Our docs currently suggest creating an ingress gateway in a namespace separate from the control plane namespace [1]

However, this causes the istio ingress controller to ignore ingress resources, unless the K8S_INGRESS_NS env var is set on istiod deployment, matching the namespace where the ingress gateway is deployed.

example configuration:

apiVersion: sailoperator.io/v1alpha1
kind: Istio
metadata: 
  name: default
spec: 
  version: v1.23.0
  namespace: istio-system
  values: 
    pilot: 
      env: 
        K8S_INGRESS_NS: <ingress gateway ns>

The upstream documentation only seems to mention this in a list of available env vars [2]
 

[1] https://github.com/istio-ecosystem/sail-operator/blob/main/docs/common/create-and-configure-gateways.md#creating-and-configuring-gateways
[2] https://istio.io/latest/docs/reference/commands/pilot-discovery/#envvars