diff -Naur istio/pilot/pkg/model/credentials/ali_resource.go new/pilot/pkg/model/credentials/ali_resource.go
--- istio/pilot/pkg/model/credentials/ali_resource.go	2022-11-07 21:40:10.000000000 +0800
+++ new/pilot/pkg/model/credentials/ali_resource.go	2022-11-07 19:03:22.000000000 +0800
@@ -4,6 +4,7 @@
 	"fmt"
 	"strings"
 
+	"istio.io/istio/pilot/pkg/features"
 	"istio.io/istio/pkg/cluster"
 )
 
@@ -13,6 +14,9 @@
 )
 
 func ToKubernetesIngressResource(clusterId, namespace, name string) string {
+	if clusterId == "" {
+		clusterId = features.ClusterName
+	}
 	return fmt.Sprintf("%s://%s/%s/%s", KubernetesIngressSecretType, clusterId, namespace, name)
 }
 
diff -Naur istio/pilot/pkg/xds/sds.go new/pilot/pkg/xds/sds.go
--- istio/pilot/pkg/xds/sds.go	2022-11-07 21:40:10.000000000 +0800
+++ new/pilot/pkg/xds/sds.go	2022-11-07 21:44:28.000000000 +0800
@@ -229,6 +229,12 @@
 			} else {
 				deniedResources = append(deniedResources, r.Name)
 			}
+		case credentials.KubernetesIngressSecretType:
+			if isAuthorized() {
+				allowedResources = append(allowedResources, r)
+			} else {
+				deniedResources = append(deniedResources, r.Name)
+			}
 		default:
 			// Should never happen
 			log.Warnf("unknown credential type %q", r.Type)
