feat(istio): expose istiod_replicas to guarantee HA for node drains

[agustincelentano]

Summary

Single-replica istiod + chart-default PDB (minAvailable=1) yields disruptionsAllowed=0, which blocks every EKS node rolling update with PodEvictionFailure: Reached max retries. In clusters that use this module, tofu apply fails as soon as any change triggers a node group replacement (AMI bumps, instance_type changes, etc.).

Change

• Add a new istiod_replicas variable (default 1, validated >= 1).
• Wire it into both pilot.replicaCount and pilot.autoscaleMin on the helm_release "istiod".

Why default = 1

Backwards compatibility. Existing consumers see no behavior change after upgrading the module. Callers that need HA (recommended for clusters doing node rolling updates) opt in explicitly:

module "istio" {
  source = "...//infrastructure/commons/istio?ref=v1.52.0"

  istiod_replicas = 2
}

Why both replicaCount AND autoscaleMin

The upstream istiod chart enables the HPA by default (pilot.autoscaleEnabled=true, pilot.autoscaleMin=1). Setting only pilot.replicaCount is insufficient — the HPA would scale the deployment back to 1 replica shortly after install, leaving us with the same problem. Overriding autoscaleMin locks in the floor.

Test plan

• Apply on a dev cluster with istiod_replicas = 2 and verify kubectl -n istio-system get deploy istiod shows READY 2/2.
• Verify kubectl -n istio-system get hpa istiod shows MINPODS=2.
• Verify kubectl -n istio-system get pdb istiod shows ALLOWED DISRUPTIONS=1.
• Trigger a node rolling update and confirm the drain succeeds.
• Apply on another cluster without setting the variable and verify the deployment stays at 1 replica (backwards compat).