Skip to content
Reference
Managed Resources

Managed Resources

Primary Managed Output

kleym-operator manages ClusterSPIFFEID resources in spire.spiffe.io.

Rendered Field Mapping

FieldRendered value
spec.spiffeIDTemplateFully rendered SPIFFE ID.
spec.podSelectorValidated selector derived from the referenced pool.
spec.workloadSelectorTemplatesRendered namespace and service-account safety selectors, pool-derived selectors, and the optional per-objective container-name selector.
spec.classNameRendered only when kleym-operator is configured with --clusterspiffeid-class-name. When omitted, SPIRE Controller Manager must watch classless resources.
spec.fallbackfalse for all managed identities.
spec.hintOriginating binding reference in the form <namespace>/<binding-name>.
JWT-SVID-related fieldsNot rendered today. Requires a user story and SPIRE Controller Manager/SPIRE version gate.

Managed ClusterSPIFFEID objects are labeled with:

  • kleym.sonda.red/managed-by=kleym
  • kleym.sonda.red/binding-name=<binding-name>
  • kleym.sonda.red/binding-namespace=<binding-namespace>

The controller also uses the finalizer kleym.sonda.red/inferenceidentitybinding-finalizer to clean up managed ClusterSPIFFEID objects on deletion.

Naming

Managed ClusterSPIFFEID names are deterministic and derived from:

  • the kleym-operator controller name
  • binding namespace
  • binding name
  • rendered mode (pool or objective)
  • a short hash of the SPIFFE ID

That keeps names DNS-safe while allowing the SPIFFE ID to remain the real identity contract.

Other Resources Touched

ResourceRole
InferenceIdentityBindingSource resource for managed output.
InferencePoolRequired selector source resolved from spec.poolRef.name.
InferenceObjectiveOptional objective subject resolved from spec.objectiveRef.name and validated against spec.poolRef.
ClusterSPIFFEIDManaged output resource written by the reconciler.

Read And Watch Behavior

The controller:

  • watches InferenceIdentityBinding
  • watches supported InferencePool objects and maps them back to bindings whose spec.poolRef.name references those pools
  • watches supported InferenceObjective objects and maps them back to bindings whose optional spec.objectiveRef.name references those objectives
Last updated on
ConditionsCompatibility