We're using istio multicluster, and have connected together two kubernetes clusters.

We want to have some pods that are able to use the mesh to access services located on the other cluster, however we also want this pods to have access to the apiserver of the cluster they're running on.

Currently the connections to the apiserver from those pods are being load balanced across both clusters, which doesn't work (different CA, permissioning etc)

How do we configure the kubernetes.default service in Istio so that traffic is routed only to the local cluster?

I've tried using this:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: apiserver
  namespace: istio-test
spec:
  hosts:
  - kubernetes.default.svc.cluster.local
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  resolution: NONE
  location: MESH_EXTERNAL

But it doesn't seem to have any effect

This is using istio 1.1.0.snapshot.0