diff --git a/networking/v1alpha3/virtual_service.pb.go b/networking/v1alpha3/virtual_service.pb.go
index 70c5726408..b72b594e71 100644
--- a/networking/v1alpha3/virtual_service.pb.go
+++ b/networking/v1alpha3/virtual_service.pb.go
@@ -1392,6 +1392,9 @@ type HTTPMatchRequest struct {
 	// with the given labels. If the VirtualService has a list of gateways specified
 	// in the top-level `gateways` field, it must include the reserved gateway
 	// `mesh` for this field to be applicable.
+	//
+	// **Note:** This is not a runtime match, but is a selector; it filters which workloads the
+	// VirtualService applies to.
 	SourceLabels map[string]string `protobuf:"bytes,7,rep,name=source_labels,json=sourceLabels,proto3" json:"source_labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// Names of gateways where the rule should be applied. Gateway names
 	// in the top-level `gateways` field of the VirtualService (if any) are overridden. The gateway
@@ -1425,6 +1428,9 @@ type HTTPMatchRequest struct {
 	// Source namespace constraining the applicability of a rule to workloads in that namespace.
 	// If the VirtualService has a list of gateways specified in the top-level `gateways` field,
 	// it must include the reserved gateway `mesh` for this field to be applicable.
+	//
+	// **Note:** This is not a runtime match, but is a selector; it filters which workloads the
+	// VirtualService applies to.
 	SourceNamespace string `protobuf:"bytes,13,opt,name=source_namespace,json=sourceNamespace,proto3" json:"source_namespace,omitempty"`
 	// The human readable prefix to use when emitting statistics for this route.
 	// The statistics are generated with prefix route.<stat_prefix>.
@@ -1786,6 +1792,9 @@ type L4MatchAttributes struct {
 	// workloads with the given labels. If the VirtualService has a list of
 	// gateways specified in the top-level `gateways` field, it should include the reserved gateway
 	// `mesh` in order for this field to be applicable.
+	//
+	// **Note:** This is not a runtime match, but is a selector; it filters which workloads the
+	// VirtualService applies to.
 	SourceLabels map[string]string `protobuf:"bytes,4,rep,name=source_labels,json=sourceLabels,proto3" json:"source_labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// Names of gateways where the rule should be applied. Gateway names
 	// in the top-level `gateways` field of the VirtualService (if any) are overridden. The gateway
@@ -1794,6 +1803,9 @@ type L4MatchAttributes struct {
 	// Source namespace constraining the applicability of a rule to workloads in that namespace.
 	// If the VirtualService has a list of gateways specified in the top-level `gateways` field,
 	// it must include the reserved gateway `mesh` for this field to be applicable.
+	//
+	// **Note:** This is not a runtime match, but is a selector; it filters which workloads the
+	// VirtualService applies to.
 	SourceNamespace string `protobuf:"bytes,6,opt,name=source_namespace,json=sourceNamespace,proto3" json:"source_namespace,omitempty"`
 	unknownFields   protoimpl.UnknownFields
 	sizeCache       protoimpl.SizeCache
@@ -1891,6 +1903,9 @@ type TLSMatchAttributes struct {
 	// workloads with the given labels. If the VirtualService has a list of
 	// gateways specified in the top-level `gateways` field, it should include the reserved gateway
 	// `mesh` in order for this field to be applicable.
+	//
+	// **Note:** This is not a runtime match, but is a selector; it filters which workloads the
+	// VirtualService applies to.
 	SourceLabels map[string]string `protobuf:"bytes,5,rep,name=source_labels,json=sourceLabels,proto3" json:"source_labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// Names of gateways where the rule should be applied. Gateway names
 	// in the top-level `gateways` field of the VirtualService (if any) are overridden. The gateway
@@ -1899,6 +1914,9 @@ type TLSMatchAttributes struct {
 	// Source namespace constraining the applicability of a rule to workloads in that namespace.
 	// If the VirtualService has a list of gateways specified in the top-level `gateways` field,
 	// it must include the reserved gateway `mesh` for this field to be applicable.
+	//
+	// **Note:** This is not a runtime match, but is a selector; it filters which workloads the
+	// VirtualService applies to.
 	SourceNamespace string `protobuf:"bytes,7,opt,name=source_namespace,json=sourceNamespace,proto3" json:"source_namespace,omitempty"`
 	unknownFields   protoimpl.UnknownFields
 	sizeCache       protoimpl.SizeCache
diff --git a/networking/v1alpha3/virtual_service.pb.html b/networking/v1alpha3/virtual_service.pb.html
index 6dd34f222c..637a497cc1 100644
--- a/networking/v1alpha3/virtual_service.pb.html
+++ b/networking/v1alpha3/virtual_service.pb.html
@@ -1086,6 +1086,8 @@ <h2 id="HTTPMatchRequest">HTTPMatchRequest</h2>
 with the given labels. If the VirtualService has a list of gateways specified
 in the top-level <code>gateways</code> field, it must include the reserved gateway
 <code>mesh</code> for this field to be applicable.</p>
+<p><strong>Note:</strong> This is not a runtime match, but is a selector; it filters which workloads the
+VirtualService applies to.</p>
 
 </td>
 </tr>
@@ -1158,6 +1160,8 @@ <h2 id="HTTPMatchRequest">HTTPMatchRequest</h2>
 <p>Source namespace constraining the applicability of a rule to workloads in that namespace.
 If the VirtualService has a list of gateways specified in the top-level <code>gateways</code> field,
 it must include the reserved gateway <code>mesh</code> for this field to be applicable.</p>
+<p><strong>Note:</strong> This is not a runtime match, but is a selector; it filters which workloads the
+VirtualService applies to.</p>
 
