{"id":19523914,"url":"https://github.com/eitansuez/istio-multicluster","last_synced_at":"2026-02-04T14:31:51.948Z","repository":{"id":96637533,"uuid":"534337413","full_name":"eitansuez/istio-multicluster","owner":"eitansuez","description":null,"archived":false,"fork":false,"pushed_at":"2022-09-08T20:15:39.000Z","size":3,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-02-26T01:27:11.603Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/eitansuez.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-09-08T18:10:55.000Z","updated_at":"2022-09-08T18:10:55.000Z","dependencies_parsed_at":null,"dependency_job_id":"b7e49956-460b-4ca1-a7fd-a8148f4ddfcc","html_url":"https://github.com/eitansuez/istio-multicluster","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/eitansuez/istio-multicluster","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eitansuez%2Fistio-multicluster","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eitansuez%2Fistio-multicluster/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eitansuez%2Fistio-multicluster/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eitansuez%2Fistio-multicluster/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/eitansuez","download_url":"https://codeload.github.com/eitansuez/istio-multicluster/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/eitansuez%2Fistio-multicluster/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263499193,"owners_count":23476021,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T00:45:14.531Z","updated_at":"2026-02-04T14:31:46.927Z","avatar_url":"https://github.com/eitansuez.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Istio Multi-cluster on separate networks\n\nNot shown: I created two VPCs, one named network1 in the us-central1 region, and the other network2 in us-east1.\n\n## Create the clusters\n\n```shell\ngcloud container clusters create central-cluster \\\n  --cluster-version latest \\\n  --machine-type \"e2-standard-2\" \\\n  --num-nodes \"3\" \\\n  --network \"network1\" \\\n  --subnetwork \"network1-subnet\" \\\n  --zone \"us-central1-a\"\n```\n\n```shell\ngcloud container clusters create east-cluster \\\n  --cluster-version latest \\\n  --machine-type \"e2-standard-2\" \\\n  --num-nodes \"3\" \\\n  --network \"network2\" \\\n  --subnetwork \"network2-subnet\" \\\n  --zone \"us-east1-b\"\n```\n\n## Create common root of trust\n\nSee [these instructions](https://istio.io/latest/docs/tasks/security/cert-management/plugin-ca-cert/).\n\n### Create the certs and keys\n\nMake the root ca first.\n\nThen:\n\n```shell\nmake -f ../tools/certs/Makefile.selfsigned.mk central-cluster-cacerts\n```\n\nand:\n\n```shell\nmake -f ../tools/certs/Makefile.selfsigned.mk east-cluster-cacerts\n```\n\n## Create the secrets\n\nCreate the `istio-system` namespace and create secret in each kube context.\n\n```shell\nkubectx gke_eitan-tetrate_us-east1_east-cluster\npushd east-cluster\nkubectl create namespace istio-system\nkubectl create secret generic cacerts -n istio-system \\\n      --from-file=ca-cert.pem \\\n      --from-file=ca-key.pem \\\n      --from-file=root-cert.pem \\\n      --from-file=cert-chain.pem\npopd\n```\n\nand..\n\n```shell\nkubectx gke_eitan-tetrate_us-central1-a_central-cluster\npushd central-cluster\nkubectl create namespace istio-system\nkubectl create secret generic cacerts -n istio-system \\\n      --from-file=ca-cert.pem \\\n      --from-file=ca-key.pem \\\n      --from-file=root-cert.pem \\\n      --from-file=cert-chain.pem\npopd\n```\n\n## Configure kube context env vars\n\n```shell\nexport CTX_CLUSTER1=gke_eitan-tetrate_us-central1-a_central-cluster\n```\n\nand\n\n```shell\nexport CTX_CLUSTER2=gke_eitan-tetrate_us-east1_east-cluster\n```\n\n## Main course\n\nFollow instructions on [this page](https://istio.io/latest/docs/setup/install/multicluster/primary-remote_multi-network/)\n\n## Test\n\nDeploy helloworld and sleep samples to each cluster in the default namespace (labeled for istio injection).\n\nFor complete details, see [these instructions](https://istio.io/latest/docs/setup/install/multicluster/verify/).\n\n### Setup\n\nIn each cluster:\n\n- label default ns with istio-injection=enabled\n- deploy sleep\n- deploy helloworld service only\n\nThen on cluster1 (central), deploy helloworld-v1 only.\nAnd on cluster2 (east), deploy helloworld-v2 only.