fix: 注入执行器 SPIFFE socket

.gitea/workflows/pod-smoke.yml

@@ -16,4 +16,4 @@ jobs:
             -audience ci-smoke \
             -socketPath /run/spire/agent-sockets/spire-agent.sock \
             >/dev/null
-          test "$(id -u)" = 0
+          test "$(id -u)" = 2000

cmd/gitea-dynamic-runner/controller.go

@@ -93,6 +93,7 @@ func runController(ctx context.Context) error {
 	}
 	bootstrap := runnerbootstrap.Bootstrap{
 		Capabilities: capabilities, FacadeURL: config.FacadeURL, FacadeSPIFFEID: config.FacadeSPIFFEID,
+		WorkloadAPIAddr: config.WorkloadAPIAddr,
 	}
 
 	labels := []string{"self-hosted"}

internal/runnerbootstrap/bootstrap.go

@@ -27,10 +27,11 @@ type Bootstrap struct {
 	Capabilities    runnerfacade.Capabilities
 	FacadeURL       string
 	FacadeSPIFFEID  string
+	WorkloadAPIAddr string
 }
 
 func (b Bootstrap) Environment(assignment taskassignment.Assignment) (map[string]string, error) {
-	if assignment.ID == "" || assignment.Identity.SPIFFEID == "" || b.FacadeSPIFFEID == "" {
+	if assignment.ID == "" || assignment.Identity.SPIFFEID == "" || b.FacadeSPIFFEID == "" || b.WorkloadAPIAddr == "" {
 		return nil, errors.New("assignment ID and SPIFFE ID are required")
 	}
 	parsed, err := url.Parse(b.FacadeURL)
@@ -48,6 +49,7 @@ func (b Bootstrap) Environment(assignment taskassignment.Assignment) (map[string
 		EnvFacadeID:              b.FacadeSPIFFEID,
 		EnvSPIFFEID:              assignment.Identity.SPIFFEID,
 		EnvBackend:               string(assignment.Backend),
+		"SPIFFE_ENDPOINT_SOCKET": b.WorkloadAPIAddr,
 	}, nil
 }
 

internal/runnerbootstrap/bootstrap_test.go

@@ -19,6 +19,7 @@ func testBootstrap(t *testing.T) Bootstrap {
 		Capabilities:    capabilities,
 		FacadeURL:       "https://runner-facade.gitea-actions.svc:8443",
 		FacadeSPIFFEID:  "spiffe://ddupan.top/ns/gitea-actions/sa/gitea-dynamic-runner",
+		WorkloadAPIAddr: "unix:///run/spire/agent-sockets/spire-agent.sock",
 	}
 }
 
@@ -48,6 +49,9 @@ func TestEnvironmentIsDeterministicAndAssignmentScoped(t *testing.T) {
 	if first[EnvBackend] != "pod" || first[EnvFacadeID] == "" {
 		t.Fatalf("environment = %#v", first)
 	}
+	if first["SPIFFE_ENDPOINT_SOCKET"] != "unix:///run/spire/agent-sockets/spire-agent.sock" {
+		t.Fatalf("environment = %#v", first)
+	}
 }
 
 func TestRegistrationMatchesOfficialRunnerSchema(t *testing.T) {