panxiao81/homelab-infra
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

补齐 sandbox PSAT reviewer 权限 #90

Merged
panxiao81 merged 1 commits from fix/sandbox-spire-psat-rbac into main 2026-09-17 17:47:27 +00:00
Conversation 0 Commits 1 Files Changed 3
+18 -5
panxiao81 commented 2026-09-17 17:30:55 +00:00
Owner
Copy Link
Copy Source

问题

sandbox Agent attestation 到达 central SPIRE Server 后失败。Server 日志明确显示 reviewer 无权读取 Agent Pod：

pods ... is forbidden: spire-server-token-reviewer cannot get resource pods

k8s_psat Server plugin 不只调用 TokenReview，还必须读取对应 Pod/Node 来校验证明上下文。

修复

按固定 chart 0.30.2 渲染的上游 Server ClusterRole 对齐 reviewer 权限：

  • tokenreviews: get/list/watch/create
  • pods、nodes: get/list

不授予任何 workload 修改权限，不与 external controller credential 合并。

验证

  • yamllint 与 diff check 通过
  • bootstrap Kustomize render 与 Kubernetes client dry-run 通过
  • 权限集合与 spire-server/templates/roles.yaml 的 k8s_psat 规则一致

合并后 Flux 会更新 ClusterRole，Agent 将自动重试 attestation。

关联 #83、#34

## 问题 sandbox Agent attestation 到达 central SPIRE Server 后失败。Server 日志明确显示 reviewer 无权读取 Agent Pod： `pods ... is forbidden: spire-server-token-reviewer cannot get resource pods` k8s_psat Server plugin 不只调用 TokenReview，还必须读取对应 Pod/Node 来校验证明上下文。 ## 修复 按固定 chart 0.30.2 渲染的上游 Server ClusterRole 对齐 reviewer 权限： - `tokenreviews`: get/list/watch/create - `pods`、`nodes`: get/list 不授予任何 workload 修改权限，不与 external controller credential 合并。 ## 验证 - yamllint 与 diff check 通过 - bootstrap Kustomize render 与 Kubernetes client dry-run 通过 - 权限集合与 `spire-server/templates/roles.yaml` 的 k8s_psat 规则一致 合并后 Flux 会更新 ClusterRole，Agent 将自动重试 attestation。 关联 #83、#34
panxiao81 added 1 commit 2026-09-17 17:30:56 +00:00
fix: 补齐 sandbox PSAT reviewer 权限
yaml / yaml (pull_request) Successful in 13s
Details
b619f6f681
panxiao81 merged commit 9515cde49b into main 2026-09-17 17:47:27 +00:00
panxiao81 deleted branch fix/sandbox-spire-psat-rbac 2026-09-17 17:47:27 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
panxiao81 (Xiao Pan)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: panxiao81/homelab-infra#90