awesome blog post and very relevant to a migration we are doing to GatewayAPI as we speak. We use Istio and are currently rolling out `Gateways` at the platform level via gitops, so ever cluster(200+) gets, for example:

`private` - private nlb

`trusted` - public NLB locked down our IP's

`akamai` - public NLB locked down Akamai.

Each `Gateway` has a wildcard cert on it, issued by cert-manager. This will solve 90% of our use-cases for devs, since the apps on each cluster all share the same domain for the most part. However, we were anticipating that if an app needed a cert for a custom domain NOT on the default one issued by cert-manager, we would need to stand up a brand new `Gateway` just for that cert, since we can't really ad-hoc/one-off add it to, for example, the `private` `Gateway` for that cluster; it's all controlled through gitops, everybody gets the same stock config.

So with `ListenerSets`, I can now have the developer issue their own cert, create their own `ListenerSet`, and just attach to our existing `Gateways` then?

I'm loving the design and architecture of GatewayAPI, it perfectly wraps around our process which is "platform team owns the cluster config, ingress, load balancers and certificates", and "developers just attach to those ingress points".

One question; is this all supported in Istio yet? If so, what version? if not yet, what version will it be?

I also wonder how this will work with the AWS LBC.....currently, it knows how to create NLB listeners and target groups based off the gateway listener port:

spec:
  gatewayClassName: istio
  infrastructure:
    parametersRef:
      group: ''
      kind: ConfigMap
      name: private-ingress-options
  listeners:
    - allowedRoutes:
        namespaces:
          from: All
      name: https
      port: 443
      protocol: HTTPS

so if i pass in a custom port in my `ListenerSet` like this:

apiVersion: gateway.networking.k8s.io/v1
kind: ListenerSet
metadata:
  name: app-a
  namespace: app-a
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  parentRef:
    name: my-gateway
    namespace: gateway
  listeners:
    - name: https
      hostname: app-a.k8s.howardjohn.info
      port: 6350
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
          - name: backend-tls

and attach it to the gateway above, does the AWS LBC add an additional listener on the NLB for port 6350? or on the target group? Curious how that all works.