feat(ql3): admit plugin secret action jobs

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/api-server-egress-patch.example.yaml

@@ -0,0 +1,12 @@
+# Example only. Copy into a private overlay and replace the placeholder with
+# the exact Kubernetes API endpoint CIDR. The base policy intentionally has no
+# broad TCP/443 escape hatch, so the controller fails closed without this rule.
+- op: add
+  path: /spec/egress/-
+  value:
+    to:
+      - ipBlock:
+          cidr: REPLACE_WITH_API_SERVER_CIDR
+    ports:
+      - protocol: TCP
+        port: 443

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/cron-job.yaml

@@ -26,7 +26,7 @@ spec:
             app.kubernetes.io/part-of: qinglong3
         spec:
           serviceAccountName: ql3-plugin-package-executor
-          automountServiceAccountToken: false
+          automountServiceAccountToken: true
           restartPolicy: Never
           securityContext:
             runAsNonRoot: true
@@ -65,6 +65,82 @@ spec:
                   value: '16'
                 - name: QL3_PLUGIN_PACKAGE_EXECUTOR_REVOCATION_MAX_PAGES
                   value: '16'
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_CONTROLLER_ENABLED
+                  value: 'true'
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_CONTROLLER_LIMIT
+                  value: '8'
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_NAMESPACE
+                  value: qinglong3-system
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_SERVICE_ACCOUNT
+                  valueFrom:
+                    configMapKeyRef:
+                      name: ql3-plugin-package-secret-action-admission
+                      key: serviceAccountName
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_SOURCE_SECRET
+                  valueFrom:
+                    configMapKeyRef:
+                      name: ql3-plugin-package-secret-action-admission
+                      key: sourceSecretName
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_IMAGE
+                  valueFrom:
+                    configMapKeyRef:
+                      name: ql3-plugin-package-secret-action-admission
+                      key: image
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_CA_SECRET
+                  valueFrom:
+                    configMapKeyRef:
+                      name: ql3-plugin-package-secret-action-admission
+                      key: postgresCaSecretName
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_CA_KEY
+                  valueFrom:
+                    configMapKeyRef:
+                      name: ql3-plugin-package-secret-action-admission
+                      key: postgresCaKey
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_SERVERNAME
+                  valueFrom:
+                    configMapKeyRef:
+                      name: ql3-plugin-package-secret-action-admission
+                      key: postgresServerName
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_URL_SECRET
+                  valueFrom:
+                    configMapKeyRef:
+                      name: ql3-plugin-package-secret-action-admission
+                      key: postgresUrlSecretName
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_URL_KEY
+                  valueFrom:
+                    configMapKeyRef:
+                      name: ql3-plugin-package-secret-action-admission
+                      key: postgresUrlSecretKey
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_AUTH_SECRET
+                  valueFrom:
+                    configMapKeyRef:
+                      name: ql3-plugin-package-secret-action-admission
+                      key: postgresAuthSecretName
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_HOST
+                  valueFrom:
+                    configMapKeyRef:
+                      name: ql3-plugin-package-secret-action-admission
+                      key: postgresHost
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_PORT
+                  valueFrom:
+                    configMapKeyRef:
+                      name: ql3-plugin-package-secret-action-admission
+                      key: postgresPort
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_DATABASE
+                  valueFrom:
+                    configMapKeyRef:
+                      name: ql3-plugin-package-secret-action-admission
+                      key: postgresDatabase
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_USERNAME_KEY
+                  valueFrom:
+                    configMapKeyRef:
+                      name: ql3-plugin-package-secret-action-admission
+                      key: postgresUsernameKey
+                - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_PASSWORD_KEY
+                  valueFrom:
+                    configMapKeyRef:
+                      name: ql3-plugin-package-secret-action-admission
+                      key: postgresPasswordKey
                 - name: QL3_POSTGRES_TLS_MODE
                   value: verify-full
                 - name: QL3_POSTGRES_TLS_CA_FILE

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/kustomization.yaml

@@ -3,5 +3,11 @@ kind: Kustomization
 
 resources:
   - service-account.yaml
+  - secret-action-service-account.yaml
+  - secret-action-admission-config.yaml
+  - role.yaml
+  - role-binding.yaml
+  - validating-admission-policy.yaml
+  - validating-admission-policy-binding.yaml
   - cron-job.yaml
   - network-policy.yaml

