Repository: istio/istio
File: pilot/pkg/features/experimental.go (Go)

Code before:
			" they will be kept as independent rules if the exportTos are not equal.").Get()

	UnifiedSidecarScoping = env.Register("PILOT_UNIFIED_SIDECAR_SCOPE", true,
		"If true, unified SidecarScope creation will be used. This is only intended as a temporary feature flag for backwards compatibility.").Get()

	CACertConfigMapName = env.Register("PILOT_CA_CERT_CONFIGMAP", "istio-ca-root-cert",
		"The name of the ConfigMap that stores the Root CA Certificate that is used by istiod").Get()

	EnvoyStatusPortEnableProxyProtocol = env.Register("ENVOY_STATUS_PORT_ENABLE_PROXY_PROTOCOL", false,
		"If enabled, Envoy will support requests with proxy protocol on its status port").Get()

	EnableGatewayAPIInferenceExtension = env.Register("ENABLE_GATEWAY_API_INFERENCE_EXTENSION", false,
		"If true, support gateway inference extension routing apis").Get()

	EnableWildcardHostServiceEntriesForTLS = env.Register("ENABLE_WILDCARD_HOST_SERVICE_ENTRIES_FOR_TLS", false,
		"If enabled, ServiceEntries with wildcard hosts and dynamic dns resolution will be allowed for TLS traffic. "+
			"This is a security risk, susceptible to SNI spoofing, and should be used with caution. "+
			"Only consider using this feature if the client is trusted and you understand the risks.").Get()

	IgnorePilotResources = env.Register(
		"IGNORE_PILOT_RESOURCES",
		false,
		"If true, pilot will ignore any Istio specific resource."+
			"This can be used in case it is desired that Pilot watches just Gateway API resources.").Get()

	bypassCRDFilter = env.Register(
		"BYPASS_CRD_FILTER",
		"",
		"If set, and combined with 'IGNORE_PILOT_RESOURCES' the resources set on this list will not be ignored."+
			"This value should be a comma-separated list of resources names",
	)

	BypassCRDFilter = func() []string {
		filters := bypassCRDFilter.Get()

		if filters == "" {
			return []string{}
		}

		return strings.Split(filters, ",")
	}()
)


Review comment (suggestion):
Per comments on the doc, I think we want a deny-list of resources, that can include a prefix match like `*.istio.io`

Code after:

	UnifiedSidecarScoping = env.Register("PILOT_UNIFIED_SIDECAR_SCOPE", true,
		"If true, unified SidecarScope creation will be used. This is only intended as a temporary feature flag for backwards compatibility.").Get()

	CACertConfigMapName = env.Register("PILOT_CA_CERT_CONFIGMAP", "istio-ca-root-cert",
		"The name of the ConfigMap that stores the Root CA Certificate that is used by istiod").Get()

	CRLConfigMapName = env.Register("PILOT_CRL_CONFIGMAP", "istio-ca-crl",
		"The name of the ConfigMap that stores the Certificate Revocation List (CRL) for a plugged-in CA").Get()

	EnvoyStatusPortEnableProxyProtocol = env.Register("ENVOY_STATUS_PORT_ENABLE_PROXY_PROTOCOL", false,
		"If enabled, Envoy will support requests with proxy protocol on its status port").Get()

	EnableGatewayAPIInferenceExtension = env.Register("ENABLE_GATEWAY_API_INFERENCE_EXTENSION", false,
		"If true, support gateway inference extension routing apis").Get()

	EnableWildcardHostServiceEntriesForTLS = env.Register("ENABLE_WILDCARD_HOST_SERVICE_ENTRIES_FOR_TLS", false,
		"If enabled, ServiceEntries with wildcard hosts and dynamic dns resolution will be allowed for TLS traffic. "+
			"This is a security risk, susceptible to SNI spoofing, and should be used with caution. "+
			"Only consider using this feature if the client is trusted and you understand the risks.").Get()

	PilotIgnoreResourcesEnv = env.Register(
		"PILOT_IGNORE_RESOURCES",
		"",
		"If set, the resources set on this list will be ignored and never reconciled."+
			"This value should be a comma-separated list of resources names."+
			"Items on this list can be prefixed with a '*.' meaning a whole group should be ignored.",
	).Get()

	PilotIncludeResourcesEnv = env.Register(
		"PILOT_INCLUDE_RESOURCES",
		"",
		"If set, and combined with 'PILOT_IGNORE_RESOURCES' the resources set on this list will not be ignored."+
			"This value should be a comma-separated list of resources names."+
			"Items on this list can be prefixed with a '*.' meaning a whole group should be included regardless of the ignore list.",
	).Get()
)