Connect a GKE-hosted app to a legacy REST service deployed in two regional GKE clusters with resilience, minimal steps, and probe-based health checks on a separate port. Choose two.

Traffic Director, combined with a sidecar proxy (like Envoy), provides a robust service mesh solution for connecting applications to services across multiple GKE clusters, offering resilience features like load balancing and health checks. The sidecar intercepts all outbound traffic from the application, including health checks, and routes it according to Traffic Director's configuration. Therefore, the firewall for the legacy service must be configured to permit health check traffic originating from these sidecar proxies. Proxyless Traffic Director is not suitable here because it requires specific gRPC or xDS-compliant clients, which is unlikely for a "legacy REST service." Allowing health checks from the application directly is incorrect because the sidecar proxy handles this traffic. Traffic Director's control plane does not directly originate health checks to the services; the sidecars do.