opened
mdgreenfield
username_0
**Describe the bug**
When using SDS in the sidecar injected `istio-proxy` by configuring `.Values.global.sds.enabled` we receive connection errors from `istio-proxy`/Envoy because we also have `controlPlaneSecurityEnabled: true`.

This issue looks to be introduced in https://github.com/istio/istio/commit/0b3bd99657a9528e3d9e4a5c5cb1cccc77b6c890#diff-be47e44182a3c785141d47d28a66f2d7R192

**Expected behavior**
With SDS enabled and `controlPlaneSecurityEnabled: true` `istio-proxy` should be able to connect to the control plan.

I believe that [this condition](https://github.com/istio/istio/commit/0b3bd99657a9528e3d9e4a5c5cb1cccc77b6c890#diff-be47e44182a3c785141d47d28a66f2d7R192) should be on `.Values.global.controlPlaneSecurityEnabled` and will need to be addressed in both the `istio` and `istio-remote` charts.

**Steps to reproduce the bug**
configure `.Values.global.sds.enabled` and `.Values.global.controlPlaneSecurityEnabled` to `true`.

**Version**
We're using the nightly istio version release-1.1-20190125-09-16

**Installation**
- Multi-cluster environment (using the `istio` chart in the primary cluster and and `istio-remote` in the secondary cluster)
- SDS enabled
- Control plane security enabled
- Per-pod Citadel node agent

**Environment**
AWS
istio-proxy control plane connection issues when both SDS and control plane security are enabled
issue
created
mdgreenfield
username_0
/cc @wattli
comment
created
hercynium
username_1
This is still an issue in Istio 1.1.6, as I've just stumbled across it. Is there any timeline for a fix? Is the control plane really unsecured when controlPlaneSecurityEnabled=false?
comment
created
quanjielin
username_2
@username_1 there is pending fix PR https://github.com/istio/istio/pull/13593 
/cc @wenchenglu
comment
created
hercynium
username_1
Willl this land in 1.2?
comment
created
christianwoehrle
username_3
Still an issue in istio 1.1.8.

It can be reproduced with the example from https://istio.io/docs/tasks/security/auth-sds/

When the line 
```
  controlPlaneSecurityEnabled: true
```
is added to the values-istio-sds-auth.yaml file, the the example doesn`t work anymore.

istio-proxy then waits for certs in /etc/certs/ that it never gets.

```
2019-06-10T16:49:28.253269Z     info    Monitored certs: []string{"/etc/certs/cert-chain.pem", "/etc/certs/key.pem", "/etc/certs/root-cert.pem"}
2019-06-10T16:49:28.253276Z     info    waiting 2m0s for /etc/certs/cert-chain.pem
2019-06-10T16:49:29.254351Z     info    waiting for certificates
2019-06-10T16:49:29.354492Z     info    waiting for certificates

...
```
comment
created
quanjielin
username_2
/cc @costinm @duderino
comment
closed
JimmyCYJ
username_4
issue
created
JimmyCYJ
username_4
This control plane SDS support will be shipped with release 1.3
comment