feat: 支持按 Pod UID 生成 Agent ID

Signed-off-by: panxiao81 <[email protected]>

tests/unit/spire_test.go

@@ -416,6 +416,41 @@ spire-server:
 			Expect(objs[serverTmpl]).Should(ContainSubstring("init-jwt-svid-exec"))
 		})
 	})
+	Describe("spire-server.nodeAttestor.k8sPSAT.usePodUIDForAgentID", func() {
+		It("renders the local cluster setting", func() {
+			objs, err := ValueStringRender(chart, `
+spire-server:
+  nodeAttestor:
+    k8sPSAT:
+      usePodUIDForAgentID: true
+`)
+			Expect(err).Should(Succeed())
+			serverCM := objs["spire/charts/spire-server/templates/configmap.yaml"]
+			Expect(serverCM).Should(ContainSubstring(`"use_pod_uid_for_agent_id": true`))
+		})
+
+		It("allows an external cluster to override the default", func() {
+			objs, err := ValueStringRender(chart, `
+spire-server:
+  kubeConfigs:
+    sandbox:
+      kubeConfig: |
+        apiVersion: v1
+        kind: Config
+  nodeAttestor:
+    externalK8sPSAT:
+      defaults:
+        usePodUIDForAgentID: false
+      clusters:
+        sandbox:
+          usePodUIDForAgentID: true
+`)
+			Expect(err).Should(Succeed())
+			serverCM := objs["spire/charts/spire-server/templates/configmap.yaml"]
+			Expect(serverCM).Should(ContainSubstring(`"sandbox": {`))
+			Expect(serverCM).Should(ContainSubstring(`"use_pod_uid_for_agent_id": true`))
+		})
+	})
 	Describe("spiffe-csi-driver.syncWave", func() {
 		csiTmpl := "spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml"
 		It("renders the default sync-wave annotation on OpenShift", func() {