The federation.maistra.io/proxy label is used to associate istio Gateway resources with a specific gateway workload that is used to proxy traffic between meshes in a federated mesh.  This limits the workload to only being able to proxy traffic for a specific remote mesh (i.e. it can't be shared/reused by/for other meshes).  We should consider an alternative if we want users to be able use a single gateway for all their federated traffic.

One option might be to allow the user to specify specific resource labels that should be used to identify the workloads.  This might be a good option for identifying gateways in the MeshFederation resource, although configuration of the outbound discovery traffic currently requires the name of the service associated with the egress gateway being used to proxy traffic.