// Module included in the following assemblies:
//
// * security/zero_trust_workload_identity_manager/zero-trust-manager-mesh-integration-multi-cluster.adoc.

:_mod-docs-content-type: PROCEDURE
[id="zero-trust-manager-prepare-spire-multi-cluster_{context}"]
= Preparing the environment for multi-cluster {spire-full} federation

[role="_abstract"]
Export kubeconfig paths, trust domains, federation endpoints, and JWT issuer URLs for Cluster A and Cluster B before you deploy federated {spire-full} (SPIRE) operands on both clusters.

.Prerequisites

* You have two {product-title} clusters (4.x) with network connectivity between them.
* You have installed {zero-trust-full} on both clusters.
* The {oc-first} is configured with access to both clusters.
* You have installed the `istioctl` CLI tool.
* You have installed `helm`. This is used for gateway deployment.
* You have Istio version 1.29.2 or later.

.Procedure

. Export the namespace variables by running the following commands:
+
[source,terminal]
----
$ export ZTWIM_NS=zero-trust-workload-identity-manager
----
+
[source,terminal]
----
$ export OSSM_NS=istio-system
----
+
[source,terminal]
----
$ export OSSM_CNI=istio-cni
----

. Export the kubeconfig file paths for Cluster A and Cluster B by running the following commands:
+
[source,terminal]
----
$ export CLUSTER_A_KUBECONFIG="/path/to/cluster-a/kubeconfig"
----
+
[source,terminal]
----
$ export CLUSTER_B_KUBECONFIG="/path/to/cluster-b/kubeconfig"
----

. Set the base domain environment variables for Cluster A and Cluster B by running the following commands:
+
[source,terminal]
----
$ export CLUSTER_A_BASE_DOMAIN=$(oc get ingresses.config/cluster \
  -o jsonpath='{.spec.domain}' --kubeconfig "${CLUSTER_A_KUBECONFIG}")
----
+
[source,terminal]
----
$ export CLUSTER_B_BASE_DOMAIN=$(oc get ingresses.config/cluster \
  -o jsonpath='{.spec.domain}' --kubeconfig "${CLUSTER_B_KUBECONFIG}")
----

. Export the trust domain environment variables from the base domain of each cluster by running the following commands:
+
[source,terminal]
----
$ export CLUSTER_A_TRUST_DOMAIN="${CLUSTER_A_BASE_DOMAIN}"
----
+
[source,terminal]
----
$ export CLUSTER_B_TRUST_DOMAIN="${CLUSTER_B_BASE_DOMAIN}"
----

. Define the cluster and network environment variables by running the following commands:
+
[source,terminal]
----
$ export CLUSTER_A=cluster-a
----
+
[source,terminal]
----
$ export CLUSTER_B=cluster-b
----
+
[source,terminal]
----
$ export NETWORK_A=network-a
----
+
[source,terminal]
----
$ export NETWORK_B=network-b
----

. Export the federation endpoint URLs for Cluster A and Cluster B by running the following commands:
+
[source,terminal]
----
$ export FEDERATION_ENDPOINT_A="https://federation.${CLUSTER_A_BASE_DOMAIN}"
----
+
[source,terminal]
----
$ export FEDERATION_ENDPOINT_B="https://federation.${CLUSTER_B_BASE_DOMAIN}"
----

. Set the JWT issuer environment variables for Cluster A and Cluster B by running the following commands:
+
[source,terminal]
----
$ export JWT_ISSUER_A="https://oidc-discovery.${CLUSTER_A_BASE_DOMAIN}"
----
+
[source,terminal]
----
$ export JWT_ISSUER_B="https://oidc-discovery.${CLUSTER_B_BASE_DOMAIN}"
----

