3.2.2 (1.27.5) introduce an upstream fix that breaks how Gateway API work in Openshift via CIO.

Commit: https://github.com/openshift-service-mesh/istio/commit/204addd6923c5e8389cfea7652e231715997ab7a

CIO rely on a revisioned istio control plane to isolate it from the other possible control planes on the cluster. This to avoid conflicting updates etc.

Prior to this commit, CIO would add a revision label to the Gateway resource automatically to bind the resource to the CIO revision of istio. The assumption was that the rest of the Gateway API resources would naturally follow where they are connected.

The bug fix above seems to indicate that in some situations, that has not been the case. But from what I can gather, the bug fix only fix who can write to the status of these Resources, not who can read/configure them.

The current situation: You can deploy a Gateway and a HTTPRoute in CIO. CIO will apply the label to the Gateway only. HTTPRoute will never see any Status updates about what has been configured or if it's working, but it seems to still be configured and working. More testing needed.

Workaround: revision labels all Gateway API+ resource. Placing it on the namespace level triggers istio sidecar injection which fails in this setup.