Configuring Istio Sidecar Mesh + ALB Ingress on EKS with Terraform

Istio's sidecar-based architecture places an Envoy Proxy alongside each Pod to control traffic.

This pattern improves observability and security, but adds resource overhead.

This post uses Terraform to install Istio in sidecar mode on an Amazon EKS cluster and integrate it with the ALB Ingress Controller to receive external traffic.

Installation Overview

Component	Description
`istio-base`	Installs common Istio resources (CRDs, etc.)
`istiod`	Sidecar-based Istio control plane
`istio-ingressgateway`	External entry point gateway (deployed as NodePort)
`Gateway 리소스`	Istio Gateway CR
`ALB용 Ingress 리소스`	ALB Ingress definitions for services/monitoring

Istio Sidecar와 ALB Ingress의 Terraform 리소스 관계

Line guide

Terraform depends_on 순서
Ingress 템플릿이 값을 가져오는 data source

Istio Sidecar와 ALB Ingress의 Terraform 리소스 관계

istio-base, istiod, istio-ingress, Gateway CR로 이어지는 Terraform depends_on 순서 위에 Services용·Addons용 ALB Ingress 두 개가 놓인다. 두 Ingress는 헬스체크 포트 값을 istio-ingress Service의 node_port에서 가져온다.

Read the diagram as text

istiod는 istio-base에 의존한다.
istio-ingress(gateway 차트, Service NodePort)는 istio-base와 istiod에 의존한다.
Istio Gateway CR(istio-gateway.yaml)은 istio-base, istiod, istio-ingress에 의존한다.
Services용 ALB Ingress는 앞의 네 리소스에 의존한다. 템플릿에 퍼블릭 서브넷과 ACM 인증서를 넘긴다.
Addons용 ALB Ingress도 같은 네 리소스에 의존한다.
Services용 Ingress 템플릿의 헬스체크 포트 값은 istio-ingressgateway Service 15021 포트의 node_port다.
Addons용 Ingress 템플릿도 같은 값을 받는다.

1. Install istio-base and istiod

hcl

resource "helm_release" "istio_base" {
  namespace        = "istio-system"
  create_namespace = true
  name             = "istio-base"
  repository       = "https://istio-release.storage.googleapis.com/charts"
  chart            = "base"
  upgrade_install  = true

  values = [
    yamlencode({
      defaultRevision = "default"
    })
  ]
}

resource "helm_release" "istiod" {
  namespace        = "istio-system"
  create_namespace = true
  name             = "istiod"
  repository       = "https://istio-release.storage.googleapis.com/charts"
  chart            = "istiod"
  upgrade_install  = true

  depends_on = [ helm_release.istio_base ]
}

2. Install istio-ingressgateway (for NodePort + ALB Integration)

hcl

resource "helm_release" "istio_ingress" {
  namespace        = "istio-ingress"
  create_namespace = true
  name             = "istio-ingress"
  repository       = "https://istio-release.storage.googleapis.com/charts"
  chart            = "gateway"
  upgrade_install  = true

  values = [
    yamlencode({
      _internal_defaults_do_not_set = {
        service = {
          type = "NodePort"
        }
      }
      extraManifests = []
    })
  ]

  depends_on = [ helm_release.istio_base, helm_release.istiod ]
}

3. Define the Istio Gateway Resource

hcl

resource "kubectl_manifest" "istio_gateway" {
  yaml_body = file("${path.module}/manifests/istio-gateway.yaml")

  depends_on = [
    helm_release.istio_base,
    helm_release.istiod,
    helm_release.istio_ingress
  ]
}

4. Ingress Resources (ALB Integration)

ALB-Integrated Ingress Template (for Services)

hcl

resource "kubectl_manifest" "ingress_for_services" {
  yaml_body = templatefile("${path.module}/manifests/ingress-for-serivces.yaml", {
    ALB_NAME_SVC                   = "${local.cluster_name}-svc-ingress"
    PUBLIC_SUBNET_IDS             = join(",", aws_subnet.public[*].id)
    ACM_CERT_ARN                  = data.aws_acm_certificate.cert.arn
    ISTIO_INGRESS_HEALTHCHECK_PORT = tostring([
      for p in data.kubernetes_service.istio_ingressgateway.spec[0].port :
        p.node_port if p.port == 15021
    ][0])
    WAF_ACL_ARN = ""
  })

  depends_on = [
    helm_release.istio_base,
    helm_release.istiod,
    helm_release.istio_ingress,
    kubectl_manifest.istio_gateway
  ]
}

ALB-Integrated Ingress Template (for Addons)

hcl

resource "kubectl_manifest" "ingress_for_addons" {
  yaml_body = templatefile("${path.module}/manifests/ingress-for-addons.yaml", {
    ALB_NAME_ADDON                = "${local.cluster_name}-addon-ingress"
    PUBLIC_SUBNET_IDS             = join(",", aws_subnet.public[*].id)
    ACM_CERT_ARN                  = data.aws_acm_certificate.cert.arn
    ISTIO_INGRESS_HEALTHCHECK_PORT = tostring([
      for p in data.kubernetes_service.istio_ingressgateway.spec[0].port :
        p.node_port if p.port == 15021
    ][0])
    WAF_ACL_ARN = ""
  })

  depends_on = [
    helm_release.istio_base,
    helm_release.istiod,
    helm_release.istio_ingress,
    kubectl_manifest.istio_gateway
  ]
}

Closing Notes

This configuration has the following characteristics.

Traffic security and observability through the Istio Sidecar Mesh architecture
An external entry point integrated with the ALB Ingress Controller
Separate Ingress configurations for services and monitoring

This Sidecar + ALB architecture can also be used in production.