diff --git a/networking/v1alpha3/service_entry.pb.go b/networking/v1alpha3/service_entry.pb.go
index 8b1ce09126..4a367f3f55 100644
--- a/networking/v1alpha3/service_entry.pb.go
+++ b/networking/v1alpha3/service_entry.pb.go
@@ -623,6 +623,8 @@ type ServiceEntry struct {
 	//     service accounts associated with the pods of the service, the
 	//     SANs specified here will also be verified.
 	//
+	// **NOTE 3:** Ambient mode does not support wildcard hostsnames.
+	//
 	// +kubebuilder:validation:MinItems=1
 	// +kubebuilder:validation:MaxItems=256
 	// +protoc-gen-crd:list-value-validation:XValidation:message="hostname cannot be wildcard",rule="self != '*'"
@@ -687,6 +689,9 @@ type ServiceEntry struct {
 	// For a Kubernetes Service, the equivalent effect can be achieved by setting
 	// the annotation "networking.istio.io/exportTo" to a comma-separated list
 	// of namespace names.
+	//
+	// **Note:** Ambient mode does not support this field. Service entries will
+	// be exported to all namespaces.
 	ExportTo []string `protobuf:"bytes,7,rep,name=export_to,json=exportTo,proto3" json:"export_to,omitempty"`
 	// If specified, the proxy will verify that the server certificate's
 	// subject alternate name matches one of the specified values.
diff --git a/networking/v1alpha3/service_entry.pb.html b/networking/v1alpha3/service_entry.pb.html
index fb5ada0db4..6c9fd3b772 100644
--- a/networking/v1alpha3/service_entry.pb.html
+++ b/networking/v1alpha3/service_entry.pb.html
@@ -382,6 +382,7 @@ <h2 id="ServiceEntry">ServiceEntry</h2>
 service accounts associated with the pods of the service, the
 SANs specified here will also be verified.</li>
 </ol>
+<p><strong>NOTE 3:</strong> Ambient mode does not support wildcard hostsnames.</p>
 
 </td>
 </tr>
@@ -482,6 +483,8 @@ <h2 id="ServiceEntry">ServiceEntry</h2>
 <p>For a Kubernetes Service, the equivalent effect can be achieved by setting
 the annotation &ldquo;networking.istio.io/exportTo&rdquo; to a comma-separated list
 of namespace names.</p>
+<p><strong>Note:</strong> Ambient mode does not support this field. Service entries will
+be exported to all namespaces.</p>
 
 </td>
 </tr>
diff --git a/networking/v1alpha3/service_entry.proto b/networking/v1alpha3/service_entry.proto
index a551fee8c6..f22d16acc7 100644
--- a/networking/v1alpha3/service_entry.proto
+++ b/networking/v1alpha3/service_entry.proto
@@ -464,6 +464,9 @@ message ServiceEntry {
   // 1. subjectAltNames: In addition to verifying the SANs of the
   //    service accounts associated with the pods of the service, the
   //    SANs specified here will also be verified.
+  //
+  // **NOTE 3:** Ambient mode does not support wildcard hostsnames.
+  //
   // +kubebuilder:validation:MinItems=1
   // +kubebuilder:validation:MaxItems=256
   // +protoc-gen-crd:list-value-validation:XValidation:message="hostname cannot be wildcard",rule="self != '*'"
@@ -595,6 +598,9 @@ message ServiceEntry {
   // For a Kubernetes Service, the equivalent effect can be achieved by setting
   // the annotation "networking.istio.io/exportTo" to a comma-separated list
   // of namespace names.
+  //
+  // **Note:** Ambient mode does not support this field. Service entries will
+  // be exported to all namespaces.
   repeated string export_to = 7;
 
   // If specified, the proxy will verify that the server certificate's
diff --git a/networking/v1alpha3/sidecar.pb.go b/networking/v1alpha3/sidecar.pb.go
index bf86c1a082..9c2f2da418 100644
--- a/networking/v1alpha3/sidecar.pb.go
+++ b/networking/v1alpha3/sidecar.pb.go
@@ -25,8 +25,9 @@
 // $aliases: [/docs/reference/config/networking/v1alpha3/sidecar]
 