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/role-binding.yaml

@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ql3-plugin-package-executor
+  namespace: qinglong3-system
+  labels:
+    app.kubernetes.io/name: ql3-plugin-package-executor
+    app.kubernetes.io/component: plugin-package-executor
+    app.kubernetes.io/part-of: qinglong3
+subjects:
+  - kind: ServiceAccount
+    name: ql3-plugin-package-executor
+    namespace: qinglong3-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ql3-plugin-package-executor

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/role.yaml

@@ -0,0 +1,25 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ql3-plugin-package-executor
+  namespace: qinglong3-system
+  labels:
+    app.kubernetes.io/name: ql3-plugin-package-executor
+    app.kubernetes.io/component: plugin-package-executor
+    app.kubernetes.io/part-of: qinglong3
+rules:
+  - apiGroups:
+      - batch
+    resources:
+      - jobs
+    verbs:
+      - create
+      - get
+  - apiGroups:
+      - ''
+    resources:
+      - configmaps
+    resourceNames:
+      - ql3-plugin-package-secret-action-admission
+    verbs:
+      - get

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/secret-action-admission-config.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ql3-plugin-package-secret-action-admission
+  namespace: qinglong3-system
+  labels:
+    app.kubernetes.io/name: ql3-plugin-package-secret-action
+    app.kubernetes.io/component: plugin-package-executor
+    app.kubernetes.io/part-of: qinglong3
+data:
+  # Release automation must replace this unavailable digest together with the
+  # controller image before the opt-in operation can execute.
+  image: registry.example.com/qinglong/qinglong3-cluster-admin@sha256:0000000000000000000000000000000000000000000000000000000000000000
+  serviceAccountName: ql3-plugin-package-secret-action
+  sourceSecretName: ql3-cluster-plugin-package-values
+  postgresConnectionMode: url
+  postgresCaSecretName: ql3-cluster-plugin-package-executor
+  postgresCaKey: postgres-ca.crt
+  postgresServerName: REPLACE_WITH_POSTGRES_DNS_NAME
+  postgresUrlSecretName: ql3-cluster-plugin-package-executor
+  postgresUrlSecretKey: postgres-package-executor-url
+  postgresAuthSecretName: ''
+  postgresHost: ''
+  postgresPort: ''
+  postgresDatabase: ''
+  postgresUsernameKey: ''
+  postgresPasswordKey: ''

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/secret-action-service-account.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ql3-plugin-package-secret-action
+  namespace: qinglong3-system
+  labels:
+    app.kubernetes.io/name: ql3-plugin-package-secret-action
+    app.kubernetes.io/component: plugin-package-executor
+    app.kubernetes.io/part-of: qinglong3
+automountServiceAccountToken: false

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/validating-admission-policy-binding.yaml

@@ -0,0 +1,20 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: ql3-plugin-package-secret-action
+  labels:
+    app.kubernetes.io/name: ql3-plugin-package-secret-action
+    app.kubernetes.io/component: plugin-package-executor
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  policyName: ql3-plugin-package-secret-action
+  paramRef:
+    name: ql3-plugin-package-secret-action-admission
+    namespace: qinglong3-system
+    parameterNotFoundAction: Deny
+  matchResources:
+    namespaceSelector:
+      matchLabels:
+        kubernetes.io/metadata.name: qinglong3-system
+  validationActions:
+    - Deny

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/base/validating-admission-policy.yaml

