, 0x7e, 0x54, 0x17, 0xb3, 0x53, 0xac, 0x75,
-	0x19, 0xb2, 0x0a, 0x00, 0x00,
+	0xda, 0xff, 0x96, 0xc1, 0xc1, 0xec, 0xf4, 0x35, 0xbb, 0xf7, 0xd2, 0x8e, 0xda, 0x80, 0xeb, 0x31,
+	0x15, 0x13, 0x1a, 0x8c, 0x94, 0xc7, 0x26, 0x25, 0x26, 0xd8, 0xab, 0x06, 0x1f, 0xb0, 0xc0, 0x24,
+	0x65, 0x1d, 0xae, 0x49, 0x26, 0x49, 0x34, 0x43, 0x34, 0xf1, 0x6e, 0x69, 0xb8, 0xe0, 0x6d, 0x41,
+	0x4d, 0xd5, 0x8b, 0xb0, 0x1d, 0xd3, 0x5e, 0xb4, 0xf2, 0xac, 0x62, 0xb0, 0x21, 0xaa, 0xc1, 0xac,
+	0x4b, 0xb1, 0xf7, 0x9f, 0x03, 0xce, 0x43, 0x1e, 0xa2, 0xef, 0xa1, 0x39, 0x53, 0xfd, 0xc8, 0x7b,
+	0x69, 0x6b, 0xe8, 0xc9, 0xd3, 0xbe, 0x7d, 0x85, 0xf6, 0xf1, 0x4a, 0x68, 0x0f, 0xea, 0xf9, 0x9f,
+	0x6b, 0x74, 0xfe, 0xf8, 0x68, 0x77, 0x16, 0xe1, 0xc5, 0x7f, 0xe3, 0x5e, 0x09, 0xdd, 0x07, 0xe7,
+	0x80, 0x70, 0xd4, 0x3e, 0xe7, 0x05, 0xcc, 0x0d, 0x3a, 0xcb, 0x8e, 0xfd, 0xfe, 0x38, 0x20, 0x7c,
+	0xef, 0x27, 0x9a, 0x48, 0xaf, 0xb4, 0x55, 0x46, 0x43, 0x68, 0xcd, 0xbd, 0x96, 0xe8, 0xce, 0x55,
+	0x1e, 0xd3, 0x4b, 0x0e, 0xbd, 0x0f, 0xcb, 0xf9, 0xa7, 0xc8, 0x05, 0xbe, 0xbd, 0xbd, 0x08, 0xcf,
+	0x7c, 0xdc, 0x78, 0x25, 0xf4, 0x23, 0x34, 0x86, 0x34, 0x3a, 0x7c, 0xa4, 0xbe, 0x84, 0xd0, 0x27,
+	0x8b, 0x77, 0xcd, 0x7e, 0x26, 0x15, 0xb4, 0xdc, 0xb2, 0x4f, 0xaf, 0xc8, 0xce, 0x43, 0x38, 0x5e,
+	0xd2, 0x1f, 0x02, 0x9f, 0xfd, 0x1f, 0x00, 0x00, 0xff, 0xff, 0x18, 0x45, 0x17, 0xa9, 0xe8, 0x0d,
+	0x00, 0x00,
 }

controller/tap/server.go

@@ -89,6 +89,10 @@ func (s *server) Tap(req *public.TapRequest, stream pb.Tap_TapServer) error {
 	return nil
 }
 
+func (s *server) TapByResource(req *public.TapByResourceRequest, stream pb.Tap_TapByResourceServer) error {
+	return fmt.Errorf("unimplemented")
+}
+
 func validatePort(port uint32) error {
 	if port > 65535 {
 		return fmt.Errorf("Port number of range: %d", port)

proto/common/common.proto

@@ -66,12 +66,18 @@ message Eos {
 
 message TapEvent {
   TcpAddress source = 1;
-  TcpAddress target = 2;
+
+  TcpAddress   destination      = 2;
+  EndpointMeta destination_meta = 4;
 
   oneof event {
     Http http = 3;
   }
 
+  message EndpointMeta {
+    map<string, string> labels = 1;
+  }
+
   message Http {
     oneof event {
       RequestInit  request_init  = 1;

proto/controller/tap/tap.proto

@@ -7,4 +7,5 @@ import "public/api.proto";
 
 service Tap {
   rpc Tap(public.TapRequest) returns (stream common.TapEvent) {}
+  rpc TapByResource(public.TapByResourceRequest) returns (stream common.TapEvent) {}
 }

proto/proxy/tap/tap.proto

@@ -29,6 +29,13 @@ message ObserveRequest {
       Tcp source  = 4;
       Tcp destination = 5;
       Http http = 6;
+
+      Label destination_label = 7;
+    }
+
+    message Label {
+      string key   = 1;
+      string value = 2;
     }
 
