Migrate a single-cluster trust zone to multiple clusters

If you deployed a trust zone using Deploy Cofide SPIRE (single cluster) and it doesn’t have a TrustZoneServer record, follow this guide to configure the Cofide SPIRE server for multi-cluster support, then follow Add additional clusters to add additional clusters to the trust zone.

Configure the server cluster

Update the server cluster’s PSAT config to match what is required for a multi-cluster server cluster. With cofidectl:

cofidectl cluster update <your-server-cluster-name> \
  --trust-zone <your-trust-zone-name> \
  --psat-config '{"enabled":true,"allowed_service_accounts":["spire-system/spire-agent"]}'

With Terraform, update the k8s_psat_config block in the cofide_connect_cluster resource for the server cluster to match the values shown in Configure API resources and apply.

Create the TrustZoneServer record

Create the TrustZoneServer record. With cofidectl:

cofidectl trust-zone-server add \
  --trust-zone <your-trust-zone-name> \
  --cluster <your-server-cluster-name> \
  --kubernetes-namespace spire-server \
  --kubernetes-service-account spire-server \
  --connect-psat-audiences spire-server \
  --connect-psat-spiffe-id-path /cofide-spire-server

With Terraform, add the cofide_connect_trust_zone_server resource (as shown in Configure API resources) and apply. The ID is then available via terraform output -raw trust_zone_server_id.

Reconfigure Cofide SPIRE server

The SPIRE server must also be reachable from outside its cluster so that agents in workload clusters can connect to it. Upgrade the SPIRE server using spire-server-extra-values.yaml from Deploy Cofide SPIRE above (which sets service.type: LoadBalancer for this purpose):

helm upgrade spire cofide/spire \
  --version <version> \
  --kube-context <your-server-cluster-context> \
  --namespace spire-mgmt \
  --reuse-values \
  --values spire-server-extra-values.yaml \
  --set "spire-server.dataStore.connect.trustZoneServerID=<trust-zone-server-id>" \
  --wait

See also

• Deploy Cofide SPIRE (multiple clusters)
• Deploy Cofide SPIRE (single cluster)