Deploying Istio Service Mesh on AWS EKS: A Complete Hands-On Guide

Introduction

As Kubernetes environments grow, managing microservice communication becomes increasingly complex. Challenges such as:

· Service-to-service authentication

· Traffic management

· Observability

· Security

· Load balancing

· Canary deployments

can quickly become difficult to handle.

This is where Istio Service Mesh helps by providing a dedicated infrastructure layer for managing service-to-service communication without modifying application code.

In this article, we’ll deploy Istio on an Amazon EKS cluster and configure essential service mesh capabilities.

Architecture Overview

Prerequisites

Before starting, ensure you have:

· AWS Account

· EKS Cluster

· AWS CLI configured

aws configure

· kubectl

kubectl version — client

· eksctl

eksctl version

· Helm

helm version

Step 1: Create an EKS Cluster

If you don’t already have a cluster:

eksctl create cluster — name istio-demo — region ap-south-1 — nodegroup-name workers — node-type t3.medium — nodes 2

Verify cluster:

kubectl get nodes

Expected:

NAME STATUS

ip-192–168-x-x.ec2.internal Ready

ip-192–168-y-y.ec2.internal Ready

Step 2: Install Istio CLI

Download Istio:

curl -L https://istio.io/downloadIstio | sh -

Navigate:

cd istio-*

Add to PATH:

export PATH=$PWD/bin:$PATH

Verify:

istioctl version

Step 3: Install Istio Control Plane

Install demo profile:

istioctl install — set profile=demo -y

Verify installation:

kubectl get pods -n istio-system

Output:

NAME READY

istiod-xxxxx 1/1

Check services:

kubectl get svc -n istio-system

Step 4: Enable Automatic Sidecar Injection

Create namespace:

kubectl create namespace sample

Enable injection:

kubectl label namespace sample istio-injection=enabled

Verify:

kubectl get ns sample — show-labels

Expected:

istio-injection=enabled

Step 5: Deploy Sample Application

Deploy Bookinfo application.

kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml -n sample

Verify:

kubectl get pods -n sample

You should see:

details
ratings
reviews
productpage

Check containers:

kubectl get pod productpage-v1-xxxx -n sample -o jsonpath='{.spec.containers[*].name}'

Output:

productpage istio-proxy

The istio-proxy container confirms successful sidecar injection.

Step 6: Configure Istio Gateway

Deploy gateway:

kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml -n sample

Verify:

kubectl get gateway -n sample

Get external endpoint:

kubectl get svc istio-ingressgateway \
-n istio-system

Output:

EXTERNAL-IP: XXXXX.elb.amazonaws.com

Open:

http://<external-ip>/productpage

Bookinfo application should display successfully.

Step 7: Traffic Management

One of Istio’s greatest strengths is advanced traffic control.

Version-Based Routing

Create destination rule:

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: reviews
spec:
  host: reviews
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2

Apply:

kubectl apply -f destination-rule.yaml

Create virtual service:

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
  - reviews
  http:
  - route:
    - destination:
        host: reviews
        subset: v2

Now all traffic routes to v2.

Canary Deployment Example

Split traffic:

http:
- route:
  - destination:
      host: reviews
      subset: v1
    weight: 80
  - destination:
      host: reviews
      subset: v2
    weight: 20

Benefits:

Get Veerla Ramakrishna’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

· Safe deployments

· A/B testing

· Gradual rollouts

· Reduced deployment risk

Step 8: Enable Mutual TLS (mTLS)

Istio can encrypt all internal service communications.

Apply:

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: sample
spec:
  mtls:
    mode: STRICT

Deploy:

kubectl apply -f mtls.yaml

Verify:

istioctl authn tls-check productpage-v1

Benefits:

· Encryption in transit

· Zero-trust architecture

· Service identity validation

Step 9: Observability with Kiali

Install add-ons:

kubectl apply -f samples/addons

Verify:

kubectl get pods -n istio-system

You’ll see:

kiali
grafana
prometheus
jaeger

Access Kiali:

istioctl dashboard kiali

Features:

· Service topology visualization

· Traffic flow monitoring

· Request success rates

· Error tracking

Step 10: Monitoring Metrics

Prometheus queries:

Request Rate

rate(
 istio_requests_total[5m]
)

Error Rate

rate(
 istio_requests_total{
   response_code=~"5.."
 }[5m]
)

Request Latency

histogram_quantile(
  0.95,
  sum(
    rate(
      istio_request_duration_milliseconds_bucket[5m]
    )
  ) by (le)
)

Security Best Practices

Use STRICT mTLS

mode: STRICT

Restrict Service Access

Implement Authorization Policies:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: productpage-policy
spec:
  selector:
    matchLabels:
      app: productpage
  rules:
  - from:
    - source:
        principals:
        - cluster.local/ns/sample/sa/default

Enable JWT Authentication

kind: RequestAuthentication

for securing APIs.

Troubleshooting

Check Sidecar Injection

kubectl describe pod <pod-name>

Inspect Proxy Configuration

istioctl proxy-config cluster <pod-name>

Analyze Configuration

istioctl analyze

Access Proxy Logs

kubectl logs <pod-name> -c istio-proxy

Cost Considerations on AWS

Istio adds additional resource consumption:

For production:

· Use dedicated node groups

· Enable Cluster Autoscaler

· Monitor Envoy resource usage

· Size worker nodes appropriately

Key Benefits of Istio on EKS

✅ Zero-trust security with mTLS

✅ Advanced traffic routing

✅ Canary deployments

✅ Blue-Green deployments

✅ Distributed tracing

✅ Service observability

✅ Policy enforcement

✅ Multi-cluster support

Conclusion

Istio brings enterprise-grade traffic management, security, and observability to Amazon EKS without requiring changes to application code. By deploying Istio on EKS, organizations can implement secure service-to-service communication, perform safer canary deployments, gain deep visibility into microservice interactions, and build a robust cloud-native platform.

Whether you’re running a few microservices or hundreds of workloads, Istio service mesh can become a foundational component of your Kubernetes platform strategy.