<p>While trying to configure Repilicated Control Planes as described in this guide:
<a href="https://istio.io/latest/docs/setup/install/multicluster/gateways/" rel="nofollow noreferrer">https://istio.io/latest/docs/setup/install/multicluster/gateways/</a></p>
<p>After doing all the configuration the &quot;sleep&quot; application is unable to communicate with &quot;httpbin&quot; application as described in the documentation. The result of the test is always the same about 503 Service Unavailable error:</p>
<pre><code>kubectl exec --context=kontiki $SLEEP_POD -n multi-test -c sleep -- curl -k -I httpbin.multi-test-bar.global:8000/headers
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0    91    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
HTTP/1.1 503 Service Unavailable
content-length: 91
content-type: text/plain
date: Wed, 07 Oct 2020 13:55:19 GMT
server: envoy
</code></pre>
<p>The relevant logs found are:</p>
<ol>
<li>istio-proxy container in sleep pod on origin cluster</li>
</ol>
<pre><code>[2020-10-07T13:58:21.775Z] &quot;HEAD /headers HTTP/1.1&quot; 503 UF,URX &quot;-&quot; &quot;-&quot; 0 0 137 - &quot;-&quot; &quot;curl/7.69.1&quot; &quot;5ccf05b7-d0e3-9e38-a581-8c0bdabc98b3&quot; &quot;httpbin.multi-t0&quot; &quot;10.14.10.99:31383&quot; outbound|8000||httpbin.multi-test-bar.global - 240.0.0.2:8000 172.17.141.20:59704 - default
</code></pre>
<ol start="2">
<li>ingress pods on destination cluster</li>
</ol>
<pre><code>[2020-10-07T13:58:21.900Z] &quot;- - -&quot; 0 NR &quot;-&quot; &quot;-&quot; 0 0 0 - &quot;-&quot; &quot;-&quot; &quot;-&quot; &quot;-&quot; &quot;-&quot; - - 172.17.184.60:15443 172.31.4.248:62395 - -
[2020-10-07T13:58:21.814Z] &quot;- - -&quot; 0 NR &quot;-&quot; &quot;-&quot; 0 0 0 - &quot;-&quot; &quot;-&quot; &quot;-&quot; &quot;-&quot; &quot;-&quot; - - 172.17.133.59:15443 172.31.4.209:38326 - -
</code></pre>
<p>Istio 1.7.3 is deployed with Istio-operator on vanilla k8s clusters with version 1.17. Certificates are configured as described in the referenced guide, ServiceEntry created for httpbin is the following:</p>
<pre><code>apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: httpbin-multi-test-bar
spec:
  hosts:
  - httpbin.multi-test-bar.global
  location: MESH_INTERNAL
  ports:
  - name: http1
    number: 8000
    protocol: http
  resolution: DNS
  addresses:
  - 240.0.0.2
  endpoints:
  - address: cluster-2
    network: external
    ports:
      http1: 31383 # nodePort tls exposed port via our proxy
  - address: istio-egressgateway.istio-system.svc.cluster.local
    ports:
      http1: 15443
</code></pre>
<p>This error is also referenced in this <a href="https://github.com/istio/istio/issues/25077" rel="nofollow noreferrer">#Issue</a> where for other people, this very same thing was happening and the way they fixed it was to moving to a previous Istio version like 1.6.8.
edit: I can confirm that my configuration works with version 1.6.8, but it fails with 1.7.3.</p>
<p>Can you please help me understand what's happening or how could it be fixed?</p>

carrotcakeslayer
<p>There are more issues reported with that specific issue:</p>
<ul>
<li><a href="https://github.com/istio/istio/issues/26990" rel="nofollow noreferrer">https://github.com/istio/istio/issues/26990</a></li>
<li><a href="https://discuss.istio.io/t/getting-503-for-multi-cluster-replicated-control-plane/7336" rel="nofollow noreferrer">https://discuss.istio.io/t/getting-503-for-multi-cluster-replicated-control-plane/7336</a></li>
</ul>
<p>and there is no answer so far about how to fix it.</p>
<p>I would suggest to wait for the answer from istio devs in the <a href="https://github.com/istio/istio/issues/25077" rel="nofollow noreferrer">issue</a> you mentioned and use 1.6.8 untill that will be solved.</p>
<hr />
<p>The issue itself might be related to <a href="https://preliminary.istio.io/latest/docs/ops/deployment/deployment-models/#dns-with-multiple-clusters" rel="nofollow noreferrer">dns changes</a> in 1.8, but these are just my thoughts.</p>
<blockquote>
<p>Starting with Istio 1.8, the Istio agent on the sidecar will ship with a caching DNS proxy, programmed dynamically by Istiod.</p>
</blockquote>
<p>There are more informations about dns changes:</p>
<ul>
<li><a href="https://preliminary.istio.io/latest/blog/2020/dns-proxy/" rel="nofollow noreferrer">https://preliminary.istio.io/latest/blog/2020/dns-proxy/</a></li>
<li><a href="https://preliminary.istio.io/latest/docs/ops/deployment/deployment-models/#dns-with-multiple-clusters" rel="nofollow noreferrer">https://preliminary.istio.io/latest/docs/ops/deployment/deployment-models/#dns-with-multiple-clusters</a></li>
<li><a href="https://github.com/istio-ecosystem/istio-coredns-plugin" rel="nofollow noreferrer">https://github.com/istio-ecosystem/istio-coredns-plugin</a></li>
</ul>
<p>And there are preliminary <a href="https://preliminary.istio.io/latest/docs/setup/install/multicluster/" rel="nofollow noreferrer">docs</a> for 1.8 multi cluster installation.</p>
