Bug Description

After upgrading Istio from v1.13.8 to 1.14.3, destinationrule used to originate TLS connection to the upstream endpoint stops working.

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: nginx-dst-rule
spec:
  exportTo:
  - "istio-system"
  host: nginx.apps.svc.cluster.local
  trafficPolicy:
    tls:
      mode: SIMPLE

istioctl bug-report produced below error log says it needs caCertificates but that field is optional as mentioned in istio document https://istio.io/v1.14/docs/reference/config/networking/destination-rule/#ClientTLSSettings

Running istio analyze on all namespaces and report as below:
Analysis Report:
Error [IST0128] (DestinationRule apps/nginx-dst-rule) DestinationRule apps/nginx-dst-rule in namespace apps has TLS mode set to SIMPLE but no caCertificates are set to validate server identity for host: nginx.apps.svc.cluster.local

Version

$ istioctl version
client version: 1.14.3
control plane version: 1.14.3
data plane version: 1.14.3 (2 proxies)
$ kubectl version --short
Client Version: v1.22.11
Server Version: v1.22.11

Additional Information

Below is the full bug report
bug-report.tar.gz

To reproduce the issue please follow the guideline here https://github.com/nathluu/istio-upgrade-test.
It will work with istio v1.13.8 but not for v1.14 onward.