Add Primary on Same Network

#!/bin/bash

set -euo pipefail

HUB=gcr.io/istio-testing
TAG=latest
echo "HUB=${HUB}"
echo "TAG=${TAG}"

# Delete Istio in this cluster
kubectl delete ns istio-system sample --context=${CTX2} --ignore-not-found

# Update the first cluster
echo "Updating MeshNetworks in the first cluster..."
cat <<EOF> ${WORK_DIR}/${CLUSTER1}/install.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  values:
    global:
      meshID: ${MESH}
      multiCluster:
        clusterName: ${CLUSTER1}
      network: ${NETWORK1}

      # Map network names to endpoints and ingress.
      # This is not required for single-cluster meshes, but is
      # included here for completeness and consistency with other
      # examples.
      meshNetworks:
        ${NETWORK1}:
          endpoints:
          - fromRegistry: ${CLUSTER1}
          - fromRegistry: ${CLUSTER2}
          gateways:
          - registry_service_name: istio-ingressgateway.istio-system.svc.cluster.local
            port: 15443
EOF

istioctl --context=${CTX1} install -f \
    ${WORK_DIR}/${CLUSTER1}/install.yaml \
    --charts manifests \
    --set values.global.hub=${HUB} \
    --set values.global.tag=${TAG} \
    --set values.global.imagePullPolicy=Always

# Configure trust
echo "Configuring trust..."
kubectl create namespace istio-system --context=${CTX2}
kubectl create secret generic cacerts --context=${CTX2} \
        -n istio-system \
        --from-file=${ISTIO}/samples/certs/ca-cert.pem \
        --from-file=${ISTIO}/samples/certs/ca-key.pem \
        --from-file=${ISTIO}/samples/certs/root-cert.pem \
        --from-file=${ISTIO}/samples/certs/cert-chain.pem

# Install Istio
echo "Installing Istio on second primary cluster (on the same network)..."
mkdir -p ${WORK_DIR}/${CLUSTER2} && \
cat <<EOF> ${WORK_DIR}/${CLUSTER2}/install.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  values:
    global:
      meshID: ${MESH}
      multiCluster:
        clusterName: ${CLUSTER2}
      network: ${NETWORK1}

      # Map network names to endpoints and ingress.
      # This is not required for single-cluster meshes, but is
      # included here for completeness and consistency with other
      # examples.
      meshNetworks:
        ${NETWORK1}:
          endpoints:
          - fromRegistry: ${CLUSTER1}
          - fromRegistry: ${CLUSTER2}
          gateways:
          - registry_service_name: istio-ingressgateway.istio-system.svc.cluster.local
            port: 15443
EOF
istioctl --context=${CTX2} install -f \
    ${WORK_DIR}/${CLUSTER2}/install.yaml \
    --charts manifests \
    --set values.global.hub=${HUB} \
    --set values.global.tag=${TAG} \
    --set values.global.imagePullPolicy=Always

# Verify the installation
kubectl --context=${CTX2} -n istio-system get pod

# Configure cross-cluster LB
echo "Configuring cross-cluster load balancing..."
istioctl x create-remote-secret \
  --context=${CTX1} \
  --name=${CLUSTER1} | \
  kubectl apply -f - --context=${CTX2}
istioctl x create-remote-secret \
  --context=${CTX2} \
  --name=${CLUSTER2} | \
  kubectl apply -f - --context=${CTX1}