open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-23 12:05:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): add direct Vault KV worker secret custody

Browse Source
This commit is contained in:
whyour
2026-08-25 00:16:59 +08:00
parent a64d08bda1
commit 686873f8ec
25 changed files with 2830 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/kubernetes/ql3-cluster/README.md
+16
View File
@@ -1032,6 +1032,22 @@ Kubernetes API permission. Version-pinned SecretRefs use a different hash and
remain immutable by policy; retain their files until referenced Run/Artifact
retention has completed.
For deployments that require direct external custody, use the optional
`vault-kv-worker-secret` overlay instead of projecting value files:
```bash
kubectl kustomize \
deploy/kubernetes/ql3-cluster/vault-kv-worker-secret >/dev/null
```
That overlay mounts only a private Vault CA and a short-lived, orphan,
non-renewable read token. The adapter revalidates the token and fetches exact
digest-derived KV v2 paths over TLS 1.3 for every authorized delivery; it has no
cache, watcher, renewal loop or fallback to `mounted-files`. Follow the
overlay's README for the exact policy, payload and token-rotation contract.
External Vault HA, seal custody, audit devices, backup and disaster recovery
remain deployment-specific gates.
Create a distinct migration Secret:
```yaml