multi-cluster-headless-memcache

istiooperator.yaml

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: default
  namespace: istio-system
spec:
  profile: default
  components:
    pilot:
      k8s:
        priorityClassName: high-priority
        env:
          # Explicitly prevent fsGroup injection which can muck with mounted file permissions. We encountered this when
          # setting a 0400 on a mounted SSH key in conan and observed it ended up having a 0440 permission. The fix is
          # officially approved by istio (note LEGACY in the behaviour description) as long as we are running on k8s
          # >= 1.19 (which we are). If we installed via CLI istio would set this variable itself if it detected we were
          # installing in a k8s cluster > 1.19. More info here: https://github.com/istio/istio/issues/32217
          - name: ENABLE_LEGACY_FSGROUP_INJECTION
            value: "false"
  meshConfig:
    accessLogFile: /dev/stdout
    defaultConfig:
      proxyMetadata:
        # Enable basic DNS proxying
        ISTIO_META_DNS_CAPTURE: "true"
        # Enable automatic address allocation, optional
        ISTIO_META_DNS_AUTO_ALLOCATE: "true"
  values:
    global:
      meshID: {{ .Values.meshConfig.meshId }}
      multiCluster:
        clusterName: {{ .Values.meshConfig.clusterName }}
      network: {{ .Values.meshConfig.networkName }}

local-cluster.yaml

---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: memcache-0
  namespace: default
spec:
  hosts:
    - memcache-0.memcache-headless.default.svc.cluster.local
  location: MESH_INTERNAL
  ports:
    - name: memcached
      number: 11211
      protocol: TCP
  resolution: DNS

remote-cluster.yaml

---
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: memcache-0
spec:
  hosts:
    - memcache-0.memcache-headless.default.svc.cluster.local
  ports:
    - name: memcached
      number: 11211
      protocol: TCP
  location: MESH_INTERNAL
  resolution: STATIC
  endpoints:
    - address: <<redacted:eastwestgatewayip>>
      ports:
        memcached: 15443
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: memcache-0
spec:
  host: memcache-0.memcache-headless.default.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
      sni: outbound_.11211_._.memcache-0.memcache-headless.default.svc.cluster.local