MultCluster Setup TLS Errors

[jnccneto]

Hello,

I am currently testing the MultiCluster setup following the documentation provided in the Istio website:

• Multi-Primary, Multi-Network Setup
• Certificate Management with Plugin CA Cert

I have set up two clusters, and on one of them (cluster1), I do not encounter any TLS errors. However, on the second cluster (cluster2), I am encountering the following TLS error:

error security Failed to authenticate client from 192.168.144.183:48018: Authenticator ClientCrtAuthenticator: no verified chain is found; Authenticator KubeJWTAuthenticator: could not get cluster cluster2's kube client

I have already applied the following configuration on cluster2 using the Istio operator:

values:
  global:
    meshID: mesh1
    multiCluster:
      clusterName: cluster2
    network: network2

I am unsure why this error is occurring. Is it attempting to reach itself (cluster2)? Or could it be related to cluster naming?

[jnccneto]

Follow up on this question, would the name of the clusters when we create the KubeConfig entries like mentioned in the documentation need to match what we write on the Mesh Config?

istioctl create-remote-secret
--context="${CTX_CLUSTER1}"
--name=cluster1 |
kubectl apply -f - --context="${CTX_CLUSTER2}"

[rootsongjc]

Check out this blog I wrote Deciphering Istio Multi-Cluster Authentication & mTLS Connection, which are primary-remote cluster, but the principle should be the same.

[jnccneto]

Thanks that gives more info on the topic
One question I still have is about onboarding / scaling
when we add a kubeconfig secret in istio-system namespace, that kubernetes clusters gets added to the Mesh? Or gets scanned and if the MeshID matches is added?