feat: 引导 sandbox 跨集群 SPIRE 认证

infrastructure/sandbox-cluster/README.md

@@ -108,6 +108,22 @@ homelab CA trust。Flux `v2.9.5` controllers 与 root sync 也由 Ansible 通过
 server manifests 管理；root 使用 homelab CA 访问公开 Gitea 仓库，不保存 Git token。
 集群内 workload 由 `clusters/sandbox/` 分阶段纳入 Flux。
 
+## SPIRE 跨集群 bootstrap
+
+Sandbox 复用 homelab 的 SPIRE Server 与 `ddupan.top` trust domain。Flux 首先安装
+SPIRE CRD，并创建权限仅为 `authentication.k8s.io/tokenreviews.create` 的 reviewer。
+在该 Kustomization Ready 后运行：
+
+```bash
+cd infrastructure/sandbox-cluster/ansible
+ansible-playbook spire-bootstrap.yml
+```
+
+Playbook 不把 reviewer token 或生成的 kubeconfig 落盘，而是将目标 Secret manifest
+通过 stdin 交给本机 homelab `k3s kubectl`。目标 Secret
+`spire-server/spire-external-kubeconfigs` 由 Ansible 单独拥有；Flux 和人工操作不得写入。
+第二次运行必须为零变更。
+
 ## 已验证的 Kata CI 前置条件
 
 - Cloud Hypervisor 必须报告 `vm.info.config.memory.shared=true`；

infrastructure/sandbox-cluster/ansible/roles/sandbox_spire_bootstrap/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+sandbox_spire_bootstrap_api_server: https://10.60.0.13:6443
+sandbox_spire_bootstrap_source_namespace: spire-system
+sandbox_spire_bootstrap_source_secret: spire-server-token-reviewer-token
+sandbox_spire_bootstrap_target_namespace: spire-server
+sandbox_spire_bootstrap_target_secret: spire-external-kubeconfigs

infrastructure/sandbox-cluster/ansible/roles/sandbox_spire_bootstrap/tasks/main.yml

@@ -0,0 +1,73 @@
+---
+- name: Wait for the sandbox SPIRE token reviewer credential
+  ansible.builtin.command:
+    argv:
+      - k3s
+      - kubectl
+      - --namespace
+      - "{{ sandbox_spire_bootstrap_source_namespace }}"
+      - get
+      - secret
+      - "{{ sandbox_spire_bootstrap_source_secret }}"
+      - --output=json
+  register: sandbox_spire_bootstrap_reviewer_secret
+  changed_when: false
+  retries: 60
+  delay: 10
+  until:
+    - sandbox_spire_bootstrap_reviewer_secret.rc == 0
+    - (sandbox_spire_bootstrap_reviewer_secret.stdout | from_json).data.token is defined
+    - (sandbox_spire_bootstrap_reviewer_secret.stdout | from_json).data['ca.crt'] is defined
+  no_log: true
+
+- name: Extract the sandbox TokenReview credential data
+  ansible.builtin.set_fact:
+    sandbox_spire_bootstrap_secret_data: >-
+      {{ (sandbox_spire_bootstrap_reviewer_secret.stdout | from_json).data }}
+  no_log: true
+
+- name: Build the restricted sandbox TokenReview kubeconfig
+  ansible.builtin.set_fact:
+    sandbox_spire_bootstrap_kubeconfig: |
+      apiVersion: v1
+      kind: Config
+      clusters:
+        - name: sandbox
+          cluster:
+            server: {{ sandbox_spire_bootstrap_api_server }}
+            certificate-authority-data: {{ sandbox_spire_bootstrap_secret_data['ca.crt'] }}
+      users:
+        - name: spire-server-token-reviewer
+          user:
+            token: {{ sandbox_spire_bootstrap_secret_data.token | b64decode }}
+      contexts:
+        - name: sandbox
+          context:
+            cluster: sandbox
+            user: spire-server-token-reviewer
+      current-context: sandbox
+  no_log: true
+
+- name: Reconcile the central SPIRE external kubeconfig Secret
+  ansible.builtin.command:
+    argv:
+      - k3s
+      - kubectl
+      - apply
+      - --filename=-
+    stdin: |
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: {{ sandbox_spire_bootstrap_target_secret }}
+        namespace: {{ sandbox_spire_bootstrap_target_namespace }}
+      type: Opaque
+      data:
+        sandbox: {{ sandbox_spire_bootstrap_kubeconfig | b64encode }}
+  delegate_to: localhost
+  become: true
+  register: sandbox_spire_bootstrap_target
+  changed_when: >-
+    ' created' in sandbox_spire_bootstrap_target.stdout or
+    ' configured' in sandbox_spire_bootstrap_target.stdout
+  no_log: true

infrastructure/sandbox-cluster/ansible/site.yml

@@ -52,3 +52,9 @@
   gather_facts: false
   roles:
     - sandbox_flux
+
+- name: Reconcile central SPIRE access to sandbox Kubernetes
+  hosts: sandbox1
+  gather_facts: false
+  roles:
+    - sandbox_spire_bootstrap

infrastructure/sandbox-cluster/ansible/spire-bootstrap.yml

@@ -0,0 +1,6 @@
+---
+- name: Reconcile central SPIRE access to sandbox Kubernetes
+  hosts: sandbox1
+  gather_facts: false
+  roles:
+    - sandbox_spire_bootstrap