Skip to content

Commit ce78f97

Browse files
committed
Description and minor fixups
1 parent cb8d901 commit ce78f97

File tree

1 file changed

+8
-8
lines changed
  • content/en/blog/2025/ambient-multicluster

1 file changed

+8
-8
lines changed

content/en/blog/2025/ambient-multicluster/index.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Introducing multicluster support for ambient mode (alpha)
3-
description: Introducing multicluster support for ambient mode (alpha).
3+
description: Istio 1.27 adds alpha ambient multicluster support, extending ambient's familiar lightweight, modular architecture to deliver secure connectivity, discovery and load balancing across clusters.
44
date: 2025-08-04
55
attribution: Jackie Maertens (Microsoft), Keith Mattix (Microsoft), Mikhail Krinkin (Microsoft), Steven Jin (Microsoft)
66
keywords: [ambient,multicluster]
@@ -21,26 +21,26 @@ IP address spaces of different clusters might overlap,
2121
and even without overlap, the underlying infrastructure would need configuration to route cross-cluster traffic.
2222

2323
Cross-cluster connectivity also presents security challenges.
24-
Pod-to-pod traffic will traverse cluster boundaries and pods will accept connections from outside the cluster.
24+
Pod-to-pod traffic will leave cluster boundaries and pods will accept connections from outside their cluster.
2525
Without identity verification at the edge of the cluster and strong encryption,
2626
an outside attacker could exploit a vulnerable pod or intercept unencrypted traffic.
2727

2828
A multicluster solution must securely connect clusters and do so
29-
through simple, declarative APIs that keep pace with dynamic environments.
29+
through simple, declarative APIs that keep pace with dynamic environments where clusters are frequently added and removed.
3030

3131
## Key Components
3232

3333
Ambient multicluster extends ambient with new components and minimal APIs to
3434
securely connect clusters using ambient's lightweight, modular architecture.
35-
It builds on the namespace sameness model -- a service in namespace `foo` in one cluster is treated as the same logical service as `foo` in another --
35+
It builds on the {{< gloss "namespace sameness" >}}namespace sameness{{< /gloss >}} model
3636
so services keep their existing DNS names across clusters, allowing you to control cross-cluster communication without changing application code.
3737

3838
### East-West Gateways
3939

4040
Each cluster has an east-west gateway with a globally routable IP acting as an entry point for cross-cluster communication.
4141
A ztunnel connects to the remote cluster's east-west gateway, identifying the destination service by its namespaced name.
42-
The gateway then load balances the connection to a local pod.
43-
Using the gateways routable IP removes the need for inter-cluster routing configuration,
42+
The east-west gateway then load balances the connection to a local pod.
43+
Using the east-west gateway's routable IP removes the need for inter-cluster routing configuration,
4444
and addressing pods by namespaced name rather than IP eliminates issues with overlapping IP spaces.
4545
Together, these design choices enable cross-cluster connectivity without changing cluster networking or restarting workloads,
4646
even as clusters are added or removed.
@@ -75,10 +75,10 @@ serviceScopeConfigs:
7575
{{< /text >}}
7676

7777
meaning that any service with the `istio.io/global=true` label is global.
78-
Although the default value is straightforward, the API is flexible and can express complex conditions using a mix of ANDs and ORs.
78+
Although the default value is straightforward, the `ServiceScope` API can express complex conditions using a mix of ANDs and ORs.
7979

8080
By default, ztunnel load balances traffic uniformly across all endpoints --even remote ones--,
81-
but is configurable through the service's `trafficDistribution` field to only cross cluster boundaries when there are no local endpoints.
81+
but this is configurable through the service's `trafficDistribution` field to only cross cluster boundaries when there are no local endpoints.
8282
Thus, users have control over whether and when traffic crosses cluster boundaries with no changes to application code.
8383

8484
## Limitations and Roadmap

0 commit comments

Comments
 (0)