fix: 绑定 Pod 到真实 SPIRE agent

internal/podbackend/backend.go

@@ -65,6 +65,7 @@ type Config struct {
 	TrustDomain    string
 	SPIRECluster   string
 	SPIREClass     string
+	SPIREAgentID   string
 	ExecutorUID    int
 }
 
@@ -134,12 +135,9 @@ func (b Backend) BindIdentity(ctx context.Context, executor *taskworker.Executor
 			assignmentLabel:               executor.Name,
 		},
 		ClassName: b.Config.SPIREClass,
-		ParentID: fmt.Sprintf(
-			"spiffe://%s/spire/agent/k8s_psat/%s/pod/%s",
-			b.Config.TrustDomain, b.Config.SPIRECluster, executor.IdentityTarget,
-		),
+		ParentID:  b.Config.SPIREAgentID,
 		SPIFFEID:  identity.SPIFFEID,
-		Selectors: []string{fmt.Sprintf("unix:uid:%d", b.Config.ExecutorUID)},
+		Selectors: []string{"k8s:pod-uid:" + executor.IdentityTarget},
 	})
 }
 
@@ -168,7 +166,7 @@ func (b Backend) Delete(ctx context.Context, executor *taskworker.Executor) erro
 }
 
 func (b Backend) validate() error {
-	if b.API == nil || b.Config.Namespace == "" || b.Config.Image == "" || b.Config.ServiceAccount == "" || b.Config.TrustDomain == "" || b.Config.SPIRECluster == "" || b.Config.SPIREClass == "" || b.Config.ExecutorUID < 1 {
+	if b.API == nil || b.Config.Namespace == "" || b.Config.Image == "" || b.Config.ServiceAccount == "" || b.Config.TrustDomain == "" || b.Config.SPIRECluster == "" || b.Config.SPIREClass == "" || b.Config.SPIREAgentID == "" || b.Config.ExecutorUID < 1 {
 		return errors.New("Pod API and complete executor/SPIRE configuration are required")
 	}
 	return nil