Issue title: TestNamespaceTargeting is failing in istio/installer:release-1.3 integration tests
 Issue body: The `TestNamespaceTargeting` test is failing in istio/installer:release-1.3's `ci/circleci: integration-presubmit-isolated-namespaces-kind` and `ci/circleci: integration-presubmit-one-namespace-kind`.

See for example https://github.com/istio/installer/pull/365 and https://github.com/istio/installer/pull/356.

cc @istio/release-managers-1-3 

```
=== RUN   TestNamespaceTargeting
2019-08-30T00:45:07.506961Z	info	CI	=== BEGIN: Test: 'citadel_test[TestNamespaceTargeting]' ===
=== RUN   TestNamespaceTargeting/no_env_label,_false_override_label
2019-08-30T00:45:07.507081Z	info	CI	=== BEGIN: Test: 'citadel_test[TestNamespaceTargeting/no_env_label,_false_override_label]' ===
2019-08-30T00:45:13.042058Z	info	CI	=== DONE:  Test: 'citadel_test[TestNamespaceTargeting/no_env_label,_false_override_label] (5.534969001s)' ===
=== RUN   TestNamespaceTargeting/matching_env_label,_no_override_label
2019-08-30T00:45:13.042375Z	info	CI	=== BEGIN: Test: 'citadel_test[TestNamespaceTargeting/matching_env_label,_no_override_label]' ===
2019-08-30T00:45:14.527662Z	info	CI	=== DONE:  Test: 'citadel_test[TestNamespaceTargeting/matching_env_label,_no_override_label] (1.485278488s)' ===
=== RUN   TestNamespaceTargeting/no_relevant_namespace_labels
2019-08-30T00:45:14.527981Z	info	CI	=== BEGIN: Test: 'citadel_test[TestNamespaceTargeting/no_relevant_namespace_labels]' ===
2019-08-30T00:45:18.252232Z	info	CI	=== DONE:  Test: 'citadel_test[TestNamespaceTargeting/no_relevant_namespace_labels] (3.724237147s)' ===
=== RUN   TestNamespaceTargeting/matching_env_label,_false_override_label
2019-08-30T00:45:18.252577Z	info	CI	=== BEGIN: Test: 'citadel_test[TestNamespaceTargeting/matching_env_label,_false_override_label]' ===
2019-08-30T00:45:20.474811Z	info	CI	=== DONE:  Test: 'citadel_test[TestNamespaceTargeting/matching_env_label,_false_override_label] (2.222225272s)' ===
2019-08-30T00:45:20.474880Z	info	CI	=== DONE:  Test: 'citadel_test[TestNamespaceTargeting] (12.967918828s)' ===
--- FAIL: TestNamespaceTargeting (12.97s)
    namespace_targeting_test.go:79: expected secret generation for secret istio.test-service-account: false, but got: true
    --- PASS: TestNamespaceTargeting/no_env_label,_false_override_label (5.54s)
    --- PASS: TestNamespaceTargeting/matching_env_label,_no_override_label (1.49s)
    --- PASS: TestNamespaceTargeting/no_relevant_namespace_labels (3.72s)
    namespace_targeting_test.go:79: expected secret generation for secret istio.test-service-account: false, but got: true
    --- PASS: TestNamespaceTargeting/matching_env_label,_false_override_label (2.22s)
=== RUN   TestSecretCreationKubernetes
2019-08-30T00:45:20.475180Z	info	CI	=== BEGIN: Test: 'citadel_test[TestSecretCreationKubernetes]' ===
2019-08-30T00:45:21.405635Z	info	CI	=== DONE:  Test: 'citadel_test[TestSecretCreationKubernetes] (930.44558ms)' ===
--- PASS: TestSecretCreationKubernetes (0.93s)
    secret_creation_test.go:34: checking secret "istio.default" is correctly created
    secret_creation_test.go:40: secret "istio.default" has been deleted
    secret_creation_test.go:44: checking secret "istio.default" is correctly re-created
FAIL
2019-08-30T00:45:21.405711Z	info	CI	=== FAILED: Test Run: 'citadel_test' (exitCode: 1) ===
2019-08-30T00:45:21.405721Z	info	CI	=== Suite "citadel_test" run time: 14.491616469s ===
2019-08-30T00:45:21.405737Z	error	CI	=== Dumping Istio Deployment State...
proto: tag has too few fields: "-"
proto: tag has too few fields: "-"
FAIL	istio.io/istio/tests/integration/security/citadel	15.275s
```

