为 Gitea runner 接入 SPIRE Workload API

platform/gitea-runner/values.yaml

@@ -7,6 +7,12 @@ existingSecretKey: token
 statefulset:
   replicas: 1
   timezone: Etc/UTC
+  serviceAccountName: gitea-actions
+  extraVolumes:
+    - name: spiffe-workload-api
+      csi:
+        driver: csi.spiffe.io
+        readOnly: true
   securityContext:
     fsGroup: 1000
   # Chart 0.1.1 applies this block to both runner and DinD containers.
@@ -27,6 +33,10 @@ statefulset:
     repository: gitea/runner
     tag: 2.3.0
     pullPolicy: IfNotPresent
+    extraVolumeMounts:
+      - name: spiffe-workload-api
+        mountPath: /run/spire/agent-sockets
+        readOnly: true
     config: |
       log:
         level: info
@@ -42,6 +52,10 @@ statefulset:
       container:
         require_docker: true
         docker_timeout: 300s
+        # Workflows must still request this exact bind mount explicitly. The
+        # allowlist prevents arbitrary host paths from reaching job containers.
+        valid_volumes:
+          - /run/spire/agent-sockets
 
   dind:
     # The node enforces AppArmor's unprivileged-userns restriction, which blocks
@@ -51,6 +65,12 @@ statefulset:
     repository: docker
     tag: 29.7.1-dind
     pullPolicy: IfNotPresent
+    # Bind mounts are resolved by dockerd, so the CSI socket must exist in the
+    # DinD container as well as in the runner container.
+    extraVolumeMounts:
+      - name: spiffe-workload-api
+        mountPath: /run/spire/agent-sockets
+        readOnly: true
     # k3s uses a 1450-byte pod MTU. Without matching it here, nested Actions
     # networks advertise 1500 and GitHub TLS packets disappear on the outer
     # overlay path while direct pod traffic remains healthy.