feat: 引导 sandbox SPIRE external controller

platform/sandbox-spire/bootstrap/controller-manager.yaml

@@ -0,0 +1,129 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: spire-controller-manager
+  namespace: spire-system
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: spire-controller-manager-token
+  namespace: spire-system
+  annotations:
+    kubernetes.io/service-account.name: spire-controller-manager
+type: kubernetes.io/service-account-token
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: spire-controller-manager
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - endpoints
+      - namespaces
+      - nodes
+      - pods
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - spire.spiffe.io
+    resources:
+      - clusterfederatedtrustdomains
+      - clusterspiffeids
+      - clusterstaticentries
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - spire.spiffe.io
+    resources:
+      - clusterfederatedtrustdomains/finalizers
+      - clusterspiffeids/finalizers
+      - clusterstaticentries/finalizers
+    verbs:
+      - update
+  - apiGroups:
+      - spire.spiffe.io
+    resources:
+      - clusterfederatedtrustdomains/status
+      - clusterspiffeids/status
+      - clusterstaticentries/status
+    verbs:
+      - get
+      - patch
+      - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: spire-controller-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: spire-controller-manager
+subjects:
+  - kind: ServiceAccount
+    name: spire-controller-manager
+    namespace: spire-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: spire-controller-manager-leader-election
+  namespace: spire-server
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - coordination.k8s.io
+    resources:
+      - leases
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: spire-controller-manager-leader-election
+  namespace: spire-server
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: spire-controller-manager-leader-election
+subjects:
+  - kind: ServiceAccount
+    name: spire-controller-manager
+    namespace: spire-system

platform/sandbox-spire/bootstrap/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - repository.yaml
   - crds.yaml
   - token-reviewer.yaml
+  - controller-manager.yaml

platform/sandbox-spire/bootstrap/namespaces.yaml

@@ -8,3 +8,8 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: spire-system
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: spire-server