Ambient SE handler should work regardless of EnableK8SServiceSelectWo…

…rkloadEntries setting

Signed-off-by: Kevin Dorosh <kevin.dorosh@solo.io>

pilot/pkg/serviceregistry/kube/controller/controller.go

@@ -915,7 +915,7 @@ func (c *Controller) serviceInstancesFromWorkloadInstance(si *model.WorkloadInst
 
 // AppendServiceHandler adds service resource event handler. Service Entries does not use these handlers.
 func (c *Controller) ServiceEntryHandler(_ *model.Service, svc *model.Service, event model.Event) {
-	if features.EnableAmbientControllers {
+	if features.EnableAmbientControllers && c.ambientIndex != nil {
 		c.ambientIndex.handleServiceEntry(svc, event)
 	}
 }

pilot/pkg/serviceregistry/kube/controller/multicluster.go

@@ -237,6 +237,10 @@ func (m *Multicluster) initializeCluster(cluster *multicluster.Cluster, kubeCont
 	if m.configController != nil && features.EnableAmbientControllers {
 		m.configController.RegisterEventHandler(gvk.AuthorizationPolicy, kubeRegistry.AuthorizationPolicyHandler)
 		m.configController.RegisterEventHandler(gvk.PeerAuthentication, kubeRegistry.PeerAuthenticationHandler)
+		if configCluster && m.serviceEntryController != nil {
+			// configController is used by ambient service entry handler to get workload entries
+			m.serviceEntryController.AppendServiceHandler(kubeRegistry.ServiceEntryHandler)
+		}
 	}
 
 	if configCluster && m.serviceEntryController != nil && features.EnableEnhancedResourceScoping {
@@ -247,7 +251,6 @@ func (m *Multicluster) initializeCluster(cluster *multicluster.Cluster, kubeCont
 	if features.EnableK8SServiceSelectWorkloadEntries {
 		if m.serviceEntryController != nil && configCluster {
 			// Add an instance handler in the service entry store to notify kubernetes about workload entry events
-			m.serviceEntryController.AppendServiceHandler(kubeRegistry.ServiceEntryHandler)
 			m.serviceEntryController.AppendWorkloadHandler(kubeRegistry.WorkloadInstanceHandler)
 		} else if features.WorkloadEntryCrossCluster {
 			// TODO only do this for non-remotes, can't guarantee CRDs in remotes (depends on https://github.com/istio/istio/pull/29824)
@@ -256,9 +259,6 @@ func (m *Multicluster) initializeCluster(cluster *multicluster.Cluster, kubeCont
 					configStore, options.XDSUpdater,
 					serviceentry.WithClusterID(cluster.ID),
 					serviceentry.WithNetworkIDCb(kubeRegistry.Network))
-				if m.serviceEntryController != nil {
-					m.serviceEntryController.AppendServiceHandler(kubeRegistry.ServiceEntryHandler)
-				}
 				// Services can select WorkloadEntry from the same cluster. We only duplicate the Service to configure kube-dns.
 				kubeController.workloadEntryController.AppendWorkloadHandler(kubeRegistry.WorkloadInstanceHandler)
 				// ServiceEntry selects WorkloadEntry from remote cluster