// Module included in the following assemblies:
//
// * security/zero_trust_workload_identity_manager/zero-trust-manager-mesh-integration-multi-cluster.adoc.

:_mod-docs-content-type: PROCEDURE
[id="zero-trust-manager-exchange-remote-secrets_{context}"]
= Exchanging remote secrets

[role="_abstract"]
Create remote secrets on both clusters so `Istiod` can discover services in the peer cluster and route cross-cluster traffic through the east-west gateways.

.Prerequisites

* You have deployed the east-west gateway, including the cross-network `Gateway` CR on both clusters. For more information, see "Deploying east-west gateways".
* The environment variables from the "Preparing the environment for multi-cluster {spire-full} federation" and "Deploying {spire-full} with federation on both clusters" procedures are set.
* The `istioctl` CLI is available and configured for both clusters.

.Procedure

. Create an Istio remote secret on Cluster A by running the following command:
+
[source,terminal]
----
$ istioctl create-remote-secret \
  --kubeconfig="${CLUSTER_A_KUBECONFIG}" \
  --name="${CLUSTER_A}" \
  --istioNamespace=istio-system | \
  oc apply --kubeconfig="${CLUSTER_B_KUBECONFIG}" -f -
----

. Create an Istio remote secret on Cluster B by running the following command:
+
[source,terminal]
----
$ istioctl create-remote-secret \
  --kubeconfig="${CLUSTER_B_KUBECONFIG}" \
  --name="${CLUSTER_B}" \
  --istioNamespace=istio-system | \
  oc apply --kubeconfig="${CLUSTER_A_KUBECONFIG}" -f -
----

. Verify that the remote cluster is synced on Cluster A by running the following command:
+
[source,terminal]
----
$ istioctl remote-clusters --kubeconfig="${CLUSTER_A_KUBECONFIG}"
----
+
The output must show `${CLUSTER_B}` with status `synced`.
+
.Example output
[source,text]
----
NAME         STATUS   SECRET
cluster-b    synced   istio-remote-secret-cluster-b
----

. Verify that the remote cluster is synced on Cluster B by running the following command:
+
[source,terminal]
----
$ istioctl remote-clusters --kubeconfig="${CLUSTER_B_KUBECONFIG}"
----
+
The output must show `${CLUSTER_A}` with status `synced`.
+
.Example output
[source,text]
----
NAME         STATUS   SECRET
cluster-a    synced   istio-remote-secret-cluster-a
----