#Installing a primary-remote multi-network mesh

#Create an ISTIO_VERSION environment variable that defines the Istio version to install

export ISTIO_VERSION=1.26.3

#Install Istio on the East cluster

1. Set the default network for the East cluster by running the following command:

   kubectl --context="${CTX_CLUSTER1}" label namespace istio-system topology.istio.io/network=network1

2. Create an Istio resource on the East cluster by running the following command:

   Save the following Istio resource to istio-external.yaml:

   istio-external.yaml

   apiVersion: sailoperator.io/v1
   kind: Istio
   metadata:
     name: default
   spec:
     version: v${ISTIO_VERSION}
     namespace: istio-system
     values:
       global:
         meshID: mesh1
         multiCluster:
           clusterName: cluster1
         network: network1
         externalIstiod: true
   1. This enables the control plane installed on the East cluster to serve as an external control plane for other remote clusters.

   Using kubectl to apply the Istio resource:

   envsubst < istio-external.yaml | kubectl --context "${CTX_CLUSTER1}" apply -f -

3. Wait for the control plane to return the "Ready" status condition by running the following command:

   kubectl --context "${CTX_CLUSTER1}" wait --for condition=Ready istio/default --timeout=3m

4. Create an East-West gateway on the East cluster by running the following command:

   kubectl --context "${CTX_CLUSTER1}" apply -f https://raw.githubusercontent.com/alauda-mesh/sail-operator/main/docs/deployment-models/resources/east-west-gateway-net1.yaml

5. Expose the control plane through the gateway so that services in the West cluster can access the control plane by running the following command:

   kubectl --context "${CTX_CLUSTER1}" apply -n istio-system -f https://raw.githubusercontent.com/alauda-mesh/sail-operator/main/docs/deployment-models/resources/expose-istiod.yaml

6. Expose the application services through the gateway by running the following command:

   kubectl --context "${CTX_CLUSTER1}" apply -n istio-system -f https://raw.githubusercontent.com/alauda-mesh/sail-operator/main/docs/deployment-models/resources/expose-services.yaml

#Install Istio on the West cluster

1. Save the IP address of the East-West gateway running in the East cluster by running the following command:

   export DISCOVERY_ADDRESS=$(kubectl --context="${CTX_CLUSTER1}" \
      -n istio-system get svc istio-eastwestgateway \
      -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

2. Create an Istio resource on the West cluster by running the following command:

   cat <<EOF | kubectl --context "${CTX_CLUSTER2}" apply -f -
   apiVersion: sailoperator.io/v1
   kind: Istio
   metadata:
     name: default
   spec:
     version: v${ISTIO_VERSION}
     namespace: istio-system
     profile: remote
     values:
       istiodRemote:
         injectionPath: /inject/cluster/cluster2/net/network2
       global:
         remotePilotAddress: ${DISCOVERY_ADDRESS}
   EOF

3. Annotate the istio-system namespace in the West cluster so that it is managed by the control plane in the East cluster by running the following command:

   kubectl --context="${CTX_CLUSTER2}" annotate namespace istio-system topology.istio.io/controlPlaneClusters=cluster1

4. Set the default network for the West cluster by running the following command:

   kubectl --context="${CTX_CLUSTER2}" label namespace istio-system topology.istio.io/network=network2

5. Install a remote secret on the East cluster that provides access to the API server on the West cluster by running the following command:

   istioctl create-remote-secret \
     --context="${CTX_CLUSTER2}" \
     --name=cluster2 | \
     kubectl --context="${CTX_CLUSTER1}" apply -f -

6. Wait for the Istio resource to return the "Ready" status condition by running the following command:

   kubectl --context "${CTX_CLUSTER2}" wait --for condition=Ready istio/default --timeout=3m

7. Create an East-West gateway on the West cluster by running the following command:

   kubectl --context "${CTX_CLUSTER2}" apply -f https://raw.githubusercontent.com/alauda-mesh/sail-operator/main/docs/deployment-models/resources/east-west-gateway-net2.yaml
   NOTE

   Since the West cluster is installed with a remote profile, exposing the application services on the East cluster exposes them on the East-West gateways of both clusters.