为 Gitea runner 接入 SPIRE Workload API

2026-09-16 13:25:01 +00:00
parent 22bffe068c
commit 94721c279b
5 changed files with 64 additions and 0 deletions
@@ -0,0 +1,17 @@
+apiVersion: spire.spiffe.io/v1alpha1
+kind: ClusterSPIFFEID
+metadata:
+  name: gitea-actions
+spec:
+  className: spire-mgmt-spire
+  spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ci/gitea-actions
+  namespaceSelector:
+    matchLabels:
+      kubernetes.io/metadata.name: gitea-actions
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: gitea-actions
+      app.kubernetes.io/name: actions-runner
+  workloadSelectorTemplates:
+    - k8s:ns:gitea-actions
+    - k8s:sa:gitea-actions