Governor Vasip Sahin said the attacker, armed with a long-barreled weapon, killed a policeman and a civilian outside the Reina club at around 1:45am on Sunday before entering and firing on people partying inside.
"A terrorist with a long-range weapon ... brutally and savagely carried out this incident by firing bullets on innocent people who were there solely to celebrate the New Year and have fun," he said at the scene.
At least 40 people, including foreign nationals, were reportedly wounded in the attack at the night spot in Ortakoy neighbourhood.
Local reports said eight of those injured were in a critical condition.
Some survivors jumped into the waters of the Bosphorus to save themselves and were being rescued by police.
Turkish media outlets said one attacker is believed to have been killed at the scene and another suspect is thought to have fled.
The Reina lies on the shore of the Bosphorus Strait and is one of Istanbul's best-known nightclubs, popular with locals and tourists alike.
Dozens of ambulances and police vehicles were dispatched to the attack site.
Al Jazeera's Jamal Elshayyal, reporting from the scene, said he saw several survivors rushing to taxis to leave after being cleared to leave the club by police.
"What security services will be trying to ascertain is not only how many attackers there were but what kind of weapons were used and how they were able to overcome security precautions," he said.
About 700 people were thought to have been in the nightclub when the attack happened, broadcaster CNN Turk said, citing officials.
Ortakoy is a cosmopolitan neighbourhood located under one of three bridges crossing the Bosphorus, and home to clubs, restaurants and art galleries.
There has been no claim of responsibility so far for the attack, but experts say the needle of suspicion points at the Islamic State of Iraq and the Levant (ISIL) group, which has repeatedly targeted civilians in Turkey in recent months.
Al Jazeera's Sinem Koseoglu, reporting from Istanbul, said security services believe the timing and target suggest ISIL involvement. Eight ISIL members had been detained, suspected of preparing a suicide attack on New Year's Eve, she said.
The Reina nightclub is not only frequented by partygoers but also used as a venue by businessmen and diplomats to conduct meetings, she said.
Koseoglu said those in the club reported seeing up to three attackers, carrying kalashnikovs.
The White House described the attack as "savagery" and said US intelligence services would help Turkish authorities investigate the attack.
Turkey, part of the US-led coalition against ISIL, faces multiple security threats including fallout from the war in neighbouring Syria.
It has seen repeated attacks and bombings blamed on ISIL, also known as ISIS, as well as Kurdish fighters of the PKK in recent months.
The PKK and its affiliates are known to target mostly members of Turkey's security forces rather than civilians.
The attack comes less than two weeks after the Russian ambassador to Turkey, Andrey Karlov, was assassinated while giving a speech at an art gallery in the capital Ankara.
Source: Al Jazeera and news agencies