// Module included in the following assemblies:
//
// * security/zero_trust_workload_identity_manager/zero-trust-manager-mesh-integration-multi-cluster.adoc.

:_mod-docs-content-type: CONCEPT
[id="zero-trust-manager-multi-cluster-spire-mesh-about_{context}"]
= Multi-cluster {spire-full} integration with {SMProductName}

[role="_abstract"]
Understand how {spire-full} (SPIRE) federation integrates with multi-cluster {SMProductName}. Cross-cluster mutual TLS (mTLS) lets workloads on separate clusters authenticate each other under a unified zero-trust identity framework.

Multi-cluster SPIRE integration extends single-cluster SPIRE capabilities to enable workloads in different clusters to authenticate each other using {spiffe-full} identities. This eliminates the need for separate certificate authorities per cluster and enables true cross-cluster zero-trust architecture.

[id="what-gets-federated_{context}"]
== What gets federated

Federation happens at two layers, and both are required:

[cols="1,1,1",options="header"]
|===
| Layer
| What
| How

| SPIRE Federation
| Trust bundles
| SPIRE Servers exchange bundles via `https_spiffe` profile

| Istio Federation
| Service discovery and routing
| `Istiod` discovers remote endpoints via remote secrets, routes traffic through east-west gateways

|===

