apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterSPIFFEID
metadata:
  name: gitea-dynamic-runner
spec:
  className: spire-mgmt-spire
  spiffeIDTemplate: 'spiffe://{{ .TrustDomain }}/ci/{{ index .PodMeta.Annotations "ci.ddupan.top/spiffe-path" }}'
  namespaceSelector:
    matchLabels:
      kubernetes.io/metadata.name: microvm-runner
  podSelector:
    matchLabels:
      app.kubernetes.io/name: gitea-dynamic-runner
      ci.ddupan.top/identity-bound: "true"
  workloadSelectorTemplates:
    - k8s:ns:microvm-runner
    - k8s:sa:gitea-dynamic-runner