se with limited organizational capability and domain
expertise.</p><h3 id=external-tcp-services-without-vips>External TCP services without VIPs</h3><p>It is not just the VMs in the mesh that suffer from the DNS issue. For
the sidecar to accurately distinguish traffic between two different
TCP services that are outside the mesh, the services must be on
different ports or they need to have a globally unique VIP, much like
the <code>clusterIP</code> assigned to Kubernetes services. But what if there is
no VIP?