security -- simplified configuration -- multiple versions of the ingress can be used, to minimize upgrade risks - the new chart uses the default namespace service account, and doesn't require additional RBAC permissions. - simplified label and chart structure. - ability to run a pilot dedicated for the gateway, isolated from the main pilot. This is more robust, safer on upgrades and allows a bit more flexibility. - the dedicated pilot-per-ingress is required if the gateway needs to support k8s-style ingress....