From 3b77af8da1c0251c7f6983dca7d88caea1276d0d Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Fri, 18 Sep 2026 00:24:21 +0000 Subject: [PATCH] =?UTF-8?q?feat:=20=E5=88=87=E6=8D=A2=20SPIRE=20=E5=88=B0?= =?UTF-8?q?=E5=86=85=E9=83=A8=20chart=20fork?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- clusters/homelab/README.md | 3 ++- platform/spire/README.md | 9 ++++++++- platform/spire/RUNBOOK.md | 2 +- platform/spire/gitrepository-fork.yaml | 11 +++++++++++ platform/spire/helmrelease.yaml | 8 ++++---- platform/spire/kustomization.yaml | 1 + platform/spire/values.yaml | 5 +++++ 7 files changed, 32 insertions(+), 7 deletions(-) create mode 100644 platform/spire/gitrepository-fork.yaml diff --git a/clusters/homelab/README.md b/clusters/homelab/README.md index 7a3694e..0eae482 100644 --- a/clusters/homelab/README.md +++ b/clusters/homelab/README.md @@ -50,6 +50,7 @@ sudo k3s kubectl -n flux-system get gitrepositories,kustomizations - VictoriaMetrics Operator 已固定现有 chart `0.66.2` 并完成分阶段 Flux HelmRelease 接管；Metrics、Logs、Traces 与 Grafana 也已统一完成 Flux 接管； - External Secrets Operator 已固定 chart `2.8.0` 并完成分阶段接管； -- SPIRE 已按官方 hardened chart `0.30.2`（SPIRE `1.15.3`）声明，使用共享 +- SPIRE 已按 hardened chart 内部 fork `0.30.2-ddupan.1`（基于上游 `0.30.2`，SPIRE + `1.15.3`）声明，使用共享 PostgreSQL 与独立 signing-key PVC；首次上线和 OpenBao JWT-SVID PoC 尚待合并后验证； - root Kustomization 与所有 brownfield 子 Kustomization 继续保持 `prune: false`。 diff --git a/platform/spire/README.md b/platform/spire/README.md index 2bf4486..ec07cab 100644 --- a/platform/spire/README.md +++ b/platform/spire/README.md @@ -11,7 +11,8 @@ Authelia 提供；SPIRE 不替代人类 OIDC，也不承担目标服务的资源 Flux 安装 SPIFFE hardened charts： - `spire-crds` `0.6.1`； -- `spire` `0.30.2`（SPIRE `1.15.3`）； +- 内部 fork 的 `spire` `0.30.2-ddupan.1`（SPIRE `1.15.3`），固定 Git tag + `spire-0.30.2-ddupan.1`； - SPIRE Server、Agent、Controller Manager、SPIFFE CSI Driver； - OIDC Discovery Provider。 @@ -24,6 +25,12 @@ API 或 Broker API。Trust domain 是 `ddupan.top`，Kubernetes cluster name 是 controller-manager 与 bundle publisher 使用由 sandbox Ansible bootstrap 的独立、受限 kubeconfig。Sandbox 不运行第二套 Server 或 OIDC Provider。 +内部 fork 仅在上游 `spire-0.30.2` 基础上暴露 +`use_pod_uid_for_agent_id`。现有 `sandbox` profile 保持 node UID 模式，供 DaemonSet +Agent 使用；独立的 `sandbox-kata` profile 复用同一 kubeconfig，但启用 Pod UID 模式， +供每个 Kata guest 内的临时 Agent 使用。不得把现有 `sandbox` profile 切换为 Pod UID， +否则会改变常驻 Agent 的 parent ID。 + ## PostgreSQL bootstrap SPIRE registration datastore 使用共享 CloudNativePG： diff --git a/platform/spire/RUNBOOK.md b/platform/spire/RUNBOOK.md index 4274fd9..5559e06 100644 --- a/platform/spire/RUNBOOK.md +++ b/platform/spire/RUNBOOK.md @@ -41,7 +41,7 @@ SPIRE Server（trust domain: ddupan.top） | 项目 | 当前值 | |---|---| -| SPIRE chart | `0.30.2` | +| SPIRE chart | `0.30.2-ddupan.1`（内部 fork，基于 `0.30.2`） | | SPIRE | `1.15.3` | | SPIRE CRDs chart | `0.6.1` | | trust domain | `ddupan.top` | diff --git a/platform/spire/gitrepository-fork.yaml b/platform/spire/gitrepository-fork.yaml new file mode 100644 index 0000000..bdf798f --- /dev/null +++ b/platform/spire/gitrepository-fork.yaml @@ -0,0 +1,11 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: GitRepository +metadata: + name: spiffe-hardened-fork + namespace: spire-mgmt +spec: + interval: 1h + ref: + tag: spire-0.30.2-ddupan.1 + timeout: 60s + url: http://gitea-http.gitea.svc.cluster.local:3000/panxiao81/helm-charts-hardened.git diff --git a/platform/spire/helmrelease.yaml b/platform/spire/helmrelease.yaml index dd21292..aa8038a 100644 --- a/platform/spire/helmrelease.yaml +++ b/platform/spire/helmrelease.yaml @@ -6,12 +6,12 @@ metadata: spec: chart: spec: - chart: spire + chart: ./charts/spire interval: 1h + reconcileStrategy: Revision sourceRef: - kind: HelmRepository - name: spiffe-hardened - version: 0.30.2 + kind: GitRepository + name: spiffe-hardened-fork dependsOn: - name: spire-crds namespace: spire-mgmt diff --git a/platform/spire/kustomization.yaml b/platform/spire/kustomization.yaml index 6894182..28a9b33 100644 --- a/platform/spire/kustomization.yaml +++ b/platform/spire/kustomization.yaml @@ -12,6 +12,7 @@ configMapGenerator: resources: - namespaces.yaml - helmrepository.yaml + - gitrepository-fork.yaml - helmrelease-crds.yaml - helmrelease.yaml - httproute.yaml diff --git a/platform/spire/values.yaml b/platform/spire/values.yaml index 01e3381..2675a90 100644 --- a/platform/spire/values.yaml +++ b/platform/spire/values.yaml @@ -51,6 +51,11 @@ spire-server: kubeConfigName: sandbox serviceAccountAllowList: - spire-system:spire-agent + sandbox-kata: + kubeConfigName: sandbox + serviceAccountAllowList: + - spire-smoke:spire-smoke + usePodUIDForAgentID: true externalControllerManagers: enabled: true clusters: -- 2.54.0