The release notes for 1.5.x (https://istio.io/latest/news/releases/1.5.x/announcing-1.5/upgrade-notes/) suggest that citadel, nodeagent etc are now not required, as this is handled by istiod. I’ve recently had certificate expiry issues, which I suspect could be due to still running nodeagent (a hangover from upgrading from an older version) - but the troubleshooting at https://istio.io/latest/docs/ops/common-problems/security-issues/#keys-and-certificates-errors states unequivocally that a healthy citadel is required.
So, is citadel in fact required or not?