<p>The scenario:</p>

<p>I have two K8s clusters. One is on-prem, the other is hosted in AWS. I could use Istio to make communication painless and do things like balloon capacity in AWS, but I'm getting hung up on trying to connect them. Reading the documentation, it looks like I need a VPN deployed inside of K8s if I want to have encrypted tunnels so that each internal network can talk to the other side. They're both non-overlapping 10-dots so I have that part done. </p>

<p>Is that correct or am I missing something on how to connect the two K8s clusters? </p>

<p>Having Istio in your cluster is independent of setting up basic communication in between your two clusters. There are a few options that I can think of here:</p>

<ol>
<li>VPN between some nodes in both clusters like you mentioned.</li>
<li>BGP peering with <a href="https://docs.projectcalico.org/v3.2/usage/configuration/bgp" rel="nofollow noreferrer">Calico</a> and your existing infrastructure.</li>
<li>A router in between your two clusters that understand the internal cluster IPs (This could be with BGP or static routes)</li>
<li><a href="https://kubernetes.io/docs/concepts/cluster-administration/federation/" rel="nofollow noreferrer">Kubernetes Federation</a>. V1 is in alpha and V2 is in the implementation phase as of this writing. Not prod ready yet IMO. </li>
</ol>
