Establishing mutual trust in multi-cluster deployments

When setting up multi-cluster deployments, we must also establish trust between the clusters. The Istio architecture is based on the zero-trust model, where the network is assumed to be hostile and there is no implicit trust for services. Thus, Istio authenticates each service communication to establish the authenticity of the workload. Every workload in the cluster is assigned an identity and service-to-service communication is performed over mTLS by sidecars. Also, all communication between the sidecar and control plane happens over mTLS. In the previous chapters, we used an Istio CA with a self-signed root certificate. When setting up multi-clusters, we must ensure that the workload is assigned identities that can be understood and trusted by all other services in the mesh. Istio does this by distributing a CA bundle to all workloads, which contains a chain of certificates that can then be used by sidecars to identify the sidecar...