Add Primary on Another Network

#!/bin/bash

set -euo pipefail

HUB=gcr.io/istio-testing
TAG=latest
echo "HUB=${HUB}"
echo "TAG=${TAG}"

# Delete Istio in this cluster
kubectl delete ns istio-system sample --context=${CTX3} --ignore-not-found

# Update the first cluster
echo "Updating MeshNetworks in the first cluster..."
cat <<EOF> ${WORK_DIR}/${CLUSTER1}/install.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  values:
    global:
      meshID: ${MESH}
      multiCluster:
        clusterName: ${CLUSTER1}
      network: ${NETWORK1}
      meshNetworks:
        ${NETWORK1}:
          endpoints:
          - fromRegistry: ${CLUSTER1}
          gateways:
          - registry_service_name: istio-ingressgateway.istio-system.svc.cluster.local
            port: 15443
        ${NETWORK2}:
          endpoints:
          - fromRegistry: ${CLUSTER3}
          gateways:
          - registry_service_name: istio-ingressgateway.istio-system.svc.cluster.local
            port: 15443
EOF
istioctl --context=${CTX1} install -f \
    ${WORK_DIR}/${CLUSTER1}/install.yaml \
    --charts manifests \
    --set values.global.hub=${HUB} \
    --set values.global.tag=${TAG} \
    --set values.global.imagePullPolicy=Always

# Configure trust
echo "Configuring trust..."
kubectl create namespace istio-system --context=${CTX3}
kubectl create secret generic cacerts --context=${CTX3} \
        -n istio-system \
        --from-file=${ISTIO}/samples/certs/ca-cert.pem \
        --from-file=${ISTIO}/samples/certs/ca-key.pem \
        --from-file=${ISTIO}/samples/certs/root-cert.pem \
        --from-file=${ISTIO}/samples/certs/cert-chain.pem

# Install Istio
echo "Installing Istio on second primary cluster (on a separate network)..."
mkdir -p ${WORK_DIR}/${CLUSTER3} && \
cat <<EOF> ${WORK_DIR}/${CLUSTER3}/install.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  values:
    global:
      meshID: ${MESH}
      multiCluster:
        clusterName: ${CLUSTER3}
      network: ${NETWORK2}
      meshNetworks:
        ${NETWORK1}:
          endpoints:
          - fromRegistry: ${CLUSTER1}
          gateways:
          - registry_service_name: istio-ingressgateway.istio-system.svc.cluster.local
            port: 15443
        ${NETWORK2}:
          endpoints:
          - fromRegistry: ${CLUSTER3}
          gateways:
          - registry_service_name: istio-ingressgateway.istio-system.svc.cluster.local
            port: 15443
EOF
istioctl --context=${CTX3} install -f \
    ${WORK_DIR}/${CLUSTER3}/install.yaml \
    --charts manifests \
    --set values.global.hub=${HUB} \
    --set values.global.tag=${TAG} \
    --set values.global.imagePullPolicy=Always

# Verify the installation
kubectl --context=${CTX3} -n istio-system get pod

# Expose services via ingress
echo "Exposing services via ingress..."
kubectl --context=${CTX1} apply -n istio-system -f \
    ${ISTIO}/samples/cross-network-gateway/cross-network-gateway.yaml
kubectl --context=${CTX3} apply -n istio-system -f \
    ${ISTIO}/samples/cross-network-gateway/cross-network-gateway.yaml

# Configure cross-cluster LB
echo "Configuring cross-cluster load balancing..."
istioctl x create-remote-secret \
  --context=${CTX1} \
  --name=${CLUSTER1} | \
  kubectl apply -f - --context=${CTX3}
istioctl x create-remote-secret \
  --context=${CTX3} \
  --name=${CLUSTER3} | \
  kubectl apply -f - --context=${CTX1}