From 28f1de35cbdd3447d62505120cc542e0d0e9f76a Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Fri, 18 Sep 2026 19:06:13 +0000 Subject: [PATCH] =?UTF-8?q?=E5=90=AF=E7=94=A8=20sandbox=20=E9=9D=99?= =?UTF-8?q?=E6=80=81=E8=BA=AB=E4=BB=BD=E7=99=BB=E8=AE=B0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/sandbox-ci-runners/README.md | 6 ++++++ platform/spire/values.yaml | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/platform/sandbox-ci-runners/README.md b/platform/sandbox-ci-runners/README.md index 6974ff7..93830c0 100644 --- a/platform/sandbox-ci-runners/README.md +++ b/platform/sandbox-ci-runners/README.md @@ -9,6 +9,12 @@ Pod-bound PSAT 向中央 SPIRE 注册；identity controller 从 BatchSandbox all 取得真实 Pod UID，再创建精确的 `ClusterStaticEntry`。runner 只有拿到请求中的完整 repository/task SVID 后才领取一次性 Gitea registration token。 +这些 `ClusterStaticEntry` 位于 sandbox 集群，由 central SPIRE Server 内的 +`spire-controller-manager-sandbox` 通过受限 external kubeconfig reconcile。必须在 +`platform/spire/values.yaml` 显式启用 external controller-manager 的 +`reconcile.clusterStaticEntries`（chart 默认关闭）；仅看到 CR 存在但没有 status，不算 +身份链路就绪。 + ## 部署依赖 - OpenSandbox chart 和 CRD 已 Ready； diff --git a/platform/spire/values.yaml b/platform/spire/values.yaml index d628ae2..54d9bfb 100644 --- a/platform/spire/values.yaml +++ b/platform/spire/values.yaml @@ -66,6 +66,12 @@ spire-server: clusters: sandbox: kubeConfigName: sandbox-controller + # Dynamic OpenSandbox runner identities are exact Pod-UID-bound + # ClusterStaticEntries created in the sandbox cluster. The chart + # defaults this reconciler to false, so enable the central registration + # path explicitly. + reconcile: + clusterStaticEntries: true bundlePublisher: externalK8sConfigMap: enabled: true