按执行职责拆分动态 Runner 组件

2026-09-16 14:53:30 +00:00
parent 246b5023e7
commit c4f425e9ea
11 changed files with 145 additions and 83 deletions
@@ -0,0 +1,17 @@
+apiVersion: spire.spiffe.io/v1alpha1
+kind: ClusterSPIFFEID
+metadata:
+  name: gitea-dynamic-runner
+spec:
+  className: spire-mgmt-spire
+  spiffeIDTemplate: 'spiffe://{{ .TrustDomain }}/ci/{{ index .PodMeta.Annotations "ci.ddupan.top/spiffe-path" }}'
+  namespaceSelector:
+    matchLabels:
+      kubernetes.io/metadata.name: dynamic-runner
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: gitea-dynamic-runner
+      ci.ddupan.top/identity-bound: "true"
+  workloadSelectorTemplates:
+    - k8s:ns:dynamic-runner
+    - k8s:sa:gitea-dynamic-runner