Steps to repro:

1. Create a cluster without auth per quick start: https://istio.io/docs/setup/kubernetes/quick-start/
2. Now change to auth by applying the auth manifest.

Expected behavior:
MeshPolicy and DestinationRules CRs should be updated from permissive to strict.

Actual behavior:
CRs are not updated.

This creates a problem for Istio on GKE, in that the Istio cluster auth config doesn't work for gcloud cluster update.