<p>I have an interesting problem, maybe you could help me out.</p>
<p>There are given <em>two spring applications</em>, called app1 and app2. There is plenty of REST calls are happening to both of the services. I need to implement a <em>security solution</em> where both of them can communicate with each other on REST but it is protected by <em>mutual TLS</em> (mTLS where both app has its own cert for each other)</p>
<p>Implementing it the standard way its not that hard, Spring has solutions for it (with keystores and etc.), but the twist is, I have to create it in a <strong>Kubernetes</strong> environment.
The two app is not in the same cluster, so app1 is in our cluster but app2 deployed in one of our partner's system.<br />
I am pretty new to k8s and not sure what is the best method to achieve this. Should I store the certs or the keystore(s) as secrets? Use and configure <em>nginx</em> ingress somehow, maybe <em>Istio</em> would be useful? I would really  want to find the optimal solution but I don't know the right way.
I would really like if I could configure it outside my app and let k8s take care about it but I am not sure if it is the right thing to do.</p>
<p>Any help would be really appreciated, some guidance to find the right path or some kind of real life examples.<br />
Thank you for your help!</p>

<p>Mikolaj has probably covered everything but still let me add my cent</p>
<p>i don't have much experience working with <strong>Istio</strong>, however i would also suggest checking out the <strong>Linkerd</strong> <a href="https://linkerd.io/" rel="nofollow noreferrer">service mesh</a>.</p>
<p>Step 1.</p>
<p>Considering if you are on multi could GKE &amp; EKS or so still it will work.</p>
<p><a href="https://linkerd.io/2.10/tasks/multicluster/" rel="nofollow noreferrer">Multicluster guide</a> details and installation details</p>
<p>Linkerd will use the <strong>Trust anchor</strong> between the cluster so traffic can flow encrypted and not get open to the public internet.</p>
<p>You have to generate the <strong>certificate</strong> which will form a common base of trust between clusters.</p>
<p>Each proxy will get copy of the certificate and use it for validation.</p>
