1
1
---
2
2
title : Introducing multicluster support for ambient mode (alpha)
3
- description : Introducing multicluster support for ambient mode (alpha) .
3
+ description : Istio 1.27 adds alpha ambient multicluster support, extending ambient's familiar lightweight, modular architecture to deliver secure connectivity, discovery and load balancing across clusters .
4
4
date : 2025-08-04
5
5
attribution : Jackie Maertens (Microsoft), Keith Mattix (Microsoft), Mikhail Krinkin (Microsoft), Steven Jin (Microsoft)
6
6
keywords : [ambient,multicluster]
@@ -21,26 +21,26 @@ IP address spaces of different clusters might overlap,
21
21
and even without overlap, the underlying infrastructure would need configuration to route cross-cluster traffic.
22
22
23
23
Cross-cluster connectivity also presents security challenges.
24
- Pod-to-pod traffic will traverse cluster boundaries and pods will accept connections from outside the cluster.
24
+ Pod-to-pod traffic will leave cluster boundaries and pods will accept connections from outside their cluster.
25
25
Without identity verification at the edge of the cluster and strong encryption,
26
26
an outside attacker could exploit a vulnerable pod or intercept unencrypted traffic.
27
27
28
28
A multicluster solution must securely connect clusters and do so
29
- through simple, declarative APIs that keep pace with dynamic environments.
29
+ through simple, declarative APIs that keep pace with dynamic environments where clusters are frequently added and removed .
30
30
31
31
## Key Components
32
32
33
33
Ambient multicluster extends ambient with new components and minimal APIs to
34
34
securely connect clusters using ambient's lightweight, modular architecture.
35
- It builds on the namespace sameness model -- a service in namespace ` foo ` in one cluster is treated as the same logical service as ` foo ` in another --
35
+ It builds on the {{< gloss " namespace sameness" >}} namespace sameness{{< /gloss >}} model
36
36
so services keep their existing DNS names across clusters, allowing you to control cross-cluster communication without changing application code.
37
37
38
38
### East-West Gateways
39
39
40
40
Each cluster has an east-west gateway with a globally routable IP acting as an entry point for cross-cluster communication.
41
41
A ztunnel connects to the remote cluster's east-west gateway, identifying the destination service by its namespaced name.
42
- The gateway then load balances the connection to a local pod.
43
- Using the gateway’ s routable IP removes the need for inter-cluster routing configuration,
42
+ The east-west gateway then load balances the connection to a local pod.
43
+ Using the east-west gateway' s routable IP removes the need for inter-cluster routing configuration,
44
44
and addressing pods by namespaced name rather than IP eliminates issues with overlapping IP spaces.
45
45
Together, these design choices enable cross-cluster connectivity without changing cluster networking or restarting workloads,
46
46
even as clusters are added or removed.
@@ -75,10 +75,10 @@ serviceScopeConfigs:
75
75
{{< /text >}}
76
76
77
77
meaning that any service with the ` istio.io/global=true ` label is global.
78
- Although the default value is straightforward, the API is flexible and can express complex conditions using a mix of ANDs and ORs.
78
+ Although the default value is straightforward, the ` ServiceScope ` API can express complex conditions using a mix of ANDs and ORs.
79
79
80
80
By default, ztunnel load balances traffic uniformly across all endpoints --even remote ones--,
81
- but is configurable through the service's ` trafficDistribution ` field to only cross cluster boundaries when there are no local endpoints.
81
+ but this is configurable through the service's ` trafficDistribution ` field to only cross cluster boundaries when there are no local endpoints.
82
82
Thus, users have control over whether and when traffic crosses cluster boundaries with no changes to application code.
83
83
84
84
## Limitations and Roadmap
0 commit comments