@@ -0,0 +1,163 @@
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: ql3-plugin-package-secret-action
+  labels:
+    app.kubernetes.io/name: ql3-plugin-package-secret-action
+    app.kubernetes.io/component: plugin-package-executor
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  failurePolicy: Fail
+  paramKind:
+    apiVersion: v1
+    kind: ConfigMap
+  matchConstraints:
+    resourceRules:
+      - apiGroups:
+          - batch
+        apiVersions:
+          - v1
+        operations:
+          - CREATE
+        resources:
+          - jobs
+        scope: Namespaced
+  matchConditions:
+    - name: exact-controller-identity
+      expression: request.userInfo.username == 'system:serviceaccount:qinglong3-system:ql3-plugin-package-executor'
+  variables:
+    - name: pod
+      expression: object.spec.template.spec
+    - name: executor
+      expression: variables.pod.containers[0]
+    - name: values
+      expression: variables.pod.volumes.filter(v, v.name == 'plugin-package-values')[0]
+    - name: ca
+      expression: variables.pod.volumes.filter(v, v.name == 'postgres-ca')[0]
+  validations:
+    - expression: >-
+        object.metadata.namespace == 'qinglong3-system' &&
+        object.metadata.name.matches('^ql3-package-secret-[0-9a-f]{32}$') &&
+        object.metadata.name == 'ql3-package-secret-' + object.metadata.annotations['qinglong.io/secret-action-job-digest'].substring(0, 32) &&
+        object.metadata.labels['app.kubernetes.io/name'] == 'ql3-plugin-package-secret-action' &&
+        object.metadata.labels['app.kubernetes.io/component'] == 'plugin-package-executor' &&
+        object.metadata.labels['app.kubernetes.io/part-of'] == 'qinglong3' &&
+        object.metadata.annotations['qinglong.io/secret-action-job-schema'] == 'qinglong/plugin-package-kubernetes-secret-action-job@v1' &&
+        object.metadata.annotations['qinglong.io/secret-action-job-digest'].matches('^[0-9a-f]{64}$') &&
+        object.metadata.annotations['qinglong.io/approved-action-digest'].matches('^[0-9a-f]{64}$') &&
+        object.metadata.annotations['qinglong.io/approved-action-type'] in ['plugin_package.secret_binding.bind', 'plugin_package.secret_binding.transition']
+      message: Secret action Job metadata is outside the reviewed contract
+    - expression: >-
+        object.spec.backoffLimit == 2 &&
+        object.spec.activeDeadlineSeconds == 600 &&
+        object.spec.ttlSecondsAfterFinished == 3600 &&
+        variables.pod.serviceAccountName == params.data.serviceAccountName &&
+        object.spec.template.metadata.labels['app.kubernetes.io/name'] == 'ql3-plugin-package-secret-action' &&
+        object.spec.template.metadata.labels['app.kubernetes.io/component'] == 'plugin-package-executor' &&
+        object.spec.template.metadata.labels['app.kubernetes.io/part-of'] == 'qinglong3' &&
+        object.spec.template.metadata.labels['qinglong.io/secret-action-job'] == object.metadata.name &&
+        variables.pod.automountServiceAccountToken == false &&
+        variables.pod.enableServiceLinks == false &&
+        variables.pod.restartPolicy == 'Never' &&
+        (!has(variables.pod.hostNetwork) || variables.pod.hostNetwork == false) &&
+        (!has(variables.pod.hostPID) || variables.pod.hostPID == false) &&
+        (!has(variables.pod.hostIPC) || variables.pod.hostIPC == false) &&
+        (!has(variables.pod.shareProcessNamespace) || variables.pod.shareProcessNamespace == false) &&
+        (!has(variables.pod.initContainers) || variables.pod.initContainers.size() == 0) &&
+        (!has(variables.pod.ephemeralContainers) || variables.pod.ephemeralContainers.size() == 0) &&
+        variables.pod.containers.size() == 1 &&
+        variables.pod.volumes.size() == 3
