<p>I'm new to Terraform and Helm world! I need to set up Istio on the AWS EKS cluster.
I'm trying to install Istio on top of EKS cluster using Terraform and Helm as a provider:
Below is the terraform code for the same:</p>
<pre><code>resource &quot;kubernetes_namespace&quot; &quot;istio-system&quot; {
  metadata {
    annotations = {
      name = &quot;istio-namespace&quot;
    }

    labels = {
      mylabel = &quot;label-value&quot;
    }

    name = &quot;istio-namespace&quot;
  }
}

resource &quot;helm_release&quot; &quot;istio_base&quot; {
  name       = &quot;istio-base&quot;
  chart      = &quot;./manifests/charts/base&quot;
  namespace  = &quot;istio-system&quot;
}

resource &quot;helm_release&quot; &quot;istiod&quot; {
  name       = &quot;istiod&quot;
  chart      = &quot;./manifests/charts/istio-control/istio-discovery&quot;
  namespace  = &quot;istio-system&quot;
}

resource &quot;helm_release&quot; &quot;istio-ingress&quot; {
  name       = &quot;istio-ingress&quot;
  chart      = &quot;./manifests/charts/gateways/istio-ingress&quot;
  namespace  = &quot;istio-system&quot;
}

resource &quot;helm_release&quot; &quot;istio-egress&quot; {
  name       = &quot;istio-ingress&quot;
  chart      = &quot;./manifests/charts/gateways/istio-egress&quot;
  namespace  = &quot;istio-system&quot;
}


</code></pre>
<p>Can someone help me to answer my few queries:</p>
<ol>
<li><p>Do I need a service account for Istio and helm both to install Istio on the EKS cluster?</p>
</li>
<li><p>Do I need to create a specific IAM role to install Istio on the EKS cluster?</p>
</li>
<li><p>What are some security checks I need to take care of to install Istio on the EKS cluster?</p>
</li>
<li><p>Let's say in the future I need to change some default value provided by helm chart How can I change those values? Let's say changing memory from 3072Mi to 4000Mi</p>
</li>
<li><p>How can I enable mTLS using helm chart in Istio?</p>
</li>
<li><p>Installing add-on for example Kiali using helm chart?</p>
</li>
</ol>

<p>yes, you have to create the IAM role also if you want to create it for workers you can also create the IAM for the same.</p>
<pre><code>resource &quot;aws_iam_role&quot; &quot;eksproject-cluster&quot; {
  name = &quot;terraform-eks-eksproject-cluster&quot;

  assume_role_policy = &lt;&lt;POLICY
{
  &quot;Version&quot;: &quot;2012-10-17&quot;,
  &quot;Statement&quot;: [
    {
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Principal&quot;: {
        &quot;Service&quot;: &quot;eks.amazonaws.com&quot;
      },
      &quot;Action&quot;: &quot;sts:AssumeRole&quot;
    }
  ]
}
POLICY
}
</code></pre>
<p><a href="https://github.com/prabhatpankaj/eks-terraform-istio" rel="nofollow noreferrer">https://github.com/prabhatpankaj/eks-terraform-istio</a></p>
<p>but if you are an admin of EKS it's not required to create the IAM you can directly setup the istio</p>
<pre><code>helm template istio-1.1.4/install/kubernetes/helm/istio --name istio --namespace istio-system  --set grafana.enabled=true --set tracing.enabled=true --set kiali.enabled=true --set kiali.dashboard.secretName=kiali --set kiali.dashboard.usernameKey=username --set kiali.dashboard.passphraseKey=passphrase | kubectl apply -f -
</code></pre>
<blockquote>
<p>Let's say in the future I need to change some default value provided
by helm chart How can I change those values? Let's say changing memory
from 3072Mi to 4000Mi</p>
</blockquote>
<p>you can use the helm for the same</p>
<p>update the value into <strong>values.yaml</strong> and run command</p>
<p><code>helm upragde istio -f values.yaml</code></p>
<blockquote>
<p>How can I enable mTLS using helm chart in Istio?</p>
</blockquote>
<p>for mTLS between services or at the namespace level, you might have to configure the other YAMLs or you edit the chart apply those new YAML as part of helm.</p>
<pre><code>spec:
  mtls:
    mode: STRICT
</code></pre>
<blockquote>
<p>Installing add-on for example Kali using helm chart?</p>
</blockquote>
<p>it's already part of helm</p>
<pre><code>helm template istio-1.1.4/install/kubernetes/helm/istio --name istio --namespace istio-system  --set grafana.enabled=true --set tracing.enabled=true --set kiali.enabled=true --set kiali.dashboard.secretName=kiali --set kiali.dashboard.usernameKey=username --set kiali.dashboard.passphraseKey=passphrase | kubectl apply -f -
</code></pre>
<p><strong>--set kiali.enabled=true</strong> overriding the default value in command.</p>
