For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Learn how Solo Enterprise for Istio extends ambient mesh across multiple Kubernetes clusters.

Solo Enterprise for Istio extends ambient mesh across multiple Kubernetes clusters by peering each cluster’s istiod control plane over mTLS-secured xDS, without requiring remote Kubernetes API access or shared kubeconfig secrets. Each cluster runs its own istiod and east-west gateway, and services are discoverable across clusters using global naming and routing.

Architecture

Shared root of trust

Every cluster in a multicluster mesh shares a common root CA. Each cluster’s istiod uses its own intermediate CA certificate signed by that root, so workload certificates across clusters chain to the same trust anchor. This allows ztunnel and waypoint proxies to verify cross-cluster identities without additional configuration.

Control plane peering

Clusters are linked by peering their istiod instances over mTLS-secured xDS connections through east-west gateways. No shared kubeconfig or remote Kubernetes API access is required. Each cluster retains full autonomy and continues to operate independently if the peer connection is interrupted.

East-west gateways

Cross-cluster data plane traffic flows over HBONE through dedicated east-west gateways, preserving the same mTLS guarantees as within a single cluster. Locality-aware load balancing prefers local endpoints when available and fails over to remote clusters automatically.

Global services

Services are explicitly exported for cross-cluster consumption. Exported services receive a stable <name>.<namespace>.mesh.internal hostname backed by the union of endpoints from all participating clusters.

Key capabilities

• Cross-cluster service discovery: Route traffic to services in remote clusters using global hostnames, with locality-aware load balancing to prefer local endpoints.
• Zero-trust data plane: Cross-cluster traffic is secured with mTLS over HBONE through east-west gateways, consistent with single-cluster ambient mesh.
• Flexible network topology: Supports both standard setups (separate cluster networks via east-west gateways) and flat networking for clusters that share a network.
• Multitenancy with segments: Isolate groups of namespaces into independent mesh segments with separate trust domains and routing boundaries.
• Extreme scale: Tested to 100 million pods across 2,000 clusters, with sub-100ms control plane propagation.

Installation

For full installation instructions, architecture diagrams, and advanced configuration options, see the multicluster documentation in the Solo Enterprise for Istio docs.