<p>I'm new to Terraform. I need to set up Istio on the AWS EKS cluster. I thought of using Istio-Operator along with Terraform to do the same.</p>
<p>Below is the shell script to install Istio on EKS using Istio-Operator:</p>
<p>install-istio.sh</p>
<pre><code># Download and install the Istio istioctl client binary

# Specify the Istio version that will be leveraged throughout these instructions
ISTIO_VERSION=1.7.3

curl -sL &quot;https://github.com/istio/istio/releases/download/$ISTIO_VERSION/istioctl-$ISTIO_VERSION-linux-amd64.tar.gz&quot; | tar xz

sudo mv ./istioctl /usr/local/bin/istioctl
sudo chmod +x /usr/local/bin/istioctl

# Install the Istio Operator on EKS
istioctl operator init

# The Istio Operator is installed into the istio-operator namespace. Query the namespace.
kubectl get all -n istio-operator

# Install Istio components
istioctl profile dump default

# Create the istio-system namespace and deploy the Istio Operator Spec to that namespace.
kubectl create ns istio-system
kubectl apply -f istio-operator.yaml

# Validate the Istio installation
kubectl get all -n istio-system

</code></pre>
<p>Below is the istio-operator.yaml file used by install-istio.sh</p>
<pre><code>apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: istio-control-plane
spec:
  # Use the default profile as the base
  # More details at: https://istio.io/docs/setup/additional-setup/config-profiles/
  profile: default
  # Enable the addons that we will want to use
  addonComponents:
    grafana:
      enabled: true
    prometheus:
      enabled: true
    tracing:
      enabled: true
    kiali:
      enabled: true
  values:
    global:
      # Ensure that the Istio pods are only scheduled to run on Linux nodes
      defaultNodeSelector:
        beta.kubernetes.io/os: linux
    kiali:
      dashboard:
        auth:
          strategy: anonymous
</code></pre>
<p>Below is the main.tf file which executes the script</p>
<pre><code>resource &quot;null_resource&quot; &quot;install_istio&quot; {

 provisioner &quot;local-exec&quot; {

    command = &quot;/bin/bash install-istio.sh&quot;
  }
}

</code></pre>
<p>I request you to help me with few queries:</p>
<ol>
<li>How can I make use of the above script along with Terraform to install Istio on EKS cluster. What is the terraform part I need to include along with the above script?</li>
<li>Is there any missing part in the script. Will I face any problem updating the Istio using the above script?</li>
<li>What are the other parameters I need to include so that the script can install Istio on the EKS cluster?</li>
<li>How can I create Terraform module using the above script?</li>
</ol>
<p>Thank you very much for your time. Appreciate all your help!</p>

Sweta Sharma
<p>I believe you will encounter problems if using a local-exec provisioner like this.</p>
<p>Terraform does not play nice with resources it cannot reconcile. Especially when it comes to CRDs. Also, every time you will run <code>terraform apply</code>, you will run <code>istioctl init</code> over and over, which is probably not what you want.</p>
<p>What you can do, is to</p>
<ol>
<li>convert the istio-operator to standard kubernetes manifests using</li>
</ol>
<pre><code>mkdir -p istio-operator
istio-operator dump &gt; istio-operator/manifests.yaml
</code></pre>
<ol start="2">
<li>Create a <code>istio-operator/kustomization.yaml</code> file with</li>
</ol>
<pre><code>#istio-operator/kustomization.yaml

resources:
- manifests.yaml
</code></pre>
<ol start="3">
<li>Install the terraform <code>kustomization</code> provider</li>
</ol>
<pre><code># terraform.tf

terraform {
  required_providers {
    kustomization = {
      source  = &quot;kbst/kustomization&quot;
      version = &quot;0.4.3&quot;
    }
  }
}

provider &quot;kustomization&quot; {
  // See online documentation on how to configure this
}
</code></pre>
<ol start="4">
<li>Install <code>istio-operator</code> with the terraform <code>kustomization</code> provider</li>
</ol>
<pre><code># istio-operator.tf

data &quot;kustomization&quot; &quot;istio_operator&quot; {
  path     = &quot;./istio-operator&quot;
}

resource &quot;kustomization_resource&quot; &quot;istio_operator&quot; {
  for_each = data.kustomization.istio_operator.ids
  manifest = data.kustomization.istio_operator.manifests[each.value]
}


</code></pre>
<ol start="5">
<li>Create a <code>IstioOperator</code> manifest in <code>istio/manifest.yaml</code></li>
</ol>
<pre><code># istio/manifest.yaml

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: istio-control-plane
...
</code></pre>
<ol start="6">
<li>Create a <code>istio/kustomization.yaml</code> with</li>
</ol>
<pre><code># istio/kustomization.yaml

resources:
- manifest.yaml
</code></pre>
<ol start="7">
<li>Install the <code>IstioOperator</code> with a second <code>kustomization</code> resource using terraform.</li>
</ol>
<pre><code># istio.tf

data &quot;kustomization&quot; &quot;istio&quot; {
  path     = &quot;./istio&quot;
}

resource &quot;kustomization_resource&quot; &quot;istio&quot; {
  for_each = data.kustomization.istio.ids
  manifest = data.kustomization.istio.manifests[each.value]
  depends_on = [kustomization_resource.istio_operator]
}


</code></pre>
<p>I would recommend putting this whole thing in a separate folder, such as this</p>
<pre><code>/home
  /project
    /terraform
      /istio
        terraform.tf
        istio_operator.tf
        istio.tf
        /istio
          kustomization.yaml
          manifest.yaml
        /istio-operator
          kustomization.yaml
          manifest.yaml

      
</code></pre>
