# Kubernetes Service Account Trust Provider now supports multiple OIDC endpoints

A Kubernetes Service Account Trust Provider now accepts more than one OpenID Connect (OIDC) endpoint. One Trust Provider can then attest a Client Workload that runs active-active across two or more clusters.

Each cluster signs its Service Account tokens with its own key. Add one **OIDC Endpoint** for each cluster’s issuer URL with **Add an Endpoint**, and the Trust Provider validates a token signed by any of them. See [Attest one workload across multiple clusters](/user-guide/access-policies/trust-providers/kubernetes-service-account-trust-provider/#attest-one-workload-across-multiple-clusters).