fix: 绑定 Pod 到真实 SPIRE agent

internal/podbackend/backend.go

@@ -65,6 +65,7 @@ type Config struct {
 	TrustDomain    string
 	SPIRECluster   string
 	SPIREClass     string
+	SPIREAgentID   string
 	ExecutorUID    int
 }
 
@@ -134,12 +135,9 @@ func (b Backend) BindIdentity(ctx context.Context, executor *taskworker.Executor
 			assignmentLabel:               executor.Name,
 		},
 		ClassName: b.Config.SPIREClass,
-		ParentID: fmt.Sprintf(
-			"spiffe://%s/spire/agent/k8s_psat/%s/pod/%s",
-			b.Config.TrustDomain, b.Config.SPIRECluster, executor.IdentityTarget,
-		),
+		ParentID:  b.Config.SPIREAgentID,
 		SPIFFEID:  identity.SPIFFEID,
-		Selectors: []string{fmt.Sprintf("unix:uid:%d", b.Config.ExecutorUID)},
+		Selectors: []string{"k8s:pod-uid:" + executor.IdentityTarget},
 	})
 }
 
@@ -168,7 +166,7 @@ func (b Backend) Delete(ctx context.Context, executor *taskworker.Executor) erro
 }
 
 func (b Backend) validate() error {
-	if b.API == nil || b.Config.Namespace == "" || b.Config.Image == "" || b.Config.ServiceAccount == "" || b.Config.TrustDomain == "" || b.Config.SPIRECluster == "" || b.Config.SPIREClass == "" || b.Config.ExecutorUID < 1 {
+	if b.API == nil || b.Config.Namespace == "" || b.Config.Image == "" || b.Config.ServiceAccount == "" || b.Config.TrustDomain == "" || b.Config.SPIRECluster == "" || b.Config.SPIREClass == "" || b.Config.SPIREAgentID == "" || b.Config.ExecutorUID < 1 {
 		return errors.New("Pod API and complete executor/SPIRE configuration are required")
 	}
 	return nil

internal/podbackend/backend_test.go

@@ -46,7 +46,9 @@ func backend(api API) Backend {
 		Namespace: "gitea-actions", Image: "zot/ci-executor:main",
 		ServiceAccount: "gitea-task-executor", ExecutorArgs: []string{"executor"},
 		TrustDomain: "ddupan.top", SPIRECluster: "homelab",
-		SPIREClass: "spire-mgmt-spire", ExecutorUID: 2000,
+		SPIREClass:   "spire-mgmt-spire",
+		SPIREAgentID: "spiffe://ddupan.top/spire/agent/k8s_psat/homelab/node-uid",
+		ExecutorUID:  2000,
 	}}
 }
 
@@ -101,7 +103,7 @@ func TestBindIdentityCreatesEntryPinnedToPodUID(t *testing.T) {
 	if err := backend(api).BindIdentity(context.Background(), executor, assignment().Identity); err != nil {
 		t.Fatal(err)
 	}
-	if api.entry.Name != executor.Name || api.entry.SPIFFEID != assignment().Identity.SPIFFEID || api.entry.ParentID != "spiffe://ddupan.top/spire/agent/k8s_psat/homelab/pod/pod-uid" || len(api.entry.Selectors) != 1 || api.entry.Selectors[0] != "unix:uid:2000" {
+	if api.entry.Name != executor.Name || api.entry.SPIFFEID != assignment().Identity.SPIFFEID || api.entry.ParentID != "spiffe://ddupan.top/spire/agent/k8s_psat/homelab/node-uid" || len(api.entry.Selectors) != 1 || api.entry.Selectors[0] != "k8s:pod-uid:pod-uid" {
 		t.Fatalf("entry=%#v", api.entry)
 	}
 }