Istiod helm chart should support mounting the cacerts volume with the Kubernetes CSI Secrets store driver

[zioproto]

Describe the feature request

When using Istio in multicluster the CA certs must be provided because each cluster cannot have a self-signed autogenerated cert.

Currently /etc/cacerts can be mounted only from a Kubernetes secret.

istio/manifests/charts/istio-control/istio-discovery/templates/deployment.yaml

Lines 225 to 228 in 70c91d1

	- name: cacerts
	secret:
	secretName: cacerts
	optional: true

Istio users on public cloud do not store private keys in Kubernetes secrets as a best practice, but they use Kubernetes Secrets Store CSI Driver to mount the secrets from their public cloud secret store.

The helm chart template should support to use the Kubernetes Secrets Store CSI Driver passing the necessary information in the values.

Describe alternatives you've considered

Currently I am patching the the IstioOperator as follows to solve this problem:

---
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
 components:
   pilot:
     enabled: true
     k8s:
       overlays:
         - kind: Deployment
           name: istiod-1-20-1 # https://github.com/istio/istio/issues/31076
           patches:
             - path: spec.template.spec.volumes[name:cacerts]
               value:
                 name: cacerts
                 csi:
                   driver: secrets-store.csi.k8s.io
                   readOnly: true
                   volumeAttributes:
                     secretProviderClass: "istio-tls"

Affected product area (please put an X in all that apply)

[ ] Ambient
[ ] Docs
[ ] Dual Stack
[X] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Extensions and Telemetry
[X] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

Affected features (please put an X in all that apply)

[X] Multi Cluster
[ ] Virtual Machine
[ ] Multi Control Plane

[istio-policy-bot]

🧭 This issue or pull request has been automatically marked as stale because it has not had activity from an Istio team member since 2024-03-21. It will be closed on 2024-10-02 unless an Istio team member takes action. Please see this wiki page for more information. Thank you for your contributions.

Created by the issue and PR lifecycle manager.