feat(ql3): complete cluster secret binding authority

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/cron-job.yaml

@@ -65,6 +65,8 @@ spec:
                   value: '16'
                 - name: QL3_PLUGIN_PACKAGE_EXECUTOR_REVOCATION_MAX_PAGES
                   value: '16'
+                - name: QL3_PLUGIN_PACKAGE_EXECUTOR_SECRET_ROOT
+                  value: /var/run/secrets/qinglong3/plugin-package-values
                 - name: QL3_POSTGRES_TLS_MODE
                   value: verify-full
                 - name: QL3_POSTGRES_TLS_CA_FILE
@@ -96,6 +98,9 @@ spec:
                 - name: postgres-package-executor-ca
                   mountPath: /var/run/secrets/qinglong3/postgres-package-executor
                   readOnly: true
+                - name: plugin-package-values
+                  mountPath: /var/run/secrets/qinglong3/plugin-package-values
+                  readOnly: true
           volumes:
             - name: tmp
               emptyDir:
@@ -108,3 +113,8 @@ spec:
                 items:
                   - key: postgres-ca.crt
                     path: ca.crt
+            - name: plugin-package-values
+              secret:
+                secretName: ql3-cluster-plugin-package-values
+                optional: true
+                defaultMode: 288

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/cloudnative-pg/cron-job-patch.yaml

@@ -17,6 +17,8 @@
       value: '16'
     - name: QL3_PLUGIN_PACKAGE_EXECUTOR_REVOCATION_MAX_PAGES
       value: '16'
+    - name: QL3_PLUGIN_PACKAGE_EXECUTOR_SECRET_ROOT
+      value: /var/run/secrets/qinglong3/plugin-package-values
     - name: QL3_POSTGRES_TLS_MODE
       value: verify-full
     - name: QL3_POSTGRES_TLS_CA_FILE

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/config.example.yaml

@@ -10,3 +10,13 @@ stringData:
   postgres-package-executor-url: REPLACE_WITH_PACKAGE_EXECUTOR_DSN
   postgres-tls-servername: REPLACE_WITH_POSTGRES_DNS_NAME
   postgres-ca.crt: REPLACE_WITH_POSTGRES_CA_CERTIFICATE
+---
+# Optional SecretRef projection. Each key is the lowercase SHA-256 of the
+# canonical qlsecret:v1 reference; the executor checks metadata only.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-cluster-plugin-package-values
+  namespace: qinglong3-system
+type: Opaque
+data: {}