Enable multi-cluster communication for custom domain suffix

istio-multicluster-config.yaml

---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: istio-multicluster-customsuffix
  namespace: istio-system
  labels:
    release: istio
spec:
   workloadLabels:
     istio: ingressgateway
   filters:
   - listenerMatch:
       portNumber: 15443
       listenerType: GATEWAY
     insertPosition:
       index: AFTER
       relativeTo: envoy.filters.network.sni_cluster
     filterName: envoy.filters.network.tcp_cluster_rewrite
     filterType: NETWORK
     filterConfig:
       cluster_pattern: "\\.customsuffix$"
       cluster_replacement: ".svc.cluster.local"
---
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-multicluster-customsuffix
  namespace: istio-system
  labels:
    release: istio
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - "*.customsuffix"
    port:
      name: tls
      number: 15443
      protocol: TLS
    tls:
      mode: AUTO_PASSTHROUGH
---
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: istio-multicluster-customsuffix
  namespace: istio-system
  labels:
    release: istio
spec:
  host: "*.customsuffix"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---

Steps

Make sure to replace `customsuffix` with `yoursuffix` in each of these steps.

1. Point k8s cluster DNS (kube-dns or coredns) to resolve `customsuffix` using istiocoredns
a. Get the cluster ip for istiocoredns
kubectl get svc istiocoredns -n istio-system -o jsonpath='{.spec.clusterIP}'
b. Edit the kube-dns or coredns cm for the k8s cluster to point to cluster ip obtained in a).
You can use this [script](https://github.intuit.com/services-mesh/admiral/blob/master/install/scripts/redirect-dns.sh) as reference:
2. Configure istiocoredns to resolve entries ending in `customsuffix` (any serviceentry created with host=someservice.somenamespace.customsuffix are resolvable using istiocoredns)
Run the following command and copy the block below into the config map.
`kubectl edit cm coredns -n istio-system`
```
proxy customsuffix 127.0.0.1:8053 {
  protocol grpc insecure
}
```
3. Add envoy filter to translate `customsuffix` to `svc.cluster.local` on the ingressgateway
4. Create istio Gateway in order for ingressgateway to accept traffic for hosts ending in `customsuffix`
5. Add a destination rule to use mTLS for hosts ending in `customsuffix`

For steps 3, 4 & 5, download and apply the yaml below after replacing `customsuffix` with `yoursuffix`
kubectl apply -f istio-multicluster-config.yaml