Benefits of Cluster Mesh for Multi-cluster Connectivity: CCA practice questions

Organizations run several Kubernetes clusters for fault isolation, scale and geography, and that brings networking problems: workloads need to find and reach each other across clusters, and policy has to be enforced consistently. Cluster Mesh extends Cilium networking across clusters and provides pod-to-pod connectivity in a flat IP address space, cluster-aware network policy, cross-cluster service discovery and load balancing, and affinity controls that prefer local or remote backends.

The design keeps the data path simple. Each cluster runs clustermesh-apiserver pods that form a per-cluster control plane. The apiserver container copies local Cilium and Kubernetes state into an embedded etcd, which remote clusters read over mutual TLS, usually through a LoadBalancer or NodePort Service, and the kvstoremesh container pulls remote state into the local cluster. Agents combine local and remote state to program the datapath, and pod traffic then flows directly from node to node across cluster boundaries, with no gateway or extra proxy in between.

Getting there requires a few things. All clusters must use the same datapath mode, Cilium versions may differ by at most one minor release, pod CIDRs must not overlap, and nodes need IP connectivity on their InternalIP addresses. In native routing mode the native routing CIDR of each cluster must cover the pod ranges of all clusters. Every cluster gets a unique name of up to 32 characters and a numeric ID from 1 to 255, best set at installation: the ID is part of security identities, so changing it later means restarting all workloads. By default up to 255 clusters can be connected; maxConnectedClusters raises that to 511 at the cost of fewer cluster-local identities.

With the Cilium CLI, cilium clustermesh enable deploys the clustermesh-apiserver and its certificates in each cluster, and a single cilium clustermesh connect, run in one direction, links two clusters both ways. cilium clustermesh status --wait reports readiness, and cilium connectivity test with the multi-cluster option checks traffic.

Because identity is decoupled from addresses, policy enforcement spans clusters, but policies themselves are not copied, so each cluster needs its own. Since Cilium 1.19 a policy only selects endpoints in the local cluster unless it names clusters with the io.cilium.k8s.policy.cluster label. All meshed clusters form a single trust domain, so only clusters with equivalent security posture should be connected. Mutual authentication and ztunnel encryption cannot currently be combined with Cluster Mesh, while WireGuard and IPsec can.