NLB -> Istio Gateway vs ALB -> Istio Gateway

If you are using Istio then yes, istio orginally created with ingress controller in mind. Gateway+Virtual Service basically enables what you want. Some ingress controllers are more easy and have different plusses but if istio handles all you want then go for it.

Yes, using ALB -> Istio gateway is redundant, as the virtual service takes care of all your custom routing rules (instead of ALB). Using an NLB hostname in front of the Istio gateway is the simplest method & recommended in the docs here: https://cloud.ibm.com/docs/containers?topic=containers-istio#no-tls

i would not say ALB is redundant, ALB has a few options which you cant leverage from istio:

• you cant add WAF on top of NLB which would leave your app exposed to security issues or you will need to address that into the cluster
• there are scenarios where you would actually want to move traffic to a another pool of EC2 instances, it would be difficult to do that with istio
• if you want to do SSL offload
• depending on your application it would be potentially dangerous to use NLB because there is no security (security groups) added on top of your NLB as such you would need to expose your nodes directly to internet