 // `Sidecar` describes the configuration of the sidecar proxy that mediates
-// inbound and outbound communication to the workload instance it is attached to. By
-// default, Istio will program all sidecar proxies in the mesh with the
+// inbound and outbound communication to the workload instance it is attached to.
+// `Sidecar` only applies to Sidecar mode.
+// By default, Istio will program all sidecar proxies in the mesh with the
 // necessary configuration required to reach every workload instance in the mesh, as
 // well as accept traffic on all the ports associated with the
 // workload. The `Sidecar` configuration provides a way to fine tune the set of
diff --git a/networking/v1alpha3/sidecar.pb.html b/networking/v1alpha3/sidecar.pb.html
index a4d72f07ba..6990863057 100644
--- a/networking/v1alpha3/sidecar.pb.html
+++ b/networking/v1alpha3/sidecar.pb.html
@@ -9,8 +9,9 @@
 number_of_entries: 8
 ---
 <p><code>Sidecar</code> describes the configuration of the sidecar proxy that mediates
-inbound and outbound communication to the workload instance it is attached to. By
-default, Istio will program all sidecar proxies in the mesh with the
+inbound and outbound communication to the workload instance it is attached to.
+<code>Sidecar</code> only applies to Sidecar mode.
+By default, Istio will program all sidecar proxies in the mesh with the
 necessary configuration required to reach every workload instance in the mesh, as
 well as accept traffic on all the ports associated with the
 workload. The <code>Sidecar</code> configuration provides a way to fine tune the set of
diff --git a/networking/v1alpha3/sidecar.proto b/networking/v1alpha3/sidecar.proto
index 2d60a306d5..332f6ceabb 100644
--- a/networking/v1alpha3/sidecar.proto
+++ b/networking/v1alpha3/sidecar.proto
@@ -21,8 +21,9 @@ syntax = "proto3";
 // $aliases: [/docs/reference/config/networking/v1alpha3/sidecar]
 
