panxiao81/gitea-dynamic-runner
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity

添加嵌套 CI 的 SPIRE JWT broker #3

Merged
panxiao81 merged 1 commits from feat/spire-jwt-broker into main 2026-09-16 13:38:48 +00:00
Conversation 0 Commits 1 Files Changed 5
+114 -1
panxiao81 commented 2026-09-16 13:37:41 +00:00
Owner
Copy Link
Copy Source

DinD job PID 无法被 Kubernetes workload attestor 映射，直接挂载 CSI socket 会超时。新增固定 aud=zot 的轻量 broker：外层 Pod 获取 JWT-SVID，token 仅在内存中解析并以 no-store 响应返回，不接受动态 audience、不记录 access log。镜像固定复制 SPIRE agent 1.15.3 digest，并新增解析测试。

DinD job PID 无法被 Kubernetes workload attestor 映射，直接挂载 CSI socket 会超时。新增固定 aud=zot 的轻量 broker：外层 Pod 获取 JWT-SVID，token 仅在内存中解析并以 no-store 响应返回，不接受动态 audience、不记录 access log。镜像固定复制 SPIRE agent 1.15.3 digest，并新增解析测试。
panxiao81 added 1 commit 2026-09-16 13:37:41 +00:00
添加嵌套 CI 的 SPIRE JWT broker
test / python (pull_request) Successful in 8s
Details
test / shell (pull_request) Successful in 17s
Details
7c3cd6a921
panxiao81 merged commit 4d6ae62abe into main 2026-09-16 13:38:48 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
panxiao81 (Xiao Pan)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: panxiao81/gitea-dynamic-runner#3