Most organizations eventually outgrow a single cluster. Multi-cluster, multi-cloud, and hybrid deployments introduce trust boundary challenges that single-cluster security models cannot handle.
Trust Domain Design
Each cluster or cloud region gets its own SPIFFE trust domain. Trust domains are federated by exchanging trust bundles. Services in any domain can verify SVIDs from any federated domain.
Cross-Cloud Identity
SPIFFE identity is cloud-agnostic. A service running on AWS can verify the identity of a service running on GCP — if both trust domains are federated. No cloud IAM roles, no cloud-specific tokens, just SPIFFE SVIDs.
Hybrid Infrastructure
SPIRE supports both Kubernetes and VM workloads. Kubernetes uses k8s_psat attestation, VMs use AWS IID, Azure MSI, or join token attestation. Both participate in the same trust domain and can verify each other.
Trust Boundaries
- Within a trust domain: All workloads share the same CA. Any registered workload can get an SVID. Identity is verified locally by the SPIRE Agent.
- Across trust domains: Federation via bundle exchange. Identity verification requires the remote trust bundle. More controlled — you choose which domains to federate with.
- Between organizations: Separate trust domains with explicit federation. Full organizational boundary isolation.