---
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterSPIFFEID
metadata:
  name: nsm-workloads
spec:
  spiffeIDTemplate: "spiffe://k8s.nsm/ns/{{.PodMeta.Namespace}}/pod/{{.PodMeta.Name}}"
  podSelector:
    matchLabels:
      "spiffe.io/spiffe-id": "true"