<p>I am confused between these 2. Both were provisioned on GKE cluster with Istio addon enabled, both are LoadBalancer type, but they are on a different namespace. What could be their use case?</p>

<p><strong>gke-system</strong> namespace</p>

<pre><code>vagrant@ubuntu-xenial:~/cloud_donws/iac$ kubectl get svc -n gke-system
NAME                    TYPE           CLUSTER-IP     EXTERNAL-IP      PORT(S)                                      AGE
cluster-local-gateway   ClusterIP      10.53.0.76     &lt;none&gt;           15020/TCP,80/TCP,443/TCP                     11h
istio-ingress           LoadBalancer   10.53.23.203   35.x.113.x   15020:31917/TCP,80:30102/TCP,443:31494/TCP   11h
istio-pilot             ClusterIP      10.53.20.61    &lt;none&gt;           15010/TCP,15011/TCP,8080/TCP,15014/TCP       11h
</code></pre>

<p><strong>istio-system</strong> namespace</p>

<pre><code>vagrant@ubuntu-xenial:~/cloud_donws/iac$ kubectl get svc -n istio-system
NAME                     TYPE           CLUSTER-IP     EXTERNAL-IP      PORT(S)                                                                                                                                      AGE
istio-citadel            ClusterIP      10.53.19.175   &lt;none&gt;           8060/TCP,15014/TCP                                                                                                                           11h
istio-galley             ClusterIP      10.53.26.27    &lt;none&gt;           443/TCP,15014/TCP,9901/TCP                                                                                                                   11h
istio-ingressgateway     LoadBalancer   10.53.27.245   x.197.x.218   15020:31856/TCP,80:31966/TCP,443:30142/TCP,31400:30876/TCP,15029:30354/TCP,15030:32017/TCP,15031:32425/TCP,15032:32647/TCP,15443:31390/TCP   11h
istio-pilot              ClusterIP      10.53.11.103   &lt;none&gt;           15010/TCP,15011/TCP,8080/TCP,15014/TCP                                                                                                       11h
istio-policy             ClusterIP      10.53.0.53     &lt;none&gt;           9091/TCP,15004/TCP,15014/TCP                                                                                                                 11h
istio-sidecar-injector   ClusterIP      10.53.4.58     &lt;none&gt;           443/TCP                                                                                                                                      11h
istio-telemetry          ClusterIP      10.53.3.170    &lt;none&gt;           9091/TCP,15004/TCP,15014/TCP,42422/TCP                                                                                                       11h
promsd                   ClusterIP      10.53.15.102   &lt;none&gt;           9090/TCP                                                                                                                                     11h
</code></pre>

<p>like for this example from Google:</p>

<p><a href="https://cloud.google.com/solutions/integrating-https-load-balancing-with-istio-and-cloud-run-for-anthos-deployed-on-gke" rel="nofollow noreferrer">https://cloud.google.com/solutions/integrating-https-load-balancing-with-istio-and-cloud-run-for-anthos-deployed-on-gke</a></p>

<p>it points to <strong>istio-ingress.gke-system.svc.cluster.local</strong> instead of <strong>istio-ingressgateway.istio-system.svc.cluster.local</strong></p>

<p><a href="https://i.stack.imgur.com/wyabK.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/wyabK.png" alt="enter image description here"></a></p>

<p>Looks like you have enabled Cloud Run for this cluster. Cloud Run creates its control plane on gke-system namespace, and then you have installed Istio, which by default, creates the control plane in istio-system namespace.</p>
<p>For more details you can check this documentation:
<a href="https://cloud.google.com/kuberun/docs/setup#using_a_separate_istio_installation" rel="nofollow noreferrer">https://cloud.google.com/kuberun/docs/setup#using_a_separate_istio_installation</a></p>
<p>Where it says:</p>
<ul>
<li><p>The istio-system namespace, with the cluster local domain istio-ingressgateway.istio-system.svc.cluster.local that is set up by default when you use an additional Istio installation.</p>
</li>
<li><p>The gke-system namespace, with the cluster local domain istio-ingress.gke-system.svc.cluster.local that is set up with the default Cloud Run for Anthos on Google Cloud install.</p>
</li>
</ul>