+      message: Secret action Job Pod authority is outside the reviewed contract
+    - expression: >-
+        variables.pod.securityContext.runAsNonRoot == true &&
+        variables.pod.securityContext.runAsUser == 10001 &&
+        variables.pod.securityContext.runAsGroup == 10001 &&
+        variables.pod.securityContext.fsGroup == 10001 &&
+        variables.pod.securityContext.seccompProfile.type == 'RuntimeDefault' &&
+        variables.executor.name == 'executor' &&
+        variables.executor.image == params.data.image &&
+        variables.executor.imagePullPolicy == 'IfNotPresent' &&
+        variables.executor.command == ['node', '/opt/qinglong/node_modules/@qinglong/cluster-admin/dist/plugin-package/executor/pluginPackageExecutorCli.js'] &&
+        variables.executor.securityContext.allowPrivilegeEscalation == false &&
+        variables.executor.securityContext.readOnlyRootFilesystem == true &&
+        variables.executor.securityContext.capabilities.drop == ['ALL'] &&
+        variables.executor.resources.requests.cpu == '25m' &&
+        variables.executor.resources.requests.memory == '48Mi' &&
+        variables.executor.resources.limits.cpu == '250m' &&
+        variables.executor.resources.limits.memory == '192Mi'
+      message: Secret action Job executor image, command or sandbox is outside the reviewed contract
+    - expression: >-
+        ((params.data.postgresConnectionMode == 'url' && variables.executor.env.size() == 11) ||
+         (params.data.postgresConnectionMode == 'fields' && variables.executor.env.size() == 15)) &&
+        variables.executor.env.all(e, e.name in [
+          'QL3_PLUGIN_PACKAGE_EXECUTOR_ENABLED',
+          'QL3_PLUGIN_PACKAGE_EXECUTOR_OWNER',
+          'QL3_PLUGIN_PACKAGE_EXECUTOR_DISPATCH_ID',
+          'QL3_PLUGIN_PACKAGE_EXECUTOR_SECRET_ROOT',
+          'QL3_PLUGIN_PACKAGE_EXECUTOR_LEASE_DURATION_MS',
+          'QL3_POSTGRES_TLS_MODE',
+          'QL3_POSTGRES_TLS_CA_FILE',
+          'QL3_POSTGRES_TLS_SERVERNAME',
+          'QL3_POSTGRES_APPLICATION_NAME',
+          'QL3_POSTGRES_MAX_CONNECTIONS',
+          'QL3_POSTGRES_PACKAGE_EXECUTOR_URL',
+          'QL3_POSTGRES_PACKAGE_EXECUTOR_HOST',
+          'QL3_POSTGRES_PACKAGE_EXECUTOR_PORT',
+          'QL3_POSTGRES_PACKAGE_EXECUTOR_DATABASE',
+          'QL3_POSTGRES_PACKAGE_EXECUTOR_USER',
+          'QL3_POSTGRES_PACKAGE_EXECUTOR_PASSWORD'
+        ]) &&
+        variables.executor.env.exists_one(e, e.name == 'QL3_PLUGIN_PACKAGE_EXECUTOR_ENABLED' && e.value == 'true') &&
+        variables.executor.env.exists_one(e, e.name == 'QL3_PLUGIN_PACKAGE_EXECUTOR_OWNER' && e.value.matches('^package_secret_[0-9a-f]{24}$')) &&
+        variables.executor.env.exists_one(e, e.name == 'QL3_PLUGIN_PACKAGE_EXECUTOR_DISPATCH_ID' && e.value.matches('^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$')) &&
+        variables.executor.env.exists_one(e, e.name == 'QL3_PLUGIN_PACKAGE_EXECUTOR_SECRET_ROOT' && e.value == '/var/run/secrets/qinglong3/plugin-package-values') &&
+        variables.executor.env.exists_one(e, e.name == 'QL3_PLUGIN_PACKAGE_EXECUTOR_LEASE_DURATION_MS' && e.value == '600000') &&
+        variables.executor.env.exists_one(e, e.name == 'QL3_POSTGRES_TLS_MODE' && e.value == 'verify-full') &&
+        variables.executor.env.exists_one(e, e.name == 'QL3_POSTGRES_TLS_CA_FILE' && e.value == '/var/run/secrets/qinglong3/postgres/ca.crt') &&
+        variables.executor.env.exists_one(e, e.name == 'QL3_POSTGRES_TLS_SERVERNAME' && e.value == params.data.postgresServerName) &&
+        variables.executor.env.exists_one(e, e.name == 'QL3_POSTGRES_APPLICATION_NAME' && e.value == 'qinglong3-package-secret-action') &&
+        variables.executor.env.exists_one(e, e.name == 'QL3_POSTGRES_MAX_CONNECTIONS' && e.value == '1')
