events.action: opened
events.author: mdgreenfield
events.text: **Describe the bug**
  When using SDS in the sidecar injected `istio-proxy` by configuring `.Values.global.sds.enabled` we receive connection errors from `istio-proxy`/Envoy because we also have `controlPlaneSecurityEnabled: true`.
  
  This issue looks to be introduced in https://github.com/istio/istio/commit/0b3bd99657a9528e3d9e4a5c5cb1cccc77b6c890#diff-be47e44182a3c785141d47d28a66f2d7R192
  
  **Expected behavior**
  With SDS enabled and `controlPlaneSecurityEnabled: true` `istio-proxy` should be able to connect to the control plan.
  
  I believe that [this condition](https://github.com/istio/istio/commit/0b3bd99657a9528e3d9e4a5c5cb1cccc77b6c890#diff-be47e44182a3c785141d47d28a66f2d7R192) should be on `.Values.global.controlPlaneSecurityEnabled` and will need to be addressed in both the `istio` and `istio-remote` charts.
  
  **Steps to reproduce the bug**
  configure `.Values.global.sds.enabled` and `.Values.global.controlPlaneSecurityEnabled` to `true`.
  
  **Version**
  We're using the nightly istio version release-1.1-20190125-09-16
  
  **Installation**
  - Multi-cluster environment (using the `istio` chart in the primary cluster and and `istio-remote` in the secondary cluster)
  - SDS enabled
  - Control plane security enabled
  - Per-pod Citadel node agent
  
  **Environment**
  AWS
events.title: istio-proxy control plane connection issues when both SDS and control plane security are enabled
events.type: issue
events.action: created
events.author: mdgreenfield
events.text: /cc @wattli
events.type: comment
events.action: created
events.author: hercynium
events.text: This is still an issue in Istio 1.1.6, as I've just stumbled across it. Is there any timeline for a fix? Is the control plane really unsecured when controlPlaneSecurityEnabled=false?
events.type: comment
events.action: created
events.author: quanjielin
events.text: @hercynium there is pending fix PR https://github.com/istio/istio/pull/13593 
  /cc @wenchenglu
events.type: comment
events.action: created
events.author: hercynium
events.text: Willl this land in 1.2?
events.type: comment
events.action: created
events.author: christianwoehrle
events.text: Still an issue in istio 1.1.8.
  
  It can be reproduced with the example from https://istio.io/docs/tasks/security/auth-sds/
  
  When the line 
  ```
    controlPlaneSecurityEnabled: true
  ```
  is added to the values-istio-sds-auth.yaml file, the the example doesn`t work anymore.
  
  istio-proxy then waits for certs in /etc/certs/ that it never gets.
  
  ```
  2019-06-10T16:49:28.253269Z     info    Monitored certs: []string{"/etc/certs/cert-chain.pem", "/etc/certs/key.pem", "/etc/certs/root-cert.pem"}
  2019-06-10T16:49:28.253276Z     info    waiting 2m0s for /etc/certs/cert-chain.pem
  2019-06-10T16:49:29.254351Z     info    waiting for certificates
  2019-06-10T16:49:29.354492Z     info    waiting for certificates
  
  ...
  ```
events.type: comment
events.action: created
events.author: quanjielin
events.text: /cc @costinm @duderino
events.type: comment
events.action: closed
events.author: JimmyCYJ
events.type: issue
events.action: created
events.author: JimmyCYJ
events.text: This control plane SDS support will be shipped with release 1.3
events.type: comment
data_with_bots.bot: This issue has been automatically marked as stale because it has not had activity in the last 90 days. It will be closed in the next 30 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.
data_with_bots.meta: This message directly preceded comment from bot *stale[bot]* by author *quanjielin*:
data_with_bots.text: /cc @costinm @duderino
data_without_bots.meta: This message directly preceded comment from bot *stale[bot]* by author *quanjielin*:
data_without_bots.text: /cc @costinm @duderino