istio: Docker-desktop + SDS-auth values fails to start

Bug description

Just setting up Istio on Docker for Windows locally, fails, with

// etc
istio-system   0s          Warning   FailedMount                    pod/istio-ingressgateway-5c4f87768-csdbs       MountVolume.SetUp failed for volume "istio-token" : failed to fetch token: the server could not find the requested resource
istio-system   0s          Warning   FailedMount                    pod/istio-pilot-7576fc8fff-9sttl               MountVolume.SetUp failed for volume "istio-token" : failed to fetch token: the server could not find the requested resource
// etc

Expected behavior

Since https://istio.io/docs/setup/platform-setup/docker/ doesn’t mention any peculiarities and I was under the assumption that Citadel would generate these tokens automatically, it is a bug that istio-token is not generated. Here is one of the many configs that reference the token:

      - name: istio-token
        projected:
          sources:
          - serviceAccountToken:
              path: istio-token
              expirationSeconds: 43200
              audience: istio-c

in this case from Deployment istio-ingressgateway’s spec for istio-proxy.

Steps to reproduce the bug

Download istio-1.3.3 to Infrastructure/istio, then in a makefile:

# From https://istio.io/docs/setup/install/helm/#option-1-install-with-helm-via-helm-template

.PHONY: template
template:
	helm template ../../Infrastructure/istio/helm/istio-init \
		--name istio-init --namespace istio-system \
		> ./istio-init/k8s/base/template.yaml

	# if CNI is re-activated, remember to deploy it also
	helm template ../../Infrastructure/istio/helm/istio \
		--name istio --namespace istio-system \
		--set istio_cni.enabled=false \
		--set sidecarInjectorWebhook.enabled=true \
		--values ../../Infrastructure/istio/helm/istio/values-istio-sds-auth.yaml \
		--set pilot.traceSampling=100.0 \
		--set kiali.enabled=true \
		--set kiali.createDemoSecret=true \
		--set global.tracer.zipkin.address=jaeger-collector.monitoring:9411 \
		--set kiali.dashboard.jaegerURL=jaeger.afa.haf.se \
		> ./istio/k8s/base/template.yaml

# -- TEST aka Docker Desktop

.PHONY: deploy_init_test
deploy_init_test:
	kustomize build ./istio-init/k8s/test | kubectl apply -f -

.PHONY: deploy_istio_test
deploy_istio_test:
	kustomize build ./istio/k8s/test | kubectl apply -f -

deploy_test: template deploy_init_test deploy_istio_test

How was Istio installed?

Via the above;

1. Pull down v1.3.3
2. Template to new k8s cluster on docker for desktop with the above values
3. Run make deploy_test until all CRDs allow instantiations (i.e. until there are no errors reported during installation)
4. Look at kubectl get pods --all-namespaces or kubectl get all -n istio-system or kubectl get events -w --all-namespaces to see the “failed to fetch token: the server could not find the requested resource”

At this point, restarting Citadel or any other pod in the cluster doesn’t magically appear the istio-token secret, so the installation is stuck.

Environment where bug was observed (cloud vendor, OS, etc)

• OS: Windows with Docker for Desktop/Windows

TL;DR If you just follow the instruction at https://istio.io/docs/setup/install/helm/#option-1-install-with-helm-via-helm-template but you enable the SDS/auth (strict mTLS) values file, you get this problem.