Managed Istio per design will revert any custom configuration and will disable SDS again. So, IMHO, it is a non-useful scenario. You can enable SDS manually following this guide, but keep in mind that the configuration will remain active only for 2-3 minutes.

Currently GKE doesn't support enabling SDS when creating a cluster from scratch. On GKE managed Istio, Google is looking to have the ability to enable SDS on GKE clusters, but they don't have an ETA yet for that release.

However, if you use non-managed (open source) Istio, SDS feature is in the Istio roadmap, and I think it should be available in version 1.2, but it is not a guarantee.

Even though currently the default ingress gateway created by Istio on GKE doesn't support SDS, you can add your own extra ingress gateway manually.

You can get the manifest of the default istio-ingressgateway deployment and service in your istio-system namespace and modify it to add the SDS container and change the name and then apply it to your cluster. But it's a little too tedious, there's a simpler way to do that:

First download the open-source helm chart of istio (choose a version that works with your Istio on GKE version, in my case my Istio on GKE is 1.1.3 and I downloaded open-source istio 1.1.17 and it works):

curl -O https://storage.googleapis.com/istio-release/releases/1.1.17/charts/istio-1.1.17.tgz
# extract under current working directory
tar xzvf istio-1.1.17.tgz

Then render the helm template for only the ingressgateway component:

helm template istio/ --name istio \
--namespace istio-system \
-x charts/gateways/templates/deployment.yaml \
-x charts/gateways/templates/service.yaml \
--set gateways.istio-egressgateway.enabled=false \
--set gateways.istio-ingressgateway.sds.enabled=true > istio-ingressgateway.yaml

Then manually modify the rendered istio-ingressgateway.yaml file with following modifications:

1. Change the metadata.name for both the deployment and service to something else like istio-ingressgateway-sds
2. Change the metadata.lables.istio for both the deployment and service to something else like ingressgateway-sds
3. Change the spec.template.metadata.labels for the deployment similarly to ingressgateway-sds
4. Change the spec.selector.istio for the service to same value like ingressgateway-sds

Then apply the yaml file to your GKE cluster:

kubectl apply -f istio-ingressgateway.yaml

Holla! You have your own istio ingressgatway with SDS created now and you can get the load balancer IP of it by:

kubectl -n istio-system get svc istio-ingressgateway-sds

To let your Gateway to use the correct sds enabled ingressgateway you need to set spec.selector.istio to match the one you set. Below is an example of a Gateway resource using a kubernetes secret as TLS cert:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: gateway-test
spec:
  selector:
    istio: ingressgateway-sds
  servers:
  - hosts:
    - '*.example.com'
    port:
      name: http
      number: 80
      protocol: HTTP
    tls:
      httpsRedirect: true
  - hosts:
    - '*.example.com'
    port:
      name: https
      number: 443
      protocol: HTTPS
    tls:
      credentialName: example-com-cert
      mode: SIMPLE
      privateKey: sds
      serverCertificate: sds