opened
mdgreenfield
**Describe the bug**
When using SDS in the sidecar injected `istio-proxy` by configuring `.Values.global.sds.enabled` we receive connection errors from `istio-proxy`/Envoy because we also have `controlPlaneSecurityEnabled: true`.

This issue looks to be introduced in https://github.com/istio/istio/commit/0b3bd99657a9528e3d9e4a5c5cb1cccc77b6c890#diff-be47e44182a3c785141d47d28a66f2d7R192

**Expected behavior**
With SDS enabled and `controlPlaneSecurityEnabled: true` `istio-proxy` should be able to connect to the control plan.

I believe that [this condition](https://github.com/istio/istio/commit/0b3bd99657a9528e3d9e4a5c5cb1cccc77b6c890#diff-be47e44182a3c785141d47d28a66f2d7R192) should be on `.Values.global.controlPlaneSecurityEnabled` and will need to be addressed in both the `istio` and `istio-remote` charts.

**Steps to reproduce the bug**
configure `.Values.global.sds.enabled` and `.Values.global.controlPlaneSecurityEnabled` to `true`.

**Version**
We're using the nightly istio version release-1.1-20190125-09-16

**Installation**
- Multi-cluster environment (using the `istio` chart in the primary cluster and and `istio-remote` in the secondary cluster)
- SDS enabled
- Control plane security enabled
- Per-pod Citadel node agent

**Environment**
AWS
istio-proxy control plane connection issues when both SDS and control plane security are enabled
issue
created
mdgreenfield
/cc @wattli
comment
created
hercynium
This is still an issue in Istio 1.1.6, as I've just stumbled across it. Is there any timeline for a fix? Is the control plane really unsecured when controlPlaneSecurityEnabled=false?
comment
created
quanjielin
@hercynium there is pending fix PR https://github.com/istio/istio/pull/13593 
/cc @wenchenglu
comment
created
hercynium
Willl this land in 1.2?
comment
created
christianwoehrle
Still an issue in istio 1.1.8.

It can be reproduced with the example from https://istio.io/docs/tasks/security/auth-sds/

When the line 
```
  controlPlaneSecurityEnabled: true
```
is added to the values-istio-sds-auth.yaml file, the the example doesn`t work anymore.

istio-proxy then waits for certs in /etc/certs/ that it never gets.

```
2019-06-10T16:49:28.253269Z     info    Monitored certs: []string{"/etc/certs/cert-chain.pem", "/etc/certs/key.pem", "/etc/certs/root-cert.pem"}
2019-06-10T16:49:28.253276Z     info    waiting 2m0s for /etc/certs/cert-chain.pem
2019-06-10T16:49:29.254351Z     info    waiting for certificates
2019-06-10T16:49:29.354492Z     info    waiting for certificates

...
```
comment
created
quanjielin
/cc @costinm @duderino
comment
closed
JimmyCYJ
issue
created
JimmyCYJ
This control plane SDS support will be shipped with release 1.3
comment
This issue has been automatically marked as stale because it has not had activity in the last 90 days. It will be closed in the next 30 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.
This message directly preceded comment from bot *stale[bot]* by author *quanjielin*:
/cc @costinm @duderino
This message directly preceded comment from bot *stale[bot]* by author *quanjielin*:
/cc @costinm @duderino