 // `Sidecar` describes the configuration of the sidecar proxy that mediates
-// inbound and outbound communication to the workload instance it is attached to. By
-// default, Istio will program all sidecar proxies in the mesh with the
+// inbound and outbound communication to the workload instance it is attached to.
+// `Sidecar` only applies to Sidecar mode.
+// By default, Istio will program all sidecar proxies in the mesh with the
 // necessary configuration required to reach every workload instance in the mesh, as
 // well as accept traffic on all the ports associated with the
 // workload. The `Sidecar` configuration provides a way to fine tune the set of
diff --git a/networking/v1alpha3/virtual_service.pb.go b/networking/v1alpha3/virtual_service.pb.go
index b72b594e71..6960ab7b92 100644
--- a/networking/v1alpha3/virtual_service.pb.go
+++ b/networking/v1alpha3/virtual_service.pb.go
@@ -61,6 +61,11 @@
 // The source of traffic can also be matched in a routing rule. This allows routing
 // to be customized for specific client contexts.
 //
+// *Note for Ambient Users*: Support for `VirtualService` in Ambient mode is alpha, and
+// there are no plans to increase support.
+// Use [Gateway API](https://istio.io/latest/docs/tasks/traffic-management/ingress/gateway-api/#mesh-traffic)
+// for a stable traffic management API.
+//
 // The following example on Kubernetes, routes all HTTP traffic by default to
 // pods of the reviews service with label "version: v1". In addition,
 // HTTP requests with path starting with /wpcatalog/ or /consumercatalog/ will
@@ -1395,6 +1400,8 @@ type HTTPMatchRequest struct {
 	//
 	// **Note:** This is not a runtime match, but is a selector; it filters which workloads the
 	// VirtualService applies to.
+	//
+	// **Note:** Ambient mode does not support this field.
 	SourceLabels map[string]string `protobuf:"bytes,7,rep,name=source_labels,json=sourceLabels,proto3" json:"source_labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// Names of gateways where the rule should be applied. Gateway names
 	// in the top-level `gateways` field of the VirtualService (if any) are overridden. The gateway
@@ -1431,6 +1438,8 @@ type HTTPMatchRequest struct {
 	//
 	// **Note:** This is not a runtime match, but is a selector; it filters which workloads the
 	// VirtualService applies to.
+	//
+	// **Note:** Ambient mode does not support this field.
 	SourceNamespace string `protobuf:"bytes,13,opt,name=source_namespace,json=sourceNamespace,proto3" json:"source_namespace,omitempty"`
 	// The human readable prefix to use when emitting statistics for this route.
 	// The statistics are generated with prefix route.<stat_prefix>.
@@ -1795,6 +1804,8 @@ type L4MatchAttributes struct {
 	//
 	// **Note:** This is not a runtime match, but is a selector; it filters which workloads the
 	// VirtualService applies to.
+	//
+	// **Note:** Ambient mode does not support this field.
 	SourceLabels map[string]string `protobuf:"bytes,4,rep,name=source_labels,json=sourceLabels,proto3" json:"source_labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// Names of gateways where the rule should be applied. Gateway names
 	// in the top-level `gateways` field of the VirtualService (if any) are overridden. The gateway
@@ -1806,6 +1817,8 @@ type L4MatchAttributes struct {
 	//
 	// **Note:** This is not a runtime match, but is a selector; it filters which workloads the
 	// VirtualService applies to.
+	//
+	// **Note:** Ambient mode does not support this field.
 	SourceNamespace string `protobuf:"bytes,6,opt,name=source_namespace,json=sourceNamespace,proto3" json:"source_namespace,omitempty"`
 	unknownFields   protoimpl.UnknownFields
 	sizeCache       protoimpl.SizeCache
@@ -1906,6 +1919,8 @@ type TLSMatchAttributes struct {
 	//
 	// **Note:** This is not a runtime match, but is a selector; it filters which workloads the
 	// VirtualService applies to.
+	//
+	// **Note:** Ambient mode does not support this field.
 	SourceLabels map[string]string `protobuf:"bytes,5,rep,name=source_labels,json=sourceLabels,proto3" json:"source_labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// Names of gateways where the rule should be applied. Gateway names
 	// in the top-level `gateways` field of the VirtualService (if any) are overridden. The gateway
@@ -1917,6 +1932,8 @@ type TLSMatchAttributes struct {
 	//
 	// **Note:** This is not a runtime match, but is a selector; it filters which workloads the
 	// VirtualService applies to.
+	//
+	// **Note:** Ambient mode does not support this field.
 	SourceNamespace string `protobuf:"bytes,7,opt,name=source_namespace,json=sourceNamespace,proto3" json:"source_namespace,omitempty"`
 	unknownFields   protoimpl.UnknownFields
 	sizeCache       protoimpl.SizeCache
diff --git a/networking/v1alpha3/virtual_service.pb.html b/networking/v1alpha3/virtual_service.pb.html
index 637a497cc1..497d484ad3 100644
--- a/networking/v1alpha3/virtual_service.pb.html
+++ b/networking/v1alpha3/virtual_service.pb.html
@@ -37,6 +37,10 @@
 (or subset/version of it) defined in the registry.</p>
 <p>The source of traffic can also be matched in a routing rule. This allows routing
 to be customized for specific client contexts.</p>
+<p><em>Note for Ambient Users</em>: Support for <code>VirtualService</code> in Ambient mode is alpha, and
+there are no plans to increase support.
+Use <a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/gateway-api/#mesh-traffic">Gateway API</a>
+for a stable traffic management API.</p>
 <p>The following example on Kubernetes, routes all HTTP traffic by default to
 pods of the reviews service with label &ldquo;version: v1&rdquo;. In addition,
 HTTP requests with path starting with /wpcatalog/ or /consumercatalog/ will
@@ -1088,6 +1092,7 @@ <h2 id="HTTPMatchRequest">HTTPMatchRequest</h2>
 <code>mesh</code> for this field to be applicable.</p>
 <p><strong>Note:</strong> This is not a runtime match, but is a selector; it filters which workloads the
 VirtualService applies to.</p>
+<p><strong>Note:</strong> Ambient mode does not support this field.</p>
 
 </td>
 </tr>
@@ -1162,6 +1167,7 @@ <h2 id="HTTPMatchRequest">HTTPMatchRequest</h2>
 it must include the reserved gateway <code>mesh</code> for this field to be applicable.</p>
 <p><strong>Note:</strong> This is not a runtime match, but is a selector; it filters which workloads the
 VirtualService applies to.</p>
+<p><strong>Note:</strong> Ambient mode does not support this field.</p>
 
 </td>
 </tr>
@@ -1367,6 +1373,7 @@ <h2 id="L4MatchAttributes">L4MatchAttributes</h2>
 <code>mesh</code> in order for this field to be applicable.</p>
 <p><strong>Note:</strong> This is not a runtime match, but is a selector; it filters which workloads the
 VirtualService applies to.</p>
+<p><strong>Note:</strong> Ambient mode does not support this field.</p>
 
