When a headless service without selectors is present in the namespace where a SMCP is installed, IOR will sometimes update the route to point to that service, instead of the istio-ingressgateway service.

This is because we find the svc by looking up all ingress gateway pods and then check whether a service's selector matches the pod's labels. The problem is that empty selectors will match any labels, meaning that the headless service will be selected if it is encountered before the actual ingressgateway service.