How to enable Istio SDS on existing GKE cluster

Question

I have an existing GKE cluster with the Istio addon installed, e.g.:

gcloud beta container clusters create istio-demo \
    --addons=Istio --istio-config=auth=MTLS_PERMISSIVE \
    --cluster-version=[cluster-version] \
    --machine-type=n1-standard-2 \
    --num-nodes=4

I am following this guide to install cert-manager in order to automatically provision TLS certificates from Let's Encrypt. According to the guide, Istio needs SDS enabled which can be done at the point of installation:

helm install istio.io/istio \
       --name istio \
       --namespace istio-system \
       --set gateways.istio-ingressgateway.sds.enabled=true

As I already have Istio installed via GKE, how can I enable SDS on the existing cluster? Alternatively, is it possible to use the gcloud CLI to enable SDS at the point of cluster creation?

Answer 1

Per Carlos' answer, I decided not to use the Istio on GKE addon as there is very limited customization available when using Istio as a managed service.

I created a standard GKE cluster...

gcloud beta container clusters create istio-demo \
    --cluster-version=[cluster-version] \
    --machine-type=n1-standard-2 \
    --num-nodes=4

And then manually installed Istio...

1. Create the namespace:

kubectl create namespace istio-system

2. Install the Istio CRDs:

helm template install/kubernetes/helm/istio-init --name istio-init --namespace istio-system | kubectl apply -f -

3. Install Istio using the default configuration profile with my necessary customizations:

helm template install/kubernetes/helm/istio --name istio --namespace istio-system \
    --set gateways.enabled=true \
    --set gateways.istio-ingressgateway.enabled=true \
    --set gateways.istio-ingressgateway.sds.enabled=true \
    --set gateways.istio-ingressgateway.externalTrafficPolicy="Local" \
    --set global.proxy.accessLogFile="/dev/stdout" \
    --set global.proxy.accessLogEncoding="TEXT" \
    --set grafana.enabled=true \
    --set kiali.enabled=true \
    --set prometheus.enabled=true \
    --set tracing.enabled=true \
  | kubectl apply -f -

4. Enable Istio sidecar injection on default namespace

kubectl label namespace default istio-injection=enabled