diff --git a/charts/kubezero-argo-cd/templates/istio-authorization-policy.yaml b/charts/kubezero-argo-cd/templates/istio-authorization-policy.yaml
index e9522f16..d757cd65 100644
--- a/charts/kubezero-argo-cd/templates/istio-authorization-policy.yaml
+++ b/charts/kubezero-argo-cd/templates/istio-authorization-policy.yaml
@@ -5,6 +5,8 @@ kind: AuthorizationPolicy
 metadata:
   name: argocd-deny-not-in-ipblocks
   namespace: istio-system
+  labels:
+{{ include "kubezero-lib.labels" . | indent 4 }}
 spec:
   selector:
     matchLabels:
diff --git a/charts/kubezero-metrics/templates/istio-authorization-policy.yaml b/charts/kubezero-metrics/templates/istio-authorization-policy.yaml
index a5b01c18..29e832e4 100644
--- a/charts/kubezero-metrics/templates/istio-authorization-policy.yaml
+++ b/charts/kubezero-metrics/templates/istio-authorization-policy.yaml
@@ -5,6 +5,8 @@ kind: AuthorizationPolicy
 metadata:
   name: grafana-deny-not-in-ipblocks
   namespace: istio-system
+  labels:
+{{ include "kubezero-lib.labels" . | indent 4 }}
 spec:
   selector:
     matchLabels:
@@ -30,6 +32,8 @@ kind: AuthorizationPolicy
 metadata:
   name: prometheus-deny-not-in-ipblocks
   namespace: istio-system
+  labels:
+{{ include "kubezero-lib.labels" . | indent 4 }}
 spec:
   selector:
     matchLabels:
diff --git a/charts/kubezero-metrics/templates/istio-service.yaml b/charts/kubezero-metrics/templates/istio-service.yaml
index 5b7c3bd1..366962e6 100644
--- a/charts/kubezero-metrics/templates/istio-service.yaml
+++ b/charts/kubezero-metrics/templates/istio-service.yaml
@@ -3,7 +3,8 @@ apiVersion: networking.istio.io/v1alpha3
 kind: VirtualService
 metadata:
   name: grafana
-  namespace: monitoring
+  labels:
+{{ include "kubezero-lib.labels" . | indent 4 }}
 spec:
   hosts:
   - {{ .Values.grafana.istio.url }}
@@ -20,7 +21,8 @@ apiVersion: networking.istio.io/v1alpha3
 kind: VirtualService
 metadata:
   name: prometheus
-  namespace: monitoring
+  labels:
+{{ include "kubezero-lib.labels" . | indent 4 }}
 spec:
   hosts:
   - {{ .Values.prometheus.istio.url }}