Kops

If you wish to run Istio Secret Discovery Service⁴ (SDS) for your mesh on Kops managed clusters, you must add extra configurations to enable service account token projection volumes in the api-server.

1. Open the configuration file:

   $ kops edit cluster $YOURCLUSTER
   

2. Add the following in the configuration file:

   kubeAPIServer:
       apiAudiences:
       - api
       - istio-ca
       serviceAccountIssuer: kubernetes.default.svc

3. Perform the update:

   $ kops update cluster
   $ kops update cluster --yes
   

4. Launch the rolling update:

   $ kops rolling-update cluster
   $ kops rolling-update cluster --yes