Introduce GatewayControllerMode

pilot/pkg/bootstrap/server.go

@@ -1123,7 +1123,7 @@ func (s *Server) initControllers(args *PilotArgs) error {
 
 	s.initSDSServer()
 
-	if features.EnableEnhancedResourceScoping {
+	if features.EnableEnhancedResourceScoping || features.EnableGatewayControllerMode {
 		// setup namespace filter
 		args.RegistryOptions.KubeOptions.DiscoveryNamespacesFilter = s.multiclusterController.DiscoveryNamespacesFilter
 	}

pilot/pkg/features/pilot.go

@@ -706,6 +706,10 @@ var (
 			"generated root certificate.").Get()
 
 	EnableFederation = env.RegisterBoolVar("PILOT_ENABLE_FEDERATION", false, "").Get()
+
+	EnableGatewayControllerMode = env.Register("PILOT_ENABLE_GATEWAY_CONTROLLER_MODE", false,
+		"If enabled, istiod will watch Gateway API and k8s resources in every namespace, but Istio resources will be limited to "+
+			"namespaces that match the meshConfig.discoverySelectors").Get()
 )
 
 // UnsafeFeaturesEnabled returns true if any unsafe features are enabled.

pilot/pkg/serviceregistry/kube/controller/controller.go

@@ -276,6 +276,10 @@ func NewController(kubeClient kubelib.Client, options Options) *Controller {
 			)
 		}
 
+		// don't use discoveryFilters if in gw-controller mode. always watch all namespaces
+		if features.EnableGatewayControllerMode {
+			c.opts.DiscoveryNamespacesFilter = namespace.NewDiscoveryNamespacesFilter(c.namespaces, []*metav1.LabelSelector{})
+		}
 		if c.opts.DiscoveryNamespacesFilter == nil {
 			c.opts.DiscoveryNamespacesFilter = namespace.NewDiscoveryNamespacesFilter(c.namespaces, options.MeshWatcher.Mesh().DiscoverySelectors)
 		}