NLB -> Istio Gateway vs ALB -> Istio Gateway

Question

It is my understanding that you're gonna have an NLB or ALB in front of your Istio Gateway anyway?

But I am confused because it seems like Istio Gateway does a lot of things ALB does for Layer 7 and even more?

So I read ALB -> Istio Gateway is ok, but isn't that redundant? What about NLB -> ALB -> Istio Gateway, which seems like too much?

It seems like it is best to have NLB -> Istio Gateway to let them handle Layer 4 and Layer 7 respectively like they do best, can anyone enlighten and confirm?

Answer 1

If you are using Istio then yes, istio orginally created with ingress controller in mind. Gateway+Virtual Service basically enables what you want. Some ingress controllers are more easy and have different plusses but if istio handles all you want then go for it.

Answer 2

Yes, using ALB -> Istio gateway is redundant, as the virtual service takes care of all your custom routing rules (instead of ALB). Using an NLB hostname in front of the Istio gateway is the simplest method & recommended in the docs here: https://cloud.ibm.com/docs/containers?topic=containers-istio#no-tls