<p>I have set up a local kubernetes cluster using <a href="https://kind.sigs.k8s.io" rel="nofollow noreferrer">kind</a> on WSL2 (Ubuntu distro). I managed to create a cluster successfully. Then I try to install istio using helm following the <a href="https://istio.io/latest/docs/setup/install/helm/" rel="nofollow noreferrer">documentation</a>.</p>
<p>Everything looks fine till I check the status of istio pods using <code>kubectl get pods -n istio-system</code> for which I get the response</p>
<pre><code>istio-egressgateway-645df98b64-tml4k    0/1     ContainerCreating   0          39m
istio-ingressgateway-6c7f679666-lxj8r   0/1     ContainerCreating   0          39m
istiod-657558ff59-fhpgl                 0/1     ContainerCreating   0          39m
</code></pre>
<p>The pods continue to stay in <code>ContainerCreating</code> status. So, I checked the pod using <code>kubectl describe pod -n istio-system istio-egressgateway-645df98b64-tml4k</code> and I see the following events with warnings:</p>
<pre><code>Events:
  Type     Reason       Age                   From               Message
  ----     ------       ----                  ----               -------
  Normal   Scheduled    27m                   default-scheduler  Successfully assigned istio-system/istio-egressgateway-645df98b64-tml4k to msg-local-worker2
  Warning  FailedMount  25m                   kubelet            Unable to attach or mount volumes: unmounted volumes=[istio-token istiod-ca-cert], unattached volumes=[istio-token podinfo istio-envoy istio-data egressgateway-ca-certs config-volume egressgateway-certs istio-egressgateway-service-account-token-2k6nv istiod-ca-cert]: timed out waiting for the condition
  Warning  FailedMount  22m                   kubelet            Unable to attach or mount volumes: unmounted volumes=[istio-token istiod-ca-cert], unattached volumes=[istio-token istio-envoy istiod-ca-cert config-volume istio-data podinfo egressgateway-certs egressgateway-ca-certs istio-egressgateway-service-account-token-2k6nv]: timed out waiting for the condition
  Warning  FailedMount  20m (x11 over 27m)    kubelet            MountVolume.SetUp failed for volume &quot;istio-token&quot; : failed to fetch token: the API server does not have TokenRequest endpoints enabled
  Warning  FailedMount  20m                   kubelet            Unable to attach or mount volumes: unmounted volumes=[istiod-ca-cert istio-token], unattached volumes=[istio-envoy podinfo istiod-ca-cert istio-egressgateway-service-account-token-2k6nv istio-token config-volume egressgateway-certs istio-data egressgateway-ca-certs]: timed out waiting for the condition
  Warning  FailedMount  11m                   kubelet            Unable to attach or mount volumes: unmounted volumes=[istiod-ca-cert istio-token], unattached volumes=[podinfo istio-egressgateway-service-account-token-2k6nv istio-envoy config-volume istio-data istiod-ca-cert egressgateway-certs egressgateway-ca-certs istio-token]: timed out waiting for the condition
  Warning  FailedMount  7m2s (x3 over 9m16s)  kubelet            (combined from similar events): Unable to attach or mount volumes: unmounted volumes=[istio-token istiod-ca-cert], unattached volumes=[egressgateway-certs istio-envoy istio-token egressgateway-ca-certs istio-egressgateway-service-account-token-2k6nv istio-data istiod-ca-cert config-volume podinfo]: timed out waiting for the condition
  Warning  FailedMount  38s (x18 over 27m)    kubelet            MountVolume.SetUp failed for volume &quot;istiod-ca-cert&quot; : configmap &quot;istio-ca-root-cert&quot; not found
</code></pre>

<p>Managed to figure out the problem thanks to this <a href="https://github.com/kubeflow/manifests/issues/959" rel="nofollow noreferrer">GitHub issue</a>. I needed to enable <a href="https://github.com/kubeflow/manifests/issues/959" rel="nofollow noreferrer">service account token volume projection</a>.</p>
<p>The exact solution is found <a href="https://github.com/linkerd/linkerd2/issues/3260" rel="nofollow noreferrer">here</a>. I changed my cluster configuration (kind-config.yaml) to</p>
<pre><code>kind: Cluster
apiVersion: kind.sigs.k8s.io/v1alpha4
kubeadmConfigPatches:
  - |
    apiVersion: kubeadm.k8s.io/v1beta2
    kind: ClusterConfiguration
    metadata:
      name: config
    apiServer:
      extraArgs:
        &quot;service-account-issuer&quot;: &quot;kubernetes.default.svc&quot;
        &quot;service-account-signing-key-file&quot;: &quot;/etc/kubernetes/pki/sa.key&quot;
nodes:
  - role: control-plane
  - role: worker
  - role: worker
</code></pre>
<p>Then started the cluster using <code>kind create cluster --name my-cluster --config ./kind-config.yaml</code>. I installed istio normally on this cluster and the pods are running now.</p>
