Ingress from 1 cluster to invoke service in another cluster

[manju-rn]

Can I directly call a service hosted in another cluster (say cluster master) from ingress in agent cluster, without having to define any native service in agent cluster?

I have the following setup:

• 2 K3S cluster setup in linkerd multicluster mode - v2.12.0.
• The Traefik (default from K3s) is the ingress controller in both clusters.
• linkerd multicluster link masterlink is setup from say - master to agent cluster -i.e any service in master marked as mirror is available in agent cluster.
• The link works fine if the call from service A in agent cluster calls the service B in master via the link like serviceb-masterlink
• However, if I do not have any service in agent cluster, but use the ingress in agent cluster to call the serviceb-masterlink. It does not work it shows mTLS error. I have tried marking the serverauthorization object as unauthenticated: true in both master and agent

[   814.451457s]  INFO ThreadId(01) inbound: linkerd_app_core::serve: Connection closed error=direct connections must be mutually authenticated error.sources=[direct connections must be mutually authenticated] client.addr=10.42.0.1:36334

The serverauthorization resource

apiVersion: policy.linkerd.io/v1beta1
kind: ServerAuthorization
metadata:
[...]
  labels:
    app: linkerd-gateway
    linkerd.io/extension: multicluster
  [...]
  name: linkerd-gateway
  namespace: linkerd-multicluster
   [...]
spec:
  client:
    networks:
      - cidr: 0.0.0.0/0
      - cidr: '::/0'
    unauthenticated: true
  server:
    name: linkerd-gateway

[mateiidavid]

When using linkerd-multicluster, we use a gateway that expects connections from other proxies (to ensure cross-cluster traffic is mTLS'd). It's worth pointing out, that the gateway itself does not implement the ingress or gateway API; it will not be aware of any ingress related resources. As a matter of fact, the gateway itself is just a linkerd-proxy instance. The port exposed in the service associated with the gateway is actually the proxy's inbound port.

When a service is mirrored (for example, from your main to your agent cluster), that service will have some additional metadata populated by Linkerd's service-mirror controller. This metadata, among other things, allows us to know the identity of the gateway, as well as the hostname of the original (i.e mirrored) service.

For this reason, only connections that go through the linkerd-proxy work with this set-up. A client proxy will send traffic directly to port 4191 (the proxy's inbound port) for the gateway. Connections will be mTLS'd here.

[manju-rn]

Thanks for the detailed explaination. I probably need to read carefully so that i understand the details. Some queries

1. I made the server authorization as unauthenticated, i was under the impression that this should allow non-mTLS traffic.
2. if i may paraphrase - calling a mTLS cross cluster service (via the mirror) is not directly possible from ingress resource. Am i correct?
   So, can i create a native service in agent which just has endpoints - that points to ip/dns to mirror service. My assumption is that since the native service (in same ns) that is injected it would encapsulate the traffic in mTLS and hence thereby still indirectly allowing traffic coming from ingress to pass thru