In our setup, there are two separate kubernetes clusters in virtual private clouds, High and Low. These clusters run the same services, but with different data. No connections can be established from Low to High. All traffic leaving the High cluster must go through a firewall proxy inspecting the contents; connections that cannot be decrypted are dropped. Services in High need to access services in Low. Using normal TLS connections from High to Low is no issue, as long as the proxy’s certificate is trusted in both High and Low.
We’d like to join the two separate clusters into a single service mesh, like linkerd, as documented in Multi-cluster communication | Linkerd, ideally as a flat network. However, we are unsure if this is possible because of the firewall and if so, how linkerd should be configured.
Currently we see these two options:
- Disable mTLS altogether for all services in both clusters.
- Use two separate services meshes in High and in Low, essentially removing all benefits from having a single service mesh.
Are there any more? Do you have any other suggestions? If the required features would be covered by Linkerd Enterprise (I am unsure when reading the documentation on Security policy automation | Buoyant Enterprise for Linkerd), that would be fine.