feat: 引导 sandbox 跨集群 SPIRE 认证

2026-09-17 16:50:02 +00:00
parent dc2b43f693
commit b7b92b3465
13 changed files with 230 additions and 0 deletions
@@ -0,0 +1,6 @@
+---
+sandbox_spire_bootstrap_api_server: https://10.60.0.13:6443
+sandbox_spire_bootstrap_source_namespace: spire-system
+sandbox_spire_bootstrap_source_secret: spire-server-token-reviewer-token
+sandbox_spire_bootstrap_target_namespace: spire-server
+sandbox_spire_bootstrap_target_secret: spire-external-kubeconfigs
@@ -0,0 +1,73 @@
+---
+- name: Wait for the sandbox SPIRE token reviewer credential
+  ansible.builtin.command:
+    argv:
+      - k3s
+      - kubectl
+      - --namespace
+      - "{{ sandbox_spire_bootstrap_source_namespace }}"
+      - get
+      - secret
+      - "{{ sandbox_spire_bootstrap_source_secret }}"
+      - --output=json
+  register: sandbox_spire_bootstrap_reviewer_secret
+  changed_when: false
+  retries: 60
+  delay: 10
+  until:
+    - sandbox_spire_bootstrap_reviewer_secret.rc == 0
+    - (sandbox_spire_bootstrap_reviewer_secret.stdout | from_json).data.token is defined
+    - (sandbox_spire_bootstrap_reviewer_secret.stdout | from_json).data['ca.crt'] is defined
+  no_log: true
+
+- name: Extract the sandbox TokenReview credential data
+  ansible.builtin.set_fact:
+    sandbox_spire_bootstrap_secret_data: >-
+      {{ (sandbox_spire_bootstrap_reviewer_secret.stdout | from_json).data }}
+  no_log: true
+
+- name: Build the restricted sandbox TokenReview kubeconfig
+  ansible.builtin.set_fact:
+    sandbox_spire_bootstrap_kubeconfig: |
+      apiVersion: v1
+      kind: Config
+      clusters:
+        - name: sandbox
+          cluster:
+            server: {{ sandbox_spire_bootstrap_api_server }}
+            certificate-authority-data: {{ sandbox_spire_bootstrap_secret_data['ca.crt'] }}
+      users:
+        - name: spire-server-token-reviewer
+          user:
+            token: {{ sandbox_spire_bootstrap_secret_data.token | b64decode }}
+      contexts:
+        - name: sandbox
+          context:
+            cluster: sandbox
+            user: spire-server-token-reviewer
+      current-context: sandbox
+  no_log: true
+
+- name: Reconcile the central SPIRE external kubeconfig Secret
+  ansible.builtin.command:
+    argv:
+      - k3s
+      - kubectl
+      - apply
+      - --filename=-
+    stdin: |
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: {{ sandbox_spire_bootstrap_target_secret }}
+        namespace: {{ sandbox_spire_bootstrap_target_namespace }}
+      type: Opaque
+      data:
+        sandbox: {{ sandbox_spire_bootstrap_kubeconfig | b64encode }}
+  delegate_to: localhost
+  become: true
+  register: sandbox_spire_bootstrap_target
+  changed_when: >-
+    ' created' in sandbox_spire_bootstrap_target.stdout or
+    ' configured' in sandbox_spire_bootstrap_target.stdout
+  no_log: true