[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[ ] Security
[x] Test and Release
[ ] User Experience
[ ] Developer Infrastructure
 Comments: 
 Comment 0: For context surrounding [this test](https://github.com/istio/istio/blob/master/tests/integration/security/citadel/namespace_targeting_test.go), it creates a namespace, adds namespace labels which determine whether to create secrets for that namespace, and then checks if the secret was created ([it tests this logic](https://github.com/istio/istio/blob/dc7a3e70f93349a7694fa64b9a2ffbbbe12e3e50/security/pkg/k8s/controller/workloadsecret.go#L361)).

The test is fails consistently by creating secrets all the time (even when the test case attempts to place the `ca.isito.io/override:false` label telling it explicitly not to). This could mean that either the test cannot read namespace labels for some reason (perm issue) or that the namespace label is not there at the time the check is made.

The test began to fail 100% of the time at around 6:00 PM PST. Will post another update as I look more into this. I don't have as much context on the installer however, and what changes might have broken the aforementioned behaviors.
 Comment 1: I'm having difficulty pinpointing a recently merged PR (in the 4-12 hour window) that could have affected this test...

/cc @JimmyCYJ @incfly who also have some context on the brownryan@example.net.
 Comment 2: It could be the same root cause as https://github.com/istio/istio/pull/16682.
 Comment 3: It's possible that the way we're creating labeled namespace from our integration test framework was broken when we updated the KinD version? This might be the only test that relies on that feature.
 Comment 4: We need to also look into any difference between the old installer and new installer that might affect this. This test is not failing in istio/istio. That could point to a missing permission that is now required by the more recent k8s version?
 Comment 5: I see the [error log](
https://12561-172785406-gh.circle-artifacts.com/0/go/out/logs/test-control-plane/containers/istio-citadel-8445957f87-nrpz4_istio-system_citadel-1106591eb2f8c9178b76547822aeb93ece64724d066a546aa06197389f4bc4dd.log) in the KinD test for istio/installer

```error
2019-08-30T00:36:12.28378622Z stdout F 2019-08-30T00:36:12.283610Z	error	istio.io/istio/security/pkg/k8s/controller/workloadsecret.go:231: Failed to list *v1.Namespace: namespaces is forbidden: User "system:serviceaccount:istio-system:istio-citadel-service-account" cannot list resource "namespaces" in API group "" at the cluster scope
```

This appears to be a RBAC setup issue?
 Comment 6: Could we check if the cluster role for the citadel service account reading namespace is setup correctly in KinD?
 Comment 7: @incfly You are right! The chart template in istio/installer:release-1.3 is missing the get/watch/list permissions on namespaces. Compare https://github.com/istio/installer/blob/release-1.3/security/citadel/templates/clusterrole.yaml#L17 with https://github.com/istio/istio/blob/release-1.3/install/kubernetes/helm/istio/charts/security/templates/clusterrole.yaml#L18. Good call!
 Comment 8: istio/installer:master is already OK: https://github.com/istio/installer/blob/master/security/citadel/templates/clusterrole.yaml#L17
 Comment 9: https://github.com/istio/installer/pull/335 needs to be backported.
Someone please comment `/cherrypick release-1.3` on that PR, and I'll approve.
 Comment 10: This seems to have been resolved on `release-1.3` with [https://github.com/istio/installer/pull/368](https://github.com/istio/installer/pull/368). I'm not seeing failures on installer `master` either- should this be safe to close?
 Comment 11: Yes, thanks for fixing this!
{'source': 'GithubIssues', 'repo_name_with_owner': 'istio/istio', 'issue_id': 487246267, 'repo_stars': 32221.0}