Demo install issue on k8s bare metal cluster with calico and crio

How did you solve it?

Istio doesn’t care what Kubernetes network plugin you use, as long as all the pods can connect to each other (and the control plane) everything should work.

That error suggests your gateway couldn’t connect to the control plane to get its certificate.