From 7703b5d21e7d919991347a79c64157ec93d83817 Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Wed, 16 Sep 2026 16:56:52 +0000
Subject: [PATCH] =?UTF-8?q?=E4=B8=BA=E5=AE=BF=E4=B8=BB=E6=9C=BA=E5=BC=80?=
 =?UTF-8?q?=E5=8F=91=E5=90=AF=E7=94=A8=20SPIRE=20workload=20identity?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 platform/spire/README.md                      | 19 +++++++++++++++++++
 platform/spire/kustomization.yaml             |  1 +
 .../spire/local-development-identity.yaml     | 12 ++++++++++++
 platform/spire/values.yaml                    |  5 ++++-
 4 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 platform/spire/local-development-identity.yaml

diff --git a/platform/spire/README.md b/platform/spire/README.md
index ebe06e2..8777651 100644
--- a/platform/spire/README.md
+++ b/platform/spire/README.md
@@ -47,6 +47,25 @@ PostgreSQL保存 registration state；SPIRE Server 的 disk KeyManager 仍使用
 `ClusterSPIFFEID`，并以 namespace、ServiceAccount、Pod label 等 selector 收窄。
 不得仅因 Pod 能挂载 CSI socket 就给它签发身份。
 
+## 宿主机本地开发身份
+
+Kubernetes 节点 Agent 同时通过 hostPath 在宿主机发布 Workload API socket：
+
+```text
+/run/spire/agent-sockets/spire-agent.sock
+```
+
+Agent 已启用 Unix workload attestor，并为本机用户 `panxiao81`（UID `1000`）注册
+`spiffe://ddupan.top/dev/panxiao81`。本地开发程序应设置：
+
+```bash
+export SPIFFE_ENDPOINT_SOCKET=unix:///run/spire/agent-sockets/spire-agent.sock
+```
+
+该身份仅按 Unix UID 匹配，不是 SPIRE admin，也不会匹配 `sudo` 后以 root 运行的
+进程。`ClusterStaticEntry.spec.parentID` 绑定当前 `laptop` Kubernetes node UID；若
+节点被删除后重建，需从 `spire-server agent list` 取得新 Agent ID 并同步更新该字段。
+
 稳定的 JWT issuer 预留为：
 
 ```text
diff --git a/platform/spire/kustomization.yaml b/platform/spire/kustomization.yaml
index 1ade345..6894182 100644
--- a/platform/spire/kustomization.yaml
+++ b/platform/spire/kustomization.yaml
@@ -15,3 +15,4 @@ resources:
   - helmrelease-crds.yaml
   - helmrelease.yaml
   - httproute.yaml
+  - local-development-identity.yaml
diff --git a/platform/spire/local-development-identity.yaml b/platform/spire/local-development-identity.yaml
new file mode 100644
index 0000000..dbf5b17
--- /dev/null
+++ b/platform/spire/local-development-identity.yaml
@@ -0,0 +1,12 @@
+apiVersion: spire.spiffe.io/v1alpha1
+kind: ClusterStaticEntry
+metadata:
+  name: local-development-panxiao81
+  labels:
+    spire.spiffe.io/class-name: spire-mgmt-spire
+spec:
+  className: spire-mgmt-spire
+  parentID: spiffe://ddupan.top/spire/agent/k8s_psat/homelab/cd2d0233-c4ea-4031-8327-e7e359e766dd
+  spiffeID: spiffe://ddupan.top/dev/panxiao81
+  selectors:
+    - unix:uid:1000
diff --git a/platform/spire/values.yaml b/platform/spire/values.yaml
index 770da6c..550a878 100644
--- a/platform/spire/values.yaml
+++ b/platform/spire/values.yaml
@@ -72,7 +72,10 @@ spire-agent:
     k8s:
       enabled: true
     unix:
-      enabled: false
+      # The node Agent also exposes its Workload API socket on the host. Enable
+      # Unix attestation so local development processes can receive an identity
+      # through an explicitly scoped ClusterStaticEntry.
+      enabled: true
 
 spiffe-csi-driver:
   enabled: true