<p>We are running hazelcast in embedded mode and the application is running in kubernetes cluster. We are using Kubernetes API for discovery. </p>

<p>It was all working fine and now we just started using <code>envoy</code> as sidecar for SSL. Now for both <code>inbound</code> and <code>outbound</code> on TCP at <code>hazelcast</code> port <code>5701</code> we have enabled TLS in envoy but are yet to do changes for kubernetes API call. </p>

<p>Right now we are getting below Exception :</p>

<blockquote>
  <p>"class":"com.hazelcast.internal.cluster.impl.DiscoveryJoiner","thread_name":"main","type":"log","data_version":2,"description":"[10.22.69.149]:5701
  [dev] [3.9.4] Operation: [get]  for kind: [Endpoints]  with name:
  [servicename]  in namespace: [namespace] 
  failed.","stack_trace":"j.n.ssl.SSLException: Unrecognized SSL
  message, plaintext connection?\n\tat
  s.s.ssl.InputRecord.handleUnknownRecord(InputRecord.java:710)\n\tat
  s.s.ssl.InputRecord.read(InputRecord.java:527)\n\tat
  s.s.s.SSLSocketImpl.readRecord(SSLSocketImpl.java:975)\n\tat
  s.s.s.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367)\n\tat
  s.s.s.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395)\n\tat
  s.s.s.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379)\n\tat
  o.i.c.RealConnection.connectTls(RealConnection.java:281)\n\tat
  o.i.c.RealConnection.establishProtocol(RealConnection.java:251)\n\tat
  o.i.c.RealConnection.connect(RealConnection.java:151)\n\tat</p>
</blockquote>

<p>Can someone help with the overall changes which should be needed for Hazelcast k8s discovery using APIs with envoy as sidecar ?</p>

<p>You can find an example config below for how to deploy Hazelcast with Envoy sidecar and use it with mTLS. </p>

<p><a href="https://github.com/hazelcast/hazelcast-kubernetes/issues/118#issuecomment-553588983" rel="nofollow noreferrer">https://github.com/hazelcast/hazelcast-kubernetes/issues/118#issuecomment-553588983</a></p>

<p>If you want to achieve the same with an embedded architecture, you need to create a headless kubernetes service besides your microservice's kubernetes service. Then you need to give headless service name to hazelcast-kubernetes plugin <strong>service-name</strong> parameter.</p>

<p>You can find more info on hazelcast-kubernetes plugin <a href="https://github.com/hazelcast/hazelcast-kubernetes/blob/master/README.md" rel="nofollow noreferrer">README.md</a> file. </p>

<p><strong>EDIT:</strong>
Hazelcast-Istio-SpringBoot step-by-step guide can be found <a href="https://github.com/hazelcast-guides/hazelcast-istio" rel="nofollow noreferrer">here</a>. </p>
