Hazelcast Cluster Client registration does not work when Istio's global.outboundTrafficPolicy.mode is set to REGISTRY_ONLY

[safvankothawala]

I am using Istio version 1.2. In order to enable egress in Istio, I have set value of "global.outboundTrafficPolicy.mode" to REGISTRY_ONLY. Post this policy change, my Hazelcast clients are unable to connect to the Hazelcast cluster. I am getting IOException: Broken Pipe error. However, the Members are able to connect in a cluster.

Following is the snippet of hazelcast-client.xml

<network>
		<discovery-strategies>
			<discovery-strategy enabled="true"
				class="com.hazelcast.kubernetes.HazelcastKubernetesDiscoveryStrategy">
				<properties>
					<!-- configure discovery service API lookup -->
					<property name="service-name">hazelcast</property>
					<property name="namespace">default</property>
				</properties>
			</discovery-strategy>
		</discovery-strategies>
		<smart-routing>true</smart-routing>
		<redo-operation>true</redo-operation>
		<connection-timeout>90000</connection-timeout>
		<connection-attempt-period>100</connection-attempt-period>
		<connection-attempt-limit>0</connection-attempt-limit>
	</network>

Following is the snippet of hazelcast.xml

<join>
<kubernetes enabled="true">
        <namespace>default</namespace>
        <service-name>hazelcast</service-name>
</kubernetes>
</join>

It seems that clients are trying to connect to Hazelcast member using the Member Pod's IP address and hence they are not able to connect.

[mesutcelik]

Hi @safvankothawala , Can you reproduce it with this sample? https://github.com/hazelcast-guides/hazelcast-istio#hazelcast-client-server