Skip to content

feat(istio): expose istio_ingressgateway_replicas to guarantee HA for node drains #379

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fedemaleh wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat(istio): expose istio_ingressgateway_replicas to guarantee HA for node drains #379

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ad09db5
feat(istio): expose istio_ingressgateway_replicas to guarantee HA for…
fedemaleh Jun 1, 2026
ac84156
chore(istio): drop verbose comment on ingressgateway HA set block
fedemaleh Jun 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion infrastructure/commons/istio/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,5 +88,14 @@ resource "helm_release" "istio_ingressgateway" {

values = [local.helm_values]


set = [
{
name = "replicaCount"
value = var.istio_ingressgateway_replicas
},
{
name = "autoscaling.minReplicas"
value = var.istio_ingressgateway_replicas
},
]
}
11 changes: 11 additions & 0 deletions infrastructure/commons/istio/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,17 @@ variable "istiod_replicas" {
}
}

variable "istio_ingressgateway_replicas" {
description = "Number of istio-ingressgateway replicas. Set to 2+ to avoid PDB blocking node drains. Applied to both replicaCount and autoscaling.minReplicas to prevent the HPA from scaling back to 1. The Istio gateway Helm chart installs the gateway with a default PodDisruptionBudget (minAvailable=1), so a single replica blocks node rolling updates with PodEvictionFailure — same class of bug as the istiod single-replica issue."
type = number
default = 2

validation {
condition = var.istio_ingressgateway_replicas >= 1
error_message = "istio_ingressgateway_replicas must be at least 1."
}
}

###############################################################################
# SERVICE CONFIGURATION
###############################################################################
Expand Down