Testing VM feature in 1.8 getting error with istioctl x worload

Hi all, Im relatively new to Istio, trying to test VM feature but getting following error.
From message it appears that for some reason it is not able to create a token. I have service account in the namespace created so not sure what the problem could be. Im sure, missing something obvious, appreciate any help.

istioctl x workload entry configure -f workloadgroup.yaml -o “${WORK_DIR}”
Error: could not create a token under service account test-vm-svcact in namespace test-vmns: the server could not find the requested resource

Just a heads up, I’m seeing the same thing. Trying to enable some kind of debugging output as well. If I try to configure the entry by file artifact or by an existing workload group that exists, I get the same error.

Looks like because TokenRequest API is not turned on in k8s cluster. Istio document does not mention that as a requirement.