<commit_before>---
title: VPN Connectivity
description: Install an Istio mesh across multiple Kubernetes clusters with direct network access to remote pods.
weight: 5
keywords: [kubernetes,multicluster,federation,vpn]
aliases:
    - /docs/setup/kubernetes/multicluster-install/vpn/
---

Follow this flow to install an Istio [multicluster service mesh](/docs/concepts/multicluster-deployments/)
where the Kubernetes cluster services and the applications in each cluster
have the capability to expose their internal Kubernetes network to other
clusters.

In this configuration, multiple Kubernetes control planes running
a remote configuration connect to a **single** Istio control plane.
Once one or more remote Kubernetes clusters are connected to the
Istio control plane, Envoy can then communicate with the **single**
control plane and form a mesh network across multiple clusters.

{{< image width="80%" link="./multicluster-with-vpn.svg" caption="Istio mesh spanning multiple Kubernetes clusters with direct network access to remote pods over VPN" >}}

## Prerequisites

* Two or more clusters running a supported Kubernetes version ({{< supported_kubernetes_versions >}}).

* The ability to deploy the [Istio control plane](/docs/setup/kubernetes/install/kubernetes/)
  on **one** of the clusters.

* A RFC1918 network, VPN, or an alternative more advanced network technique
  meeting the following requirements:

    * Individual cluster Pod CIDR ranges and service CIDR ranges must be unique
across the multicluster environment and may not overlap.

    * All pod CIDRs in every cluster must be routable to each other.

    * All Kubernetes control plane API servers must be routable to each other.

* Helm **2.7.2 or newer**.  The use of Tiller is optional.

This guide describes how to install a multicluster Istio topology using the
manifests and Helm charts provided within the Istio repository.

## Deploy the local control plane

Install the [Istio control plane](/docs/setup/kubernetes/install/kubernetes/#installation-steps)
on **one** Kubernetes cluster.

## Install the Istio remote

You must deploy the `istio-remote` component to each remote Kubernetes
cluster. You can install the component in one of two ways:

{{< tabset cookie-name="install-istio-remote" >}}

{{< tab name="Helm+kubectl" cookie-value="Helm+kubectl" >}}

1.  Use the following `helm template` command on the remote cluster to specify
    the Istio control plane service endpoints:

    {{< text bash >}}
    $ helm template install/kubernetes/helm/istio --namespace istio-system \
    --name istio-remote \
    --values install/kubernetes/helm/istio/values-istio-remote.yaml \
    --set global.remotePilotAddress=${PILOT_POD_IP} \
    --set global.remotePolicyAddress=${POLICY_POD_IP} \
    --set global.remoteTelemetryAddress=${TELEMETRY_POD_IP} > $HOME/istio-remote.yaml
    {{< /text >}}

1.  Create an `istio-system` namespace for remote Istio with the following<commit_msg>update required helm version. (#4352)<commit_after>---
title: VPN Connectivity
description: Install an Istio mesh across multiple Kubernetes clusters with direct network access to remote pods.
weight: 5
keywords: [kubernetes,multicluster,federation,vpn]
aliases:
    - /docs/setup/kubernetes/multicluster-install/vpn/
---

Follow this flow to install an Istio [multicluster service mesh](/docs/concepts/multicluster-deployments/)
where the Kubernetes cluster services and the applications in each cluster
have the capability to expose their internal Kubernetes network to other
clusters.

In this configuration, multiple Kubernetes control planes running
a remote configuration connect to a **single** Istio control plane.
Once one or more remote Kubernetes clusters are connected to the
Istio control plane, Envoy can then communicate with the **single**
control plane and form a mesh network across multiple clusters.

{{< image width="80%" link="./multicluster-with-vpn.svg" caption="Istio mesh spanning multiple Kubernetes clusters with direct network access to remote pods over VPN" >}}

## Prerequisites

* Two or more clusters running a supported Kubernetes version ({{< supported_kubernetes_versions >}}).

* The ability to deploy the [Istio control plane](/docs/setup/kubernetes/install/kubernetes/)
  on **one** of the clusters.

* A RFC1918 network, VPN, or an alternative more advanced network technique
  meeting the following requirements:

    * Individual cluster Pod CIDR ranges and service CIDR ranges must be unique
across the multicluster environment and may not overlap.

    * All pod CIDRs in every cluster must be routable to each other.

    * All Kubernetes control plane API servers must be routable to each other.

* Helm **2.10 or newer**.  The use of Tiller is optional.

This guide describes how to install a multicluster Istio topology using the
manifests and Helm charts provided within the Istio repository.

## Deploy the local control plane

Install the [Istio control plane](/docs/setup/kubernetes/install/kubernetes/#installation-steps)
on **one** Kubernetes cluster.

## Install the Istio remote

You must deploy the `istio-remote` component to each remote Kubernetes
cluster. You can install the component in one of two ways:

{{< tabset cookie-name="install-istio-remote" >}}

{{< tab name="Helm+kubectl" cookie-value="Helm+kubectl" >}}

1.  Use the following `helm template` command on the remote cluster to specify
    the Istio control plane service endpoints:

    {{< text bash >}}
    $ helm template install/kubernetes/helm/istio --namespace istio-system \
    --name istio-remote \
    --values install/kubernetes/helm/istio/values-istio-remote.yaml \
    --set global.remotePilotAddress=${PILOT_POD_IP} \
    --set global.remotePolicyAddress=${POLICY_POD_IP} \
    --set global.remoteTelemetryAddress=${TELEMETRY_POD_IP} > $HOME/istio-remote.yaml
    {{< /text >}}

1.  Create an `istio-system` namespace for remote Istio with the following
{'fraction_non_alphanumeric': 0.08208829947960383, 'fraction_numerical': 0.004700352526439483, 'mean_word_length': 4.491244239631336, 'pattern_counts': {'":': 0, '<': 15, '<?xml version=': 0, '>': 17, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2768213', 'n_tokens_mistral': 1670, 'n_tokens_neox': 1595, 'n_words': 669}