Yes, I’ve got it to work. Let’s get my notes 
I found some (parts of) examples in different places, and combined them to make it work.
I created a ServiceMonitor for the Istio components, and a PodMonitor for my application pods that I want to monitor and see in Kiali. The monitors are in the monitoring namespace. Furthermore I created a ClusterRole to have the necessary access to other namespaces.
I will add the yaml files below. Note that the ServiceMonitor matchExpression can be simpler, because 1.7 just has one pod. I think you can just match on pilot.
The PodMonitor just select the default namespace. These are things that should be easy to change, but I didn’t get around to it yet. I don’t know what the relabelings are for and if they are needed. I you find out please let me know.
apiVersion: monitoring.coreos.com/v1
kind: PodMonitor
metadata:
name: istio-proxy-monitor
namespace: monitoring
labels:
istio: proxy
spec:
jobLabel: component
selector:
matchLabels:
security.istio.io/tlsMode: "istio"
matchExpressions:
- key: migration
operator: NotIn
values: [ "true", "1" ]
namespaceSelector:
matchNames:
- default
podMetricsEndpoints:
- port: http-envoy-prom
path: /stats/prometheus
relabelings:
- action: labeldrop
regex: __meta_kubernetes_pod_label_skaffold_dev.*
- action: labeldrop
regex: __meta_kubernetes_pod_label_pod_template_hash.*
- action: labelmap
regex: __meta_kubernetes_pod_label_(.+)
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: istio-component-monitor
namespace: monitoring
labels:
k8s-app: istio-components
monitoring: istio-components
spec:
jobLabel: istio
selector:
matchExpressions:
- {key: istio, operator: In, values: [mixer,pilot,galley,citadel,sidecar-injector]}
namespaceSelector:
matchNames:
- istio-system
endpoints:
- port: http-monitoring
interval: 15s
- port: http-policy-monitoring
interval: 15s
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: prometheus-k8s
rules:
- apiGroups: [""]
resources:
- nodes
- nodes/metrics
- services
- endpoints
- pods
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources:
- configmaps
verbs: ["get"]
- apiGroups:
- networking.k8s.io
resources:
- ingresses
verbs: ["get", "list", "watch"]
- nonResourceURLs: ["/metrics"]
verbs: ["get"]
