Implement connecting multiple clusters with isolation and boundary protection, as defined by major industry standards.

[vadimeisenbergibm]

Major industry standards require isolation and boundary protection:

• put an access control mechanism at the boundary (firewall, gateway, etc.)
• all the access control mechanisms must be deny-all by default
• do not expose private IP addresses from the isolated environment
• do not let components from outside the boundary to manage security inside the isolated environment

The three multi-cluster patterns as documented on istio.io do not provide isolation between clusters and their boundary protection.

A design document: https://docs.google.com/document/d/1jmOSRy8ZL1HOe5CLCSg_Ufw9UdhoCs9O4ysJcl2k6r4/edit#heading=h.7zgnj8bwqfld
A possible implementation: istio/istio.io#4776

[vadimeisenbergibm]

@smawson @costinm @louiscryan @sdake @frankbu @andraxylia @nmittler @ayj @linsun I have created an epic to define the activity related to connecting multiple clusters with isolation & boundary protection.

[smawson]

Awesome, thank you Vadim!