We have two cloud clusters in different regions, each running the same applications and a global proxy. External requests need custom handling at the proxy. If the proxy in one region is down, how can the other region's proxy reach the intended services there directly?
We're using Cilium. Is a service mesh the usual way to do this?
You don't necessarily need a mesh just to get traffic across. First make sure the clusters have network connectivity and that the proxy in region A can reach the service endpoints you expose in region B. Then you need service discovery for those endpoints and policies that permit the traffic.
The details depend on how the cloud networks and Cilium are configured. Check address overlap, routing, firewall rules and NetworkPolicy, and decide how the proxy will find healthy endpoints when they change. Also make sure this path doesn't depend on region B's global proxy, since that's the component you're trying to bypass.
Cilium's multi-cluster capabilities are worth investigating since you're already using it. Check whether the connectivity and service discovery model fits your setup, particularly across regions. Don't assume that installing it alone makes every service reachable or handles the proxy failure case you described.
Istio has a multi-cluster model, and a service mesh can help with cross-cluster routing. The tradeoff is configuration and operational complexity, plus making sure it works with your networking setup.
I'd compare that against the amount of discovery, routing and failure handling you'd otherwise have to build into the proxy. A mesh may be useful if those needs extend beyond this one path, but it isn't automatically the simplest answer.
Could a load balancer in front of both clusters handle the regional routing? That might be simpler if it can make the decision from the request and reach the right backend.
Answers are reviewed before publication.
Snavvy:
The proxy needs custom handlers based on the request, so the load balancer would still need to send traffic to it. The tricky part is reaching region B's services when its proxy is down.