From ab8fbad3103f192ad2070b4c982c9a913465bc6a Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Fri, 18 Sep 2026 18:28:32 +0000
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=AD=A3=20OpenSandbox=20SPIRE=20?=
 =?UTF-8?q?=E7=88=B6=E8=BA=AB=E4=BB=BD=E6=A0=BC=E5=BC=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/opensandbox-runner.md                       | 2 +-
 src/gitea_dynamic_runner/opensandbox_identity.py | 2 +-
 tests/test_opensandbox_identity.py               | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/opensandbox-runner.md b/docs/opensandbox-runner.md
index b95c28d..697a8c2 100644
--- a/docs/opensandbox-runner.md
+++ b/docs/opensandbox-runner.md
@@ -19,7 +19,7 @@ Lifecycle 请求把稳定的 repository/task SPIFFE ID 放入 task environment
 集群内的 `opensandbox-identity` controller 读取 BatchSandbox allocation 得到实际
 Pod UID，然后创建：
 
-- parent：`spiffe://ddupan.top/spire/agent/k8s_psat/sandbox-kata/pod/<pod-uid>`；
+- parent：`spiffe://ddupan.top/spire/agent/k8s_psat/sandbox-kata/<pod-uid>`；
 - workload：`spiffe://ddupan.top/ci/<owner>/<repository>/<task>`；
 - selector：`unix:uid:2000`。
 
diff --git a/src/gitea_dynamic_runner/opensandbox_identity.py b/src/gitea_dynamic_runner/opensandbox_identity.py
index a8b7af6..cb527ef 100644
--- a/src/gitea_dynamic_runner/opensandbox_identity.py
+++ b/src/gitea_dynamic_runner/opensandbox_identity.py
@@ -91,7 +91,7 @@ def identity_entry(
             "className": SPIRE_CLASS_NAME,
             "parentID": (
                 f"spiffe://{SPIFFE_TRUST_DOMAIN}/spire/agent/k8s_psat/"
-                f"{SPIRE_CLUSTER_NAME}/pod/{pod_uid}"
+                f"{SPIRE_CLUSTER_NAME}/{pod_uid}"
             ),
             "spiffeID": spiffe_id,
             "selectors": [f"unix:uid:{RUNNER_UID}"],
diff --git a/tests/test_opensandbox_identity.py b/tests/test_opensandbox_identity.py
index 34ee28b..33ee0eb 100644
--- a/tests/test_opensandbox_identity.py
+++ b/tests/test_opensandbox_identity.py
@@ -49,5 +49,5 @@ def test_entry_binds_exact_pod_agent_and_runner_uid():
         pod_uid="pod-uid",
         spiffe_id="spiffe://ddupan.top/ci/org/repo/test",
     )
-    assert entry["spec"]["parentID"].endswith("/sandbox-kata/pod/pod-uid")
+    assert entry["spec"]["parentID"].endswith("/sandbox-kata/pod-uid")
     assert entry["spec"]["selectors"] == ["unix:uid:2000"]