The k8s-workload-registrar needs access to the spire-server socket and therefore has to run in the same pod to be able to mount the socket into the container. Signed-off-by: Marco Franssen <[email protected]> Signed-off-by: Marco Franssen <[email protected]>