     message Tcp {

proto/public/api.proto

@@ -47,18 +47,80 @@ message TapRequest {
   string path = 11;
 }
 
+// A tap request over kubernetes resources.
+message TapByResourceRequest {
+  // Describes the kubernetes pods that should be tapped.
+  ResourceSelection target = 1;
+
+  // Selects over events to be reported.
+  Match match = 2;
+
+  // Limits the number of events to be inspected.
+  float maxRps = 3;
+
+  message Match {
+    oneof match {
+      // If empty, matches all messages.
+      Seq all = 1;
+
+      // If empty, matches no messages.
+      Seq any = 2;
+
+      // Inverts the inner match.
+      Match not = 3;
+
+      // Matches events being sent to any of the selected destinations.
+      ResourceSelection destinations = 4;
+
+      // Matches HTTP requests by their metadata.
+      Http http = 5;
+    }
+
+    message Seq {
+      repeated Match matches = 1;
+    }
+
+    message Http {
+      oneof match {
+        string scheme = 1;
+        string method = 2;
+        string authority = 3;
+        string path = 4;
+      }
+    }
+  }
+}
+
 message ApiError {
   string error = 1;
 }
 
 message Resource {
+  // The namespace the resource is in.
+  //
+  // If empty, indicates all namespaces should be considered.
   string namespace = 1;
+
+  // The type of Kubernetes resource.
+  //
+  // E.g. pod, deployment, service, ...
+  //
+  // If `all` refers, to all resource types.
   string type = 2;
+
+  // An optional Kubernetes resource name.
   string name = 3;
 }
 
 message ResourceSelection {
+  // Identifies a Kubernetes resource.
   Resource resource = 1;
+
+  // A string-formatted Kubernetes label selector as passed to `kubectl get
+  // --selector`.
+  //
+  // XXX in the future this may be superceded by a data structure that more
+  // richly describes a parsed label selector.
   string label_selector = 2;
 }
 
@@ -118,8 +180,15 @@ message StatTable {
 
 service Api {
   rpc StatSummary(StatSummaryRequest) returns (StatSummaryResponse) {}
-  rpc Version(Empty) returns (VersionInfo) {}
+
   rpc ListPods(Empty) returns (ListPodsResponse) {}
-  rpc SelfCheck(common.healthcheck.SelfCheckRequest) returns (common.healthcheck.SelfCheckResponse) {}
+
+  // Superceded by `TapByResource`.
   rpc Tap(TapRequest) returns (stream common.TapEvent) {}
+
+  // Executes tapping over Kubernetes resources.
+  rpc TapByResource(TapByResourceRequest) returns (stream common.TapEvent) {}
+
+  rpc Version(Empty) returns (VersionInfo) {}
+  rpc SelfCheck(common.healthcheck.SelfCheckRequest) returns (common.healthcheck.SelfCheckResponse) {}
 }

proxy/src/control/pb.rs

@@ -47,7 +47,8 @@ impl event::StreamResponseEnd {
 
         common::TapEvent {
             source: Some((&ctx.server.remote).into()),
-            target: Some((&ctx.client.remote).into()),
+            destination: Some((&ctx.client.remote).into()),
+            destination_meta: None,
             event: Some(tap_event::Event::Http(tap_event::Http {
                 event: Some(tap_event::http::Event::ResponseEnd(end)),
             })),
@@ -72,7 +73,8 @@ impl event::StreamResponseFail {
 
         common::TapEvent {
             source: Some((&ctx.server.remote).into()),
-            target: Some((&ctx.client.remote).into()),
+            destination: Some((&ctx.client.remote).into()),
+            destination_meta: None,
             event: Some(tap_event::Event::Http(tap_event::Http {
                 event: Some(tap_event::http::Event::ResponseEnd(end)),
             })),
@@ -97,7 +99,8 @@ impl event::StreamRequestFail {
 
         common::TapEvent {
             source: Some((&ctx.server.remote).into()),
-            target: Some((&ctx.client.remote).into()),
+            destination: Some((&ctx.client.remote).into()),
+            destination_meta: None,
             event: Some(tap_event::Event::Http(tap_event::Http {
                 event: Some(tap_event::http::Event::ResponseEnd(end)),
             })),
@@ -130,7 +133,8 @@ impl<'a> TryFrom<&'a Event> for common::TapEvent {
 
                 common::TapEvent {
                     source: Some((&ctx.server.remote).into()),
-                    target: Some((&ctx.client.remote).into()),
+                    destination: Some((&ctx.client.remote).into()),
+                    destination_meta: None,
                     event: Some(tap_event::Event::Http(tap_event::Http {
                         event: Some(tap_event::http::Event::RequestInit(init)),
                     })),
@@ -150,7 +154,8 @@ impl<'a> TryFrom<&'a Event> for common::TapEvent {
 
                 common::TapEvent {
                     source: Some((&ctx.request.server.remote).into()),
-                    target: Some((&ctx.request.client.remote).into()),
+                    destination: Some((&ctx.request.client.remote).into()),
+                    destination_meta: None,
                     event: Some(tap_event::Event::Http(tap_event::Http {
                         event: Some(tap_event::http::Event::ResponseInit(init)),
                     })),

proxy/src/telemetry/tap/match_.rs

@@ -28,6 +28,7 @@ pub enum InvalidMatch {
     InvalidNetwork,
     InvalidHttpMethod,
     InvalidScheme,
+    Unimplemented,
 }
 
 #[derive(Clone, Debug)]
@@ -152,6 +153,8 @@ impl<'a> TryFrom<&'a observe_request::match_::Match> for Match {
 
             match_::Match::Destination(ref dst) => Match::Destination(TcpMatch::try_from(dst)?),
 
+            match_::Match::DestinationLabel(..) => return Err(InvalidMatch::Unimplemented),
+
             match_::Match::Http(ref http) => Match::Http(HttpMatch::try_from(http)?),
         };