 </td>
 </tr>
@@ -1391,6 +1398,7 @@ <h2 id="L4MatchAttributes">L4MatchAttributes</h2>
 it must include the reserved gateway <code>mesh</code> for this field to be applicable.</p>
 <p><strong>Note:</strong> This is not a runtime match, but is a selector; it filters which workloads the
 VirtualService applies to.</p>
+<p><strong>Note:</strong> Ambient mode does not support this field.</p>
 
 </td>
 </tr>
@@ -1455,6 +1463,7 @@ <h2 id="TLSMatchAttributes">TLSMatchAttributes</h2>
 <code>mesh</code> in order for this field to be applicable.</p>
 <p><strong>Note:</strong> This is not a runtime match, but is a selector; it filters which workloads the
 VirtualService applies to.</p>
+<p><strong>Note:</strong> Ambient mode does not support this field.</p>
 
 </td>
 </tr>
@@ -1479,6 +1488,7 @@ <h2 id="TLSMatchAttributes">TLSMatchAttributes</h2>
 it must include the reserved gateway <code>mesh</code> for this field to be applicable.</p>
 <p><strong>Note:</strong> This is not a runtime match, but is a selector; it filters which workloads the
 VirtualService applies to.</p>
+<p><strong>Note:</strong> Ambient mode does not support this field.</p>
 
 </td>
 </tr>
diff --git a/networking/v1alpha3/virtual_service.proto b/networking/v1alpha3/virtual_service.proto
index d81ad2d72c..c47d8a49d0 100644
--- a/networking/v1alpha3/virtual_service.proto
+++ b/networking/v1alpha3/virtual_service.proto
@@ -57,6 +57,11 @@ syntax = "proto3";
 // The source of traffic can also be matched in a routing rule. This allows routing
 // to be customized for specific client contexts.
 //
+// *Note for Ambient Users*: Support for `VirtualService` in Ambient mode is alpha, and
+// there are no plans to increase support.
+// Use [Gateway API](https://istio.io/latest/docs/tasks/traffic-management/ingress/gateway-api/#mesh-traffic)
+// for a stable traffic management API.
+//
 // The following example on Kubernetes, routes all HTTP traffic by default to
 // pods of the reviews service with label "version: v1". In addition,
 // HTTP requests with path starting with /wpcatalog/ or /consumercatalog/ will
@@ -818,6 +823,8 @@ message HTTPMatchRequest {
   //
   // **Note:** This is not a runtime match, but is a selector; it filters which workloads the
   // VirtualService applies to.
+  //
+  // **Note:** Ambient mode does not support this field.
   map<string, string> source_labels = 7;
 
   // Names of gateways where the rule should be applied. Gateway names
@@ -859,6 +866,8 @@ message HTTPMatchRequest {
   //
   // **Note:** This is not a runtime match, but is a selector; it filters which workloads the
   // VirtualService applies to.
+  //
+  // **Note:** Ambient mode does not support this field.
   string source_namespace = 13;
 
   // The human readable prefix to use when emitting statistics for this route.
@@ -990,6 +999,8 @@ message L4MatchAttributes {
   //
   // **Note:** This is not a runtime match, but is a selector; it filters which workloads the
   // VirtualService applies to.
+  //
+  // **Note:** Ambient mode does not support this field.
   map<string, string> source_labels = 4;
 
   // Names of gateways where the rule should be applied. Gateway names
@@ -1003,6 +1014,8 @@ message L4MatchAttributes {
   //
   // **Note:** This is not a runtime match, but is a selector; it filters which workloads the
   // VirtualService applies to.
+  //
+  // **Note:** Ambient mode does not support this field.
   string source_namespace = 6;
 }
 
@@ -1034,6 +1047,8 @@ message TLSMatchAttributes {
   //
   // **Note:** This is not a runtime match, but is a selector; it filters which workloads the
   // VirtualService applies to.
+  //
+  // **Note:** Ambient mode does not support this field.
   map<string, string> source_labels = 5;
 
   // Names of gateways where the rule should be applied. Gateway names
@@ -1047,6 +1062,8 @@ message TLSMatchAttributes {
   //
   // **Note:** This is not a runtime match, but is a selector; it filters which workloads the
   // VirtualService applies to.
+  //
+  // **Note:** Ambient mode does not support this field.
   string source_namespace = 7;
 }