Downward API 与投射卷：向容器注入 Pod 元数据、令牌、信任包与证书

apiVersion: v1
kind: Pod
metadata:
  name: downward-demo
  labels:
    app: demo
    version: v2
spec:
  containers:
  - name: app
    image: registry.example.com/app:1.0
    env:
    - name: POD_NAME
      valueFrom:
        fieldRef:
          fieldPath: metadata.name
    - name: POD_NAMESPACE
      valueFrom:
        fieldRef:
          fieldPath: metadata.namespace
    - name: NODE_NAME
      valueFrom:
        fieldRef:
          fieldPath: spec.nodeName
    - name: POD_IP
      valueFrom:
        fieldRef:
          fieldPath: status.podIP
    - name: APP_VERSION
      valueFrom:
        fieldRef:
          fieldPath: metadata.labels['version']
    - name: GOMAXPROCS                      # Go 运行时按 CPU limit 设置并发度
      valueFrom:
        resourceFieldRef:
          resource: limits.cpu
          divisor: "1"
    - name: MEMORY_LIMIT_MB                 # JVM -Xmx 等按 limit 推导
      valueFrom:
        resourceFieldRef:
          resource: limits.memory
          divisor: 1Mi
    resources:
      requests: { cpu: 500m, memory: 512Mi }
      limits: { cpu: "2", memory: 1Gi }
    volumeMounts:
    - name: podinfo
      mountPath: /etc/podinfo
      readOnly: true
  volumes:
  - name: podinfo
    downwardAPI:
      items:
      - path: labels
        fieldRef:
          fieldPath: metadata.labels
      - path: annotations
        fieldRef:
          fieldPath: metadata.annotations

volumes:
- name: vault-token
  projected:
    sources:
    - serviceAccountToken:
        audience: vault.example.com
        expirationSeconds: 3600
        path: token

volumes:
- name: trust
  projected:
    sources:
    - clusterTrustBundle:
        signerName: example.com/internal-ca       # 选择该签名者的所有信任包并合并
        labelSelector:
          matchLabels:
            env: prod
        path: ca-bundle.pem
        optional: true                            # 无匹配时写入空文件而非阻塞启动

volumes:
- name: identity
  projected:
    sources:
    - podCertificate:
        signerName: example.com/workload-identity
        keyType: ECDSAP256                        # ED25519 / ECDSAP256 / ECDSAP384 / ECDSAP521 / RSA3072 / RSA4096
        maxExpirationSeconds: 86400               # 1 小时至 91 天，默认 24 小时
        credentialBundlePath: credentials.pem     # 私钥 + 证书链合并为一个 PEM，便于原子重载
        # 或分开写入：keyPath / certificateChainPath
        userAnnotations:
          example.com/service: payments           # 原样传给签名者，签名者须自行校验

volumes:
- name: workload-identity
  projected:
    defaultMode: 0400
    sources:
    - serviceAccountToken:
        audience: internal-api
        expirationSeconds: 3600
        path: token
    - podCertificate:
        signerName: example.com/workload-identity
        keyType: ECDSAP256
        credentialBundlePath: tls/credentials.pem
    - clusterTrustBundle:
        signerName: example.com/workload-identity
        path: tls/ca.pem
    - downwardAPI:
        items:
        - path: pod-name
          fieldRef:
            fieldPath: metadata.name