Istio ingress gateway failed to start

Hi,

I am installing istio into EKS (Version 1.25) using istioctl.
Istio ingress gateway is not able to generate certificate to workloads.

Istioctl version: 1.17.2

Following is the command used to install istio

istioctl install --set profile=default --set values.gateways.istio-ingressgateway.type=NodePort --set meshConfig.outboundTrafficPolicy.mode=ALLOW_ANY --set meshConfig.accessLogFile=/dev/stdout -y

The result is as follows:

NAME                                        READY   STATUS    RESTARTS   AGE
pod/istio-ingressgateway-6974766b9c-hsvwx   0/1     Running   0          24s
pod/istiod-5987b4bb4f-q8jmg                 1/1     Running   0          31s

NAME                           TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                                      AGE
service/istio-ingressgateway   NodePort    10.100.74.167    <none>        15021:31023/TCP,80:30393/TCP,443:30612/TCP   23s
service/istiod                 ClusterIP   10.100.174.121   <none>        15010/TCP,15012/TCP,443/TCP,15014/TCP        31s

While debugging into pod/istio-ingressgateway-6974766b9c-hsvwx i found following logs

k logs pod/istio-ingressgateway-6974766b9c-hsvwx -n istio-system                                                                ─╯
2023-04-13T00:55:55.756197Z	info	FLAG: --concurrency="0"
2023-04-13T00:55:55.756227Z	info	FLAG: --domain="istio-system.svc.cluster.local"
2023-04-13T00:55:55.756235Z	info	FLAG: --help="false"
2023-04-13T00:55:55.756242Z	info	FLAG: --log_as_json="false"
2023-04-13T00:55:55.756247Z	info	FLAG: --log_caller=""
2023-04-13T00:55:55.756251Z	info	FLAG: --log_output_level="default:info"
2023-04-13T00:55:55.756255Z	info	FLAG: --log_rotate=""
2023-04-13T00:55:55.756260Z	info	FLAG: --log_rotate_max_age="30"
2023-04-13T00:55:55.756264Z	info	FLAG: --log_rotate_max_backups="1000"
2023-04-13T00:55:55.756269Z	info	FLAG: --log_rotate_max_size="104857600"
2023-04-13T00:55:55.756273Z	info	FLAG: --log_stacktrace_level="default:none"
2023-04-13T00:55:55.756283Z	info	FLAG: --log_target="[stdout]"
2023-04-13T00:55:55.756288Z	info	FLAG: --meshConfig="./etc/istio/config/mesh"
2023-04-13T00:55:55.756292Z	info	FLAG: --outlierLogPath=""
2023-04-13T00:55:55.756296Z	info	FLAG: --proxyComponentLogLevel="misc:error"
2023-04-13T00:55:55.756301Z	info	FLAG: --proxyLogLevel="warning"
2023-04-13T00:55:55.756306Z	info	FLAG: --serviceCluster="istio-proxy"
2023-04-13T00:55:55.756310Z	info	FLAG: --stsPort="0"
2023-04-13T00:55:55.756314Z	info	FLAG: --templateFile=""
2023-04-13T00:55:55.756319Z	info	FLAG: --tokenManagerPlugin="GoogleTokenExchange"
2023-04-13T00:55:55.756329Z	info	FLAG: --vklog="0"
2023-04-13T00:55:55.756339Z	info	Version 1.17.2-3e857775086a061d12ee445f32a0b35ea17c8488-Clean
2023-04-13T00:55:55.758269Z	info	Maximum file descriptors (ulimit -n): 1048576
2023-04-13T00:55:55.758420Z	info	Proxy role	ips=[172.10.2.107] type=router id=istio-ingressgateway-6974766b9c-hsvwx.istio-system domain=istio-system.svc.cluster.local
2023-04-13T00:55:55.758492Z	info	Apply mesh config from file accessLogFile: /dev/stdout
defaultConfig:
  discoveryAddress: istiod.istio-system.svc:15012
  proxyMetadata: {}
  tracing:
    zipkin:
      address: zipkin.istio-system:9411
enablePrometheusMerge: true
outboundTrafficPolicy:
  mode: ALLOW_ANY
rootNamespace: istio-system
trustDomain: cluster.local
2023-04-13T00:55:55.760713Z	info	Effective config: binaryPath: /usr/local/bin/envoy
configPath: ./etc/istio/proxy
controlPlaneAuthPolicy: MUTUAL_TLS
discoveryAddress: istiod.istio-system.svc:15012
drainDuration: 45s
proxyAdminPort: 15000
serviceCluster: istio-proxy
statNameLength: 189
statusPort: 15020
terminationDrainDuration: 5s
tracing:
  zipkin:
    address: zipkin.istio-system:9411

2023-04-13T00:55:55.760726Z	info	JWT policy is third-party-jwt
2023-04-13T00:55:55.760731Z	info	using credential fetcher of JWT type in cluster.local trust domain
2023-04-13T00:55:55.762825Z	info	Opening status port 15020
2023-04-13T00:55:55.763109Z	info	Workload SDS socket not found. Starting Istio SDS Server
2023-04-13T00:55:55.763143Z	info	CA Endpoint istiod.istio-system.svc:15012, provider Citadel
2023-04-13T00:55:55.763164Z	info	Using CA istiod.istio-system.svc:15012 cert with certs: var/run/secrets/istio/root-cert.pem
2023-04-13T00:55:55.780133Z	info	ads	All caches have been synced up in 27.014779ms, marking server ready
2023-04-13T00:55:55.780420Z	info	xdsproxy	Initializing with upstream address "istiod.istio-system.svc:15012" and cluster "Kubernetes"
2023-04-13T00:55:55.782139Z	info	Pilot SAN: [istiod.istio-system.svc]
2023-04-13T00:55:55.783423Z	info	Starting proxy agent
2023-04-13T00:55:55.783462Z	info	starting
2023-04-13T00:55:55.783497Z	info	Envoy command: [-c etc/istio/proxy/envoy-rev.json --drain-time-s 45 --drain-strategy immediate --local-address-ip-version v4 --file-flush-interval-msec 1000 --disable-hot-restart --allow-unknown-static-fields --log-format %Y-%m-%dT%T.%fZ	%l	envoy %n %g:%#	%v	thread=%t -l warning --component-log-level misc:error]
2023-04-13T00:55:55.783974Z	info	sds	Starting SDS grpc server
2023-04-13T00:55:55.784154Z	info	starting Http service at 127.0.0.1:15004
2023-04-13T00:56:15.764686Z	warn	ca	ca request failed, starting attempt 1 in 104.527715ms
2023-04-13T00:56:15.870171Z	warn	ca	ca request failed, starting attempt 2 in 200.732771ms
2023-04-13T00:56:16.071800Z	warn	ca	ca request failed, starting attempt 3 in 394.005637ms
2023-04-13T00:56:16.466527Z	warn	ca	ca request failed, starting attempt 4 in 856.880464ms

I can verify that istioctl version 1.13.3 was working good in EKS (version 1.21)

Can you please help me.

Thanks,