What would be a secure way to configure the connection between several Pulsar clusters running in separate physical datacenters, and to make them constitute a logical Pulsar instance? Are there any guides for that?

Is the goal to have a single authentication provider that grants access to users across the various clusters in different DCs? Would you be able to link the clusters to a single, shared configuration store, e.g. Zookeeper that holds the cluster details?

The goal is to have a single Pulsar Instance that stands from multiple Pulsar clusters running in multiple datacenters. Clients would connect to the local Pulsar cluster in each datacenter and produce/consume messages. Clusters should replicate messages between themselves (between the datacenters) in an eventual consistent fashion. So asynchronous replication is enough. What I don't yet know is how should these Pulsar clusters communicate between each other, so that the replication communication is secure.

Using Pulsar’s standard geo-replication mechanisms, along with failover-aware clients should get you what you are looking for. However, since the geo-replication will between DCs, then the traffic will go over the public internet (unless you have dedicated network links). Therefore, you will need to add authentication for all of the clusters and mTLS for the traffic if you want the data to be secured.