The release notes for 1.5.x (https://istio.io/latest/news/releases/1.5.x/announcing-1.5/upgrade-notes/) suggest that
nodeagent etc are now not required, as this is handled by
istiod. I’ve recently had certificate expiry issues, which I suspect could be due to still running
nodeagent (a hangover from upgrading from an older version) - but the troubleshooting at https://istio.io/latest/docs/ops/common-problems/security-issues/#keys-and-certificates-errors states unequivocally that a healthy
citadel is required.
citadel in fact required or not?