Advanced Mesh & Multi-Cluster

Multi-cluster mesh

Large orgs run multiple K8s clusters (per region, per env, per tenant). Istio can federate:

• Primary-remote — control plane in one cluster
• Multi-primary — control plane per cluster, shared trust

East-west gateway

Cross-cluster service traffic flows through dedicated east-west gateway — mTLS between clusters, not flat network.

Trust domains

SPIFFE trust domain per cluster; federation exchanges root CAs so identities validate cross-cluster.

Upgrade strategy

Mesh control plane upgrades affect entire fleet:

1. Canary control plane
2. Rev proxy / data plane rolling update
3. Validate proxy version skew tolerance

Performance considerations

Extra hop through sidecar + cross-cluster gateway adds latency. Measure p99 east-west before mandating mesh on hot paths.

When to stop

< 20 services, single cluster — multi-cluster mesh is premature optimization.

Cross-reference: Service Mesh core topics; Multi-Region for regional cluster layout.