panxiao81/homelab-infra
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

为宿主机开发启用 SPIRE workload identity #75

Merged
panxiao81 merged 1 commits from feat/spire-host-development into main 2026-09-16 16:59:17 +00:00
Conversation 0 Commits 1 Files Changed 4
+36 -1
panxiao81 commented 2026-09-16 16:58:31 +00:00
Owner
Copy Link
Copy Source

变更

  • 为节点 SPIRE Agent 启用 Unix workload attestor
  • 为本机 UID 1000 声明受限的开发身份 spiffe://ddupan.top/dev/panxiao81
  • 将宿主机 Workload API socket 和使用方式记录到 SPIRE README
  • 保留现有 Kubernetes workload 身份签发策略

验证

  • kubectl kustomize platform/spire 渲染通过
  • ClusterStaticEntry 已由 Controller Manager 写入 SPIRE Server
  • 宿主机普通用户通过 /run/spire/agent-sockets/spire-agent.sock 成功取得 spiffe://ddupan.top/dev/panxiao81 X.509-SVID
  • root 进程不会匹配该 UID 身份
## 变更 - 为节点 SPIRE Agent 启用 Unix workload attestor - 为本机 UID 1000 声明受限的开发身份 `spiffe://ddupan.top/dev/panxiao81` - 将宿主机 Workload API socket 和使用方式记录到 SPIRE README - 保留现有 Kubernetes workload 身份签发策略 ## 验证 - `kubectl kustomize platform/spire` 渲染通过 - ClusterStaticEntry 已由 Controller Manager 写入 SPIRE Server - 宿主机普通用户通过 `/run/spire/agent-sockets/spire-agent.sock` 成功取得 `spiffe://ddupan.top/dev/panxiao81` X.509-SVID - root 进程不会匹配该 UID 身份
panxiao81 added 1 commit 2026-09-16 16:58:31 +00:00
为宿主机开发启用 SPIRE workload identity
yaml / yaml (pull_request) Failing after 2s
Details
7703b5d21e
panxiao81 merged commit bbf228de41 into main 2026-09-16 16:59:17 +00:00
panxiao81 deleted branch feat/spire-host-development 2026-09-16 16:59:17 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
panxiao81 (Xiao Pan)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: panxiao81/homelab-infra#75