feat: 引导 sandbox SPIRE external controller

infrastructure/sandbox-cluster/README.md

@@ -124,6 +124,10 @@ Playbook 不把 reviewer token 或生成的 kubeconfig 落盘，而是将目标
 `spire-server/spire-external-kubeconfigs` 由 Ansible 单独拥有；Flux 和人工操作不得写入。
 第二次运行必须为零变更。
 
+Secret 的 `sandbox` key 仅供 SPIRE Server 的 external PSAT plugin 执行 TokenReview；
+`sandbox-controller` key 供 external controller-manager 读取 Pod/Node、reconcile SPIFFE
+CR 及执行 leader election。两者使用不同 ServiceAccount，不得合并权限或互换。
+
 ## 已验证的 Kata CI 前置条件
 
 - Cloud Hypervisor 必须报告 `vm.info.config.memory.shared=true`；

infrastructure/sandbox-cluster/ansible/roles/sandbox_spire_bootstrap/defaults/main.yml

@@ -2,5 +2,6 @@
 sandbox_spire_bootstrap_api_server: https://10.60.0.13:6443
 sandbox_spire_bootstrap_source_namespace: spire-system
 sandbox_spire_bootstrap_source_secret: spire-server-token-reviewer-token
+sandbox_spire_bootstrap_controller_secret: spire-controller-manager-token
 sandbox_spire_bootstrap_target_namespace: spire-server
 sandbox_spire_bootstrap_target_secret: spire-external-kubeconfigs

infrastructure/sandbox-cluster/ansible/roles/sandbox_spire_bootstrap/tasks/main.yml

@@ -20,10 +20,33 @@
     - (sandbox_spire_bootstrap_reviewer_secret.stdout | from_json).data['ca.crt'] is defined
   no_log: true
 
+- name: Wait for the sandbox SPIRE controller credential
+  ansible.builtin.command:
+    argv:
+      - k3s
+      - kubectl
+      - --namespace
+      - "{{ sandbox_spire_bootstrap_source_namespace }}"
+      - get
+      - secret
+      - "{{ sandbox_spire_bootstrap_controller_secret }}"
+      - --output=json
+  register: sandbox_spire_bootstrap_controller_secret_result
+  changed_when: false
+  retries: 60
+  delay: 10
+  until:
+    - sandbox_spire_bootstrap_controller_secret_result.rc == 0
+    - (sandbox_spire_bootstrap_controller_secret_result.stdout | from_json).data.token is defined
+    - (sandbox_spire_bootstrap_controller_secret_result.stdout | from_json).data['ca.crt'] is defined
+  no_log: true
+
 - name: Extract the sandbox TokenReview credential data
   ansible.builtin.set_fact:
     sandbox_spire_bootstrap_secret_data: >-
       {{ (sandbox_spire_bootstrap_reviewer_secret.stdout | from_json).data }}
+    sandbox_spire_bootstrap_controller_data: >-
+      {{ (sandbox_spire_bootstrap_controller_secret_result.stdout | from_json).data }}
   no_log: true
 
 - name: Build the restricted sandbox TokenReview kubeconfig
@@ -46,6 +69,24 @@
             cluster: sandbox
             user: spire-server-token-reviewer
       current-context: sandbox
+    sandbox_spire_bootstrap_controller_kubeconfig: |
+      apiVersion: v1
+      kind: Config
+      clusters:
+        - name: sandbox
+          cluster:
+            server: {{ sandbox_spire_bootstrap_api_server }}
+            certificate-authority-data: {{ sandbox_spire_bootstrap_controller_data['ca.crt'] }}
+      users:
+        - name: spire-controller-manager
+          user:
+            token: {{ sandbox_spire_bootstrap_controller_data.token | b64decode }}
+      contexts:
+        - name: sandbox
+          context:
+            cluster: sandbox
+            user: spire-controller-manager
+      current-context: sandbox
   no_log: true
 
 - name: Reconcile the central SPIRE external kubeconfig Secret
@@ -64,6 +105,7 @@
       type: Opaque
       data:
         sandbox: {{ sandbox_spire_bootstrap_kubeconfig | b64encode }}
+        sandbox-controller: {{ sandbox_spire_bootstrap_controller_kubeconfig | b64encode }}
   delegate_to: localhost
   become: true
   register: sandbox_spire_bootstrap_target