 </td>
 </tr>
@@ -1361,6 +1365,8 @@ <h2 id="L4MatchAttributes">L4MatchAttributes</h2>
 workloads with the given labels. If the VirtualService has a list of
 gateways specified in the top-level <code>gateways</code> field, it should include the reserved gateway
 <code>mesh</code> in order for this field to be applicable.</p>
+<p><strong>Note:</strong> This is not a runtime match, but is a selector; it filters which workloads the
+VirtualService applies to.</p>
 
 </td>
 </tr>
@@ -1383,6 +1389,8 @@ <h2 id="L4MatchAttributes">L4MatchAttributes</h2>
 <p>Source namespace constraining the applicability of a rule to workloads in that namespace.
 If the VirtualService has a list of gateways specified in the top-level <code>gateways</code> field,
 it must include the reserved gateway <code>mesh</code> for this field to be applicable.</p>
+<p><strong>Note:</strong> This is not a runtime match, but is a selector; it filters which workloads the
+VirtualService applies to.</p>
 
 </td>
 </tr>
@@ -1445,6 +1453,8 @@ <h2 id="TLSMatchAttributes">TLSMatchAttributes</h2>
 workloads with the given labels. If the VirtualService has a list of
 gateways specified in the top-level <code>gateways</code> field, it should include the reserved gateway
 <code>mesh</code> in order for this field to be applicable.</p>
+<p><strong>Note:</strong> This is not a runtime match, but is a selector; it filters which workloads the
+VirtualService applies to.</p>
 
 </td>
 </tr>
@@ -1467,6 +1477,8 @@ <h2 id="TLSMatchAttributes">TLSMatchAttributes</h2>
 <p>Source namespace constraining the applicability of a rule to workloads in that namespace.
 If the VirtualService has a list of gateways specified in the top-level <code>gateways</code> field,
 it must include the reserved gateway <code>mesh</code> for this field to be applicable.</p>
+<p><strong>Note:</strong> This is not a runtime match, but is a selector; it filters which workloads the
+VirtualService applies to.</p>
 
 </td>
 </tr>
diff --git a/networking/v1alpha3/virtual_service.proto b/networking/v1alpha3/virtual_service.proto
index b0a642d771..0d5691db4b 100644
--- a/networking/v1alpha3/virtual_service.proto
+++ b/networking/v1alpha3/virtual_service.proto
@@ -817,6 +817,9 @@ message HTTPMatchRequest {
   // with the given labels. If the VirtualService has a list of gateways specified
   // in the top-level `gateways` field, it must include the reserved gateway
   // `mesh` for this field to be applicable.
+  //
+  // **Note:** This is not a runtime match, but is a selector; it filters which workloads the
+  // VirtualService applies to.
   map<string, string> source_labels = 7;
 
   // Names of gateways where the rule should be applied. Gateway names
@@ -855,6 +858,9 @@ message HTTPMatchRequest {
   // Source namespace constraining the applicability of a rule to workloads in that namespace.
   // If the VirtualService has a list of gateways specified in the top-level `gateways` field,
   // it must include the reserved gateway `mesh` for this field to be applicable.
+  //
+  // **Note:** This is not a runtime match, but is a selector; it filters which workloads the
+  // VirtualService applies to.
   string source_namespace = 13;
 
   // The human readable prefix to use when emitting statistics for this route.
@@ -983,6 +989,9 @@ message L4MatchAttributes {
   // workloads with the given labels. If the VirtualService has a list of
   // gateways specified in the top-level `gateways` field, it should include the reserved gateway
   // `mesh` in order for this field to be applicable.
+  //
+  // **Note:** This is not a runtime match, but is a selector; it filters which workloads the
+  // VirtualService applies to.
   map<string, string> source_labels = 4;
 
   // Names of gateways where the rule should be applied. Gateway names
@@ -993,6 +1002,9 @@ message L4MatchAttributes {
   // Source namespace constraining the applicability of a rule to workloads in that namespace.
   // If the VirtualService has a list of gateways specified in the top-level `gateways` field,
   // it must include the reserved gateway `mesh` for this field to be applicable.
+  //
+  // **Note:** This is not a runtime match, but is a selector; it filters which workloads the
+  // VirtualService applies to.
   string source_namespace = 6;
 }
 
@@ -1021,6 +1033,9 @@ message TLSMatchAttributes {
   // workloads with the given labels. If the VirtualService has a list of
   // gateways specified in the top-level `gateways` field, it should include the reserved gateway
   // `mesh` in order for this field to be applicable.
+  //
+  // **Note:** This is not a runtime match, but is a selector; it filters which workloads the
+  // VirtualService applies to.  
   map<string, string> source_labels = 5;
 
   // Names of gateways where the rule should be applied. Gateway names
@@ -1031,6 +1046,9 @@ message TLSMatchAttributes {
   // Source namespace constraining the applicability of a rule to workloads in that namespace.
   // If the VirtualService has a list of gateways specified in the top-level `gateways` field,
   // it must include the reserved gateway `mesh` for this field to be applicable.
+  //
+  // **Note:** This is not a runtime match, but is a selector; it filters which workloads the
+  // VirtualService applies to.  
   string source_namespace = 7;
 }