避免动态 Runner 凭据覆盖服务账号令牌路径

2026-09-16 15:24:16 +00:00
parent dc325f3a45
commit 13279256a5
2 changed files with 5 additions and 5 deletions
@@ -50,9 +50,9 @@ spec:
            - name: NATS_CA_FILE
              value: /run/trust/ca.pem
            - name: NATS_PASSWORD_FILE
-              value: /run/secrets/nats-password
+              value: /run/dynamic-runner-secrets/nats-password
            - name: WEBHOOK_SECRET_FILE
-              value: /run/secrets/webhook-secret
+              value: /run/dynamic-runner-secrets/webhook-secret
          ports:
            - name: http
              containerPort: 8787
@@ -86,7 +86,7 @@ spec:
              type: RuntimeDefault
          volumeMounts:
            - name: secret
-              mountPath: /run/secrets
+              mountPath: /run/dynamic-runner-secrets
              readOnly: true
            - name: trust
              mountPath: /run/trust
@@ -48,7 +48,7 @@ spec:
            - name: NATS_CA_FILE
              value: /run/trust/ca.pem
            - name: NATS_PASSWORD_FILE
-              value: /run/secrets/nats-worker-password
+              value: /run/dynamic-runner-secrets/nats-worker-password
            - name: RUNNER_NAMESPACE
              valueFrom:
                fieldRef:
@@ -80,7 +80,7 @@ spec:
              type: RuntimeDefault
          volumeMounts:
            - name: secret
-              mountPath: /run/secrets
+              mountPath: /run/dynamic-runner-secrets
              readOnly: true
            - name: trust
              mountPath: /run/trust