How do we ingress via Istio to Keycloak if sidecar injection is disabled in the keycloak namespace?

Given this namespace label on the Keycloak namespace ( from https://repo1.dso.mil/platform-one/big-bang/bigbang/-/blob/1.12.0/chart/templates/keycloak/namespace.yaml ):

    istio-injection: disabled-because-keycloak-hates-istio

How do we ingress via Istio gateways to the Keycloak pods without sidecars running in them ?