SPIRE's matching rule: every one of the entry's selectors must be present on the workload.
the entry's selectors
the workload's selectors
whether the entry matches
SPIRE's matching rule: every one of the entry's selectors must be present on the workload.