\n\n### Call the helloworld service from sleep\n\nFrom cluster1.sleep, calls to helloworld service should round-robin between v1 and v2:\n\n```shell\nk exec sleep-69cfb4968f-5spv2 -it -- curl helloworld:5000/hello\n```\n\nLikewise from cluster2.sleep.  This indicates that both endpoints are associated with the helloworld service, despite the fact that they live in separate clusters.\n\n### Note IP Addresses:\n\nCluster 1:\n\n```console\nNAME                             READY   STATUS    RESTARTS   AGE     IP\nhelloworld-v1-77cb56d4b4-8q7jt   2/2     Running   0          8m53s   10.60.2.9\n```\n\n```shell\nk get svc -n istio-system\n```\n\nOutput:\n\n```console\nNAME                    TYPE           CLUSTER-IP     EXTERNAL-IP    PORT(S)                                                           AGE\nistio-eastwestgateway   LoadBalancer   10.64.13.164   34.67.135.88   15021:30671/TCP,15443:31169/TCP,15012:32203/TCP,15017:30977/TCP   140m\nistio-ingressgateway    LoadBalancer   10.64.14.243   34.71.79.179   15021:30969/TCP,80:32226/TCP,443:30675/TCP                        140m\nistiod                  ClusterIP      10.64.6.125    \u003cnone\u003e         15010/TCP,15012/TCP,443/TCP,15014/TCP                             140m\n```\n\nCluster 2:\n\n```console\nNAME                             READY   STATUS    RESTARTS   AGE   IP\nhelloworld-v2-79bf565586-xhm4p   2/2     Running   0          11m   10.124.6.4\n```\n\n```shell\nk get svc -n istio-system\n```\n\nOutput:\n\n```console\nNAME                    TYPE           CLUSTER-IP      EXTERNAL-IP     PORT(S)                                                           AGE\nistio-eastwestgateway   LoadBalancer   10.128.9.199    34.74.100.144   15021:32281/TCP,15443:30732/TCP,15012:30305/TCP,15017:32378/TCP   114m\nistiod                  ClusterIP      10.128.14.225   \u003cnone\u003e          15012/TCP,443/TCP                                                 115m\n```\n\n### Look at the endpoints\n\nFrom cluster1 to cluster2:\n\n```shell\nistioctl proxy-config endpoint sleep-69cfb4968f-h2njl --cluster \"outbound|5000||helloworld.default.svc.cluster.local\"\n```\n\nOutput:\n\n```console\nENDPOINT                STATUS      OUTLIER CHECK     CLUSTER\n10.60.2.9:5000          HEALTHY     OK                outbound|5000||helloworld.default.svc.cluster.local\n34.74.100.144:15443     HEALTHY     OK                outbound|5000||helloworld.default.svc.cluster.local\n```\n\nNote: the 10.60.2.9 address is the pod ip of the local helloworld workload, while the 34.74.100.144 address is that of the east-west gateway on cluster2.\n\nFrom cluster2 to cluster1:\n\n```shell\nistioctl proxy-config endpoint sleep-69cfb4968f-5spv2 --cluster \"outbound|5000||helloworld.default.svc.cluster.local\"\n```\n\nOutput:\n\n```console\nENDPOINT               STATUS      OUTLIER CHECK     CLUSTER\n10.124.6.4:5000        HEALTHY     OK                outbound|5000||helloworld.default.svc.cluster.local\n34.67.135.88:15443     HEALTHY     OK                outbound|5000||helloworld.default.svc.cluster.local\n```\n\nNote: the 10.124.6.4 address is the local pod ip for helloworld (cluster2), while the 34.67.135.88 address is that of the east-west gateway on cluster1.\n\n### Observations\n\n1. There's an implicit rule here that multiple services bearing the same fully-qualified name (in this case `helloworld.default.svc.cluster.local`) are considered, or coalesced into a single logical service that spans the whole mesh.\n\n1. The main observation is that this exercise confirms that service discovery is mesh-wide, even in the face of workloads residing in separate clusters.\nFurther, service discovery and propagation of that information to the envoys happens automatically and transparently, as it should, just like in the simpler case of workloads residing in a single-cluster.\n\n1. If I were to scale helloworld-v1 on cluster1 to 2 replicas, the number of endpoints for the helloworld cluster on the sleep pod in cluster2 would not change, because the two endpoints in cluster1 both have technically the same target address, the east-west gateway on cluster1.\n\n    The inference here is that the east-west gateway (on cluster1) receiving the request from cluster2 will load-balance requests across the two helloworld instances residing on its side, on its cluster.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feitansuez%2Fistio-multicluster","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Feitansuez%2Fistio-multicluster","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Feitansuez%2Fistio-multicluster/lists"}