When an issue is confidential, it does not show the create merge request button. That's a bug. Maybe not. See comment thread.