Add annotation to 'ignore' specific policy attachment objects

annotation/annotations.yaml

@@ -447,6 +447,18 @@ annotations:
     resources:
       - Pod
 
+  - name: istio.io/ignore-policy-attachment
+    featureStatus: Alpha
+    description: When set to true on a policy attachment CRD object (BackendTLSPolicy,
+      BackendTrafficPolicy), the object will not be used by the
+      Istio control plane to generate configuration or conflict with other
+      policies.
+    deprecated: false
+    hidden: false
+    resources:
+      - BackendTLSPolicy
+      - BackendTrafficPolicy
+
   - name: proxy.istio.io/overrides
     featureStatus: Alpha
     description: Used internally to indicate user-specified overrides in the proxy container of the pod during injection.

releasenotes/notes/60122.yaml

@@ -0,0 +1,21 @@
+apiVersion: release-notes/v2
+kind: feature
+area: traffic-management
+issue:
+- https://github.com/istio/istio/issues/60122
+releaseNotes:
+- |
+  **Added** support for excluding policy configuration from Istio when the
+  `istio.io/ignore-policy-attachment` annotation is set to "true" on a
+  BackendTLSPolicy, or XBackendTrafficPolicy object. This allows users to
+  prevent specific policies from being translated into Istio configuration,
+  when policy is intended for a different gateway controller than Istio.
+
+  Example usage:
+  ```yaml
+  apiVersion: gateway.networking.k8s.io/v1
+  kind: BackendTLSPolicy
+  metadata:
+    annotations:
+      istio.io/ignore-policy-attachment: "true"
+  ```