<p>I am deploying to version 1.16 but the pods are getting crashed below are the pod's error.</p>
<p>istiod pod:</p>
<p>2023-03-21T11:58:09.768255Z info kube controller &quot;extensions.istio.io/v1alpha1/WasmPlugin&quot; is syncing... controller=crd-controller
2023-03-21T11:58:09.868998Z info kube controller &quot;extensions.istio.io/v1alpha1/WasmPlugin&quot; is syncing... controller=crd-controller
2023-03-21T11:58:09.887383Z info klog k8s.io/client-go@v0.25.2/tools/cache/reflector.go:169: failed to list *v1alpha1.WasmPlugin: wasmplugins.extensions.istio.io is forbidden: User &quot;system:serviceaccount:istio-system:istiod-service-account&quot; cannot list resource &quot;wasmplugins&quot; in API group &quot;extensions.istio.io&quot; at the cluster scope
2023-03-21T11:58:09.887472Z error watch error in cluster Kubernetes: failed to list *v1alpha1.WasmPlugin: wasmplugins.extensions.istio.io is forbidden: User &quot;system:serviceaccount:istio-system:istiod-service-account&quot; cannot list resource &quot;wasmplugins&quot; in API group &quot;extensions.istio.io&quot; at the cluster scope</p>
<p>external-dns:
time=&quot;2023-03-21T12:17:22Z&quot; level=fatal msg=&quot;failed to sync cache: timed out waiting for the condition&quot;</p>
<p>Version
istioctl version:</p>
<p>client version: 1.17.1
control plane version: 1.16.2
data plane version: none</p>
<p>kubectl version --short:</p>
<p>Client Version: v1.24.10
Kustomize Version: v4.5.4
Server Version: v1.24.10-eks-48e63af</p>

<p>The error is speaking; the Service Account istiod-service-account has no privileges on the CRDs extensions.istio.io/v1alpha1/WasmPlugin.</p>
<p>The solution to your problem is documented here:
<a href="https://github.com/istio/istio/issues/36886#issue-1107794465" rel="nofollow noreferrer">https://github.com/istio/istio/issues/36886#issue-1107794465</a></p>
