feat(source/istio): fix gateway→service selector matching with per-entry indexer

[ivankatliarchuk]

---

Why:

The Istio gateway source resolves DNS targets by matching gateway.spec.selector against service.spec.selector using subset semantics — a gateway with {istio:
ingressgateway} must match a service whose selector is {istio: ingressgateway, release: istio}. PR kubernetes-sigs#5708 attempted to speed this up with an index but keyed services by a
hash of their full selector, breaking the subset match (only exact matches worked). The PR was closed as buggy.

https://github.com/kubernetes-sigs/external-dns/pull/5708/changes#diff-6895e4e602c3815e3e3b67fa2cb633b9b2c4b83bb22ef9caebf650a5f9e4d0ba

What:

• Adds IndexerSpecSelectorEntries — a multi-valued indexer that stores each k=v entry in service.spec.selector as a separate index key, correctly supporting subset-match
  lookups
• Replaces the O(n) full-scan in EndpointTargetsFromServices with an O(1) index lookup on the first selector entry, with MatchesServiceSelector as a post-filter for
  multi-entry selectors
• Registers the indexer in both NewIstioGatewaySource and NewIstioVirtualServiceSource
• Adds tests covering: subset match, superset no-match, index false-positive elimination, empty selector, index-not-registered error, and map-iteration-order stability

More

• Yes, this PR title follows Conventional Commits
• Yes, I added unit tests
• Yes, I updated end user documentation accordingly

[coveralls]

Pull Request Test Coverage Report for Build 23384706663

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• 39 unchanged lines in 4 files lost coverage.
• Overall coverage decreased (-0.02%) to 78.101%

---

Files with Coverage Reduction	New Missed Lines	%
endpoints.go	3	93.33%
istio_gateway.go	7	90.12%
istio_virtualservice.go	14	87.91%
informers/indexers.go	15	73.97%

Totals
Change from base Build 23382274615:	-0.02%
Covered Lines:	16423
Relevant Lines:	21028

---

💛 - Coveralls