public ca.crt aka caBundle is not being updated/propagated until the cert-manager and istiod components are restarted

[smarunich]

When ca.crt value is updated - it's not being propagated through the cert-manager and istiod sidecars are hitting the well-known issue below: https://istio.io/latest/docs/ops/common-problems/injection/#x509-certificate-related-errors

with the following error message:

Error creating: Internal error occurred: failed calling webhook "sidecar-injector.istio.io": Post "https://istiod.istio-system.svc:443/inject?timeout=30s": x509: certificate signed by unknown authority

Restarting istiod does not address the issue, the cert-manager stack has to be restarted as well in order to address ca.crt propagation.

istiod version: 1.8.6
cert-manager: 1.3.1
cert-manager-istio-csr: 0.3.0