panxiao81/homelab-infra
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

引导 sandbox SPIRE external controller #88

Merged
panxiao81 merged 1 commits from feat/sandbox-spire-controller-bootstrap into main 2026-09-17 17:14:51 +00:00
Conversation 0 Commits 1 Files Changed 7
+188
panxiao81 commented 2026-09-17 17:00:45 +00:00
Owner
Copy Link
Copy Source

内容

  • 为 sandbox external controller-manager 声明独立 ServiceAccount 与 token
  • RBAC 与上游 controller-manager 职责一致，覆盖 workload selector 读取、SPIFFE CR reconciliation 与 leader election
  • reviewer 与 controller 使用不同凭据，不合并权限
  • Ansible 在 central Secret 中分别维护 sandbox 和 sandbox-controller kubeconfig key

验证

  • yamllint 与 diff check 通过
  • Ansible syntax-check 通过
  • ansible-lint production profile 通过
  • Kustomize render 与 Kubernetes client dry-run 通过

部署顺序

合并后等待 Flux 生成 controller token，运行两次 spire-bootstrap.yml 并确认第二次零变更；之后启用 central external PSAT/controller 与 sandbox Agent/CSI。

关联 #83、#34

## 内容 - 为 sandbox external controller-manager 声明独立 ServiceAccount 与 token - RBAC 与上游 controller-manager 职责一致，覆盖 workload selector 读取、SPIFFE CR reconciliation 与 leader election - reviewer 与 controller 使用不同凭据，不合并权限 - Ansible 在 central Secret 中分别维护 `sandbox` 和 `sandbox-controller` kubeconfig key ## 验证 - yamllint 与 diff check 通过 - Ansible syntax-check 通过 - ansible-lint production profile 通过 - Kustomize render 与 Kubernetes client dry-run 通过 ## 部署顺序 合并后等待 Flux 生成 controller token，运行两次 `spire-bootstrap.yml` 并确认第二次零变更；之后启用 central external PSAT/controller 与 sandbox Agent/CSI。 关联 #83、#34
panxiao81 added 1 commit 2026-09-17 17:00:45 +00:00
feat: 引导 sandbox SPIRE external controller
yaml / yaml (pull_request) Successful in 17s
Details
ansible / collection-test (pull_request) Successful in 1m5s
Details
ansible / lint (pull_request) Successful in 4m4s
Details
ea15841d4d
panxiao81 merged commit 7b1a98280c into main 2026-09-17 17:14:51 +00:00
panxiao81 deleted branch feat/sandbox-spire-controller-bootstrap 2026-09-17 17:14:51 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
panxiao81 (Xiao Pan)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: panxiao81/homelab-infra#88