Be precise about 'workload' vs 'workload instance' (istio#876)

Author: esnible

authentication/v1alpha1/istio.authentication.v1alpha1.pb.html

@@ -374,10 +374,10 @@ message TargetSelector {
   // $hide_from_docs
   // $not-implemented-hide
   // Select workload by labels.
-  // Once implemented, this is a prefer way over using service name.
+  // Once implemented, this is the preferred way rather than using the service name.
   map<string, string> labels = 3;
 
-  // Specifies the ports. Note that this is the port(s) exposed by the service, not workload ports.
+  // Specifies the ports. Note that this is the port(s) exposed by the service, not workload instance ports.
   // For example, if a service is defined as below, then `8000` should be used, not `9000`.
   // ```yaml
   // kind: Service

authentication/v1alpha1/policy.pb.go

@@ -201,7 +201,7 @@ message Gateway {
   // on which this gateway configuration should be applied. The scope of
   // label search is restricted to the configuration namespace in which the
   // the resource is present. In other words, the Gateway resource must
-  // reside in the same namespace as the gateway workload.
+  // reside in the same namespace as the gateway workload instance.
   map<string, string> selector = 2;
 }
 
@@ -362,7 +362,7 @@ message Server {
     // as Kubernetes secrets, will be configured to retrieve the
     // serverCertificate and the privateKey using credentialName, instead
     // of using the file system paths specified above. If using mutual TLS,
-    // gateway workloads will retrieve the CaCertificates using
+    // gateway workload instances will retrieve the CaCertificates using
     // credentialName-cacert. The semantics of the name are platform
     // dependent.  In Kubernetes, the default Istio supplied credential
     // server expects the credentialName to match the name of the

authentication/v1alpha1/policy.proto

@@ -503,7 +503,7 @@ message ServiceEntry {
   // "." or "*" (i.e., the current namespace or all namespaces).
   repeated string export_to = 7;
 
-  // The list of subject alternate names allowed for workloads that
+  // The list of subject alternate names allowed for workload instances that
   // implement this service. This information is used to enforce
   // [secure-naming](/docs/concepts/security/#secure-naming).
   // If specified, the proxy will verify that the server