Service Discovery and Load Balancing Across Clusters: CCA practice questions

Once clusters are connected, Cilium offers two ways to make a Service reachable across them. Global Services are a Cilium feature driven by annotations. The Multi-Cluster Services API (MCS-API) is the Kubernetes SIG Multicluster standard built on ServiceExport and ServiceImport, with status conditions and a clusterset.local DNS domain that Cilium can configure in CoreDNS. The documentation suggests MCS-API when you want a standard with higher-level features, and Global Services when you want to use Cilium annotations directly, keep different Service properties in each cluster, or control precisely how backends are shared. Both can be used together.

A Global Service is a Service with the same name and namespace in every cluster, annotated with service.cilium.io/global: "true". Cilium then load-balances requests to backends in all clusters. A global service implicitly shares its local backends; setting service.cilium.io/shared: "false" in one cluster keeps that cluster consuming remote backends while hiding its own, so its clients still reach every cluster but clients elsewhere no longer reach it.

Affinity adds preference instead of exclusion. service.cilium.io/affinity accepts none, the default, local or remote. With local, a cluster uses its healthy local backends and turns to remote ones only when no local backend is available, which keeps traffic close and still fails over. With remote, the preference is reversed. Inside an agent pod, cilium-dbg service list --clustermesh-affinity marks the preferred backends. With MCS-API the same annotation is passed through the exportedAnnotations field of the ServiceExport.

A few behaviours matter in operation. If a remote cluster becomes unreachable, Cilium keeps the last known backend data, so requests may still be sent to stale endpoints. clustermesh.cacheTTL defaults to 0s, which never revokes; a value such as 15m removes the cached backends of a cluster that stays disconnected and restores them when it returns. Global NodePort Services only use remote backends when Cilium replaces kube-proxy, and the same holds for access from nodes or host-network pods unless socket load balancing is enabled in the host namespace; otherwise just local backends are eligible.

Cilium does not create EndpointSlices for remote backends of a regular global service by default. Tools outside Cilium, such as DNS servers or a third-party ingress controller, can be given them with the annotation service.cilium.io/global-sync-endpoint-slices: "true" and the beta feature flag clustermesh.enableEndpointSliceSynchronization. Headless global services synchronize by default, and features of Cilium itself, including its ingress controller, work without this.