Merge pull request '按 guest Agent 格式恢复 SPIRE 父身份' (#26) from fix/opensandbox-guest-parent into main

docs/opensandbox-runner.md

@@ -19,7 +19,7 @@ Lifecycle 请求把稳定的 repository/task SPIFFE ID 放入 task environment
 集群内的 `opensandbox-identity` controller 读取 BatchSandbox allocation 得到实际
 Pod UID，然后创建：
 
-- parent：`spiffe://ddupan.top/spire/agent/k8s_psat/sandbox-kata/<pod-uid>`；
+- parent：`spiffe://ddupan.top/spire/agent/k8s_psat/sandbox-kata/pod/<pod-uid>`；
 - workload：`spiffe://ddupan.top/ci/<owner>/<repository>/<task>`；
 - selector：`unix:uid:2000`。
 

src/gitea_dynamic_runner/opensandbox_identity.py

@@ -91,7 +91,7 @@ def identity_entry(
             "className": SPIRE_CLASS_NAME,
             "parentID": (
                 f"spiffe://{SPIFFE_TRUST_DOMAIN}/spire/agent/k8s_psat/"
-                f"{SPIRE_CLUSTER_NAME}/{pod_uid}"
+                f"{SPIRE_CLUSTER_NAME}/pod/{pod_uid}"
             ),
             "spiffeID": spiffe_id,
             "selectors": [f"unix:uid:{RUNNER_UID}"],

tests/test_opensandbox_identity.py

@@ -49,5 +49,5 @@ def test_entry_binds_exact_pod_agent_and_runner_uid():
         pod_uid="pod-uid",
         spiffe_id="spiffe://ddupan.top/ci/org/repo/test",
     )
-    assert entry["spec"]["parentID"].endswith("/sandbox-kata/pod-uid")
+    assert entry["spec"]["parentID"].endswith("/sandbox-kata/pod/pod-uid")
     assert entry["spec"]["selectors"] == ["unix:uid:2000"]