istio 1.13.3 + cert-namager v1.8.0 solving http01 chalange

I installed Istio 1.13.3 and cert-manager v1.8.0 on a 1.22 cluster using helmfile:

repositories:
  - name: jetstack
    url: https://charts.jetstack.io
  - name: istio
    url: https://istio-release.storage.googleapis.com/charts

releases:
  - name: cert-manager
    chart: jetstack/cert-manager
    version: v1.8.0  
    namespace: cert-manager
    createNamespace: true
    values:
      - installCRDs: true

  - name: istio-base
    chart: istio/base
    version: 1.13.3
    namespace: istio-system
    createNamespace: true

  - name: istiod
    chart: istio/istiod
    version: 1.13.3  
    namespace: istio-system
    createNamespace: true
    values:
      - meshConfig:
          accessLogFile: /dev/stdout

  - name: istio-ingress
    chart: istio/gateway
    version: 1.13.3  
    namespace: istio-ingress
    createNamespace: true
    needs:
      - istio-system/istio-base
      - istio-system/istiod

Then I create http01 solver ClusterIssuer and Certificate resources as usually:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    email: my@email.com
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt
    solvers:
      - http01:
          ingress:
            class: istio
        selector: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: letsencrypt
  namespace: istio-system
spec:
  secretName: letsencrypt
  issuerRef:
    name: letsencrypt
    kind: ClusterIssuer
  dnsNames:
    - "my-domain.com"

The question is: is Istio controler going to create VirtualService and Gateway resourcer for cm-acme-http-solver to reach /.well-known/acme-challenge/ endpoint?

Seems like these resources are not created and a certifite can't validate.

How can I debug it further?

In istiod logs I see that cm-acme-http-solver-kbhmp-virtualservice is trying to create:

2022-05-20T17:20:47.833133Z info    ads XDS: Pushing:2022-05-20T17:20:47Z/7 Services:6 ConnectedEndpoints:1  Version:2022-05-20T17:20:47Z/7
2022-05-20T17:20:47.833350Z info    ads CDS: PUSH for node:istio-ingress-5bd77ffbdf-2hhrb.istio-ingress resources:13 size:11.4kB cached:12/12
2022-05-20T17:20:47.833403Z info    ads EDS: PUSH for node:istio-ingress-5bd77ffbdf-2hhrb.istio-ingress resources:13 size:2.0kB empty:1 cached:12/13
2022-05-20T17:20:47.833420Z info    ads LDS: PUSH for node:istio-ingress-5bd77ffbdf-2hhrb.istio-ingress resources:0 size:0B
2022-05-20T17:20:47.835845Z info    ads EDS: PUSH request for node:istio-ingress-5bd77ffbdf-2hhrb.istio-ingress resources:12 size:1.9kB empty:0 cached:12/12
2022-05-20T17:20:48.040177Z info    ads Push debounce stable[11] 2 for config VirtualService/istio-system/cm-acme-http-solver-kbhmp-virtualservice and 1 more configs: 100.60774ms since last change, 100.617576ms since last push, full=true
2022-05-20T17:20:48.040299Z info    ads XDS: Pushing:2022-05-20T17:20:48Z/8 Services:6 ConnectedEndpoints:1  Version:2022-05-20T17:20:48Z/8
2022-05-20T17:20:48.040493Z info    ads CDS: PUSH for node:istio-ingress-5bd77ffbdf-2hhrb.istio-ingress resources:13 size:11.4kB cached:12/12
2022-05-20T17:20:48.040518Z info    ads LDS: PUSH for node:istio-ingress-5bd77ffbdf-2hhrb.istio-ingress resources:0 size:0B
2022-05-20T17:20:56.344078Z info    ads Push debounce stable[12] 1 for config Secret/istio-system/letsencrypt-qrn4z: 100.990668ms since last change, 100.990531ms since last push, full=false
2022-05-20T17:20:56.344129Z info    ads XDS: Incremental Pushing:2022-05-20T17:20:48Z/8 ConnectedEndpoints:1 Version:2022-05-20T17:20:48Z/8
2022-05-20T17:20:58.442836Z info    ads Incremental push, service cm-acme-http-solver-t7s99.istio-system.svc.cluster.local has no endpoints
2022-05-20T17:20:58.628601Z info    ads Push debounce stable[13] 7 for config ServiceEntry/istio-system/cm-acme-http-solver-t7s99.istio-system.svc.cluster.local and 4 more configs: 100.650142ms since last change, 196.205035ms since last push, full=true
2022-05-20T17:20:58.628927Z info    ads XDS: Pushing:2022-05-20T17:20:58Z/9 Services:7 ConnectedEndpoints:1  Version:2022-05-20T17:20:58Z/9
2022-05-20T17:20:58.629242Z info    ads CDS: PUSH for node:istio-ingress-5bd77ffbdf-2hhrb.istio-ingress resources:14 size:12.3kB cached:12/13
2022-05-20T17:20:58.629312Z info    ads EDS: PUSH for node:istio-ingress-5bd77ffbdf-2hhrb.istio-ingress resources:12 size:1.9kB empty:0 cached:12/12
2022-05-20T17:20:58.629329Z info    ads LDS: PUSH for node:istio-ingress-5bd77ffbdf-2hhrb.istio-ingress resources:0 size:0B
2022-05-20T17:20:58.632730Z info    ads EDS: PUSH request for node:istio-ingress-5bd77ffbdf-2hhrb.istio-ingress resources:13 size:2.0kB empty:1 cached:12/13
2022-05-20T17:21:00.854296Z info    ads Full push, new service istio-system/cm-acme-http-solver-t7s99.istio-system.svc.cluster.local
2022-05-20T17:21:00.854316Z info    ads Full push, service accounts changed, cm-acme-http-solver-t7s99.istio-system.svc.cluster.local
2022-05-20T17:21:00.954523Z info    ads Push debounce stable[14] 1 for config ServiceEntry/istio-system/cm-acme-http-solver-t7s99.istio-system.svc.cluster.local: 100.183227ms since last change, 100.183104ms since last push, full=true
2022-05-20T17:21:00.954735Z info    ads XDS: Pushing:2022-05-20T17:21:00Z/10 Services:7 ConnectedEndpoints:1  Version:2022-05-20T17:21:00Z/10
2022-05-20T17:21:00.955017Z info    ads CDS: PUSH for node:istio-ingress-5bd77ffbdf-2hhrb.istio-ingress resources:14 size:12.4kB cached:12/13
2022-05-20T17:21:00.955108Z info    ads EDS: PUSH for node:istio-ingress-5bd77ffbdf-2hhrb.istio-ingress resources:13 size:2.2kB empty:0 cached:12/13
2022-05-20T17:21:00.955130Z info    ads LDS: PUSH for node:istio-ingress-5bd77ffbdf-2hhrb.istio-ingress resources:0 size:0B

Appreciate any help in addressing that issue. Thanks!