+      message: Secret action Job environment is outside the reviewed contract
+    - expression: >-
+        (params.data.postgresConnectionMode == 'url' &&
+          variables.executor.env.exists_one(e,
+            e.name == 'QL3_POSTGRES_PACKAGE_EXECUTOR_URL' &&
+            e.valueFrom.secretKeyRef.name == params.data.postgresUrlSecretName &&
+            e.valueFrom.secretKeyRef.key == params.data.postgresUrlSecretKey) &&
+          !variables.executor.env.exists(e, e.name in ['QL3_POSTGRES_PACKAGE_EXECUTOR_HOST', 'QL3_POSTGRES_PACKAGE_EXECUTOR_PORT', 'QL3_POSTGRES_PACKAGE_EXECUTOR_DATABASE', 'QL3_POSTGRES_PACKAGE_EXECUTOR_USER', 'QL3_POSTGRES_PACKAGE_EXECUTOR_PASSWORD'])) ||
+        (params.data.postgresConnectionMode == 'fields' &&
+          !variables.executor.env.exists(e, e.name == 'QL3_POSTGRES_PACKAGE_EXECUTOR_URL') &&
+          variables.executor.env.exists_one(e, e.name == 'QL3_POSTGRES_PACKAGE_EXECUTOR_HOST' && e.value == params.data.postgresHost) &&
+          variables.executor.env.exists_one(e, e.name == 'QL3_POSTGRES_PACKAGE_EXECUTOR_PORT' && e.value == params.data.postgresPort) &&
+          variables.executor.env.exists_one(e, e.name == 'QL3_POSTGRES_PACKAGE_EXECUTOR_DATABASE' && e.value == params.data.postgresDatabase) &&
+          variables.executor.env.exists_one(e, e.name == 'QL3_POSTGRES_PACKAGE_EXECUTOR_USER' && e.valueFrom.secretKeyRef.name == params.data.postgresAuthSecretName && e.valueFrom.secretKeyRef.key == params.data.postgresUsernameKey) &&
+          variables.executor.env.exists_one(e, e.name == 'QL3_POSTGRES_PACKAGE_EXECUTOR_PASSWORD' && e.valueFrom.secretKeyRef.name == params.data.postgresAuthSecretName && e.valueFrom.secretKeyRef.key == params.data.postgresPasswordKey))
+      message: Secret action Job database authority is outside the reviewed contract
+    - expression: >-
+        variables.executor.volumeMounts.size() == 3 &&
+        variables.executor.volumeMounts[0].name == 'tmp' &&
+        variables.executor.volumeMounts[0].mountPath == '/tmp' &&
+        (!has(variables.executor.volumeMounts[0].readOnly) || variables.executor.volumeMounts[0].readOnly == false) &&
+        variables.executor.volumeMounts[1].name == 'postgres-ca' &&
+        variables.executor.volumeMounts[1].mountPath == '/var/run/secrets/qinglong3/postgres' &&
+        variables.executor.volumeMounts[1].readOnly == true &&
+        variables.executor.volumeMounts[2].name == 'plugin-package-values' &&
+        variables.executor.volumeMounts[2].mountPath == '/var/run/secrets/qinglong3/plugin-package-values' &&
+        variables.executor.volumeMounts[2].readOnly == true &&
+        variables.pod.volumes.exists_one(v, v.name == 'tmp' && v.emptyDir.medium == 'Memory' && v.emptyDir.sizeLimit == '8Mi') &&
+        variables.ca.secret.secretName == params.data.postgresCaSecretName &&
+        variables.ca.secret.optional == false &&
+        variables.ca.secret.defaultMode == 292 &&
+        variables.ca.secret.items.size() == 1 &&
+        variables.ca.secret.items[0].key == params.data.postgresCaKey &&
+        variables.ca.secret.items[0].path == 'ca.crt' &&
+        ((has(variables.values.secret) &&
+          variables.values.secret.secretName == params.data.sourceSecretName &&
+          variables.values.secret.optional == false &&
+          variables.values.secret.defaultMode == 288 &&
+          variables.values.secret.items.size() >= 1 &&
+          variables.values.secret.items.size() <= 64 &&
+          variables.values.secret.items.all(i, i.key.matches('^[0-9a-f]{64}$') && i.path == i.key) &&
+          variables.values.secret.items.all(i, variables.values.secret.items.filter(j, j.key == i.key).size() == 1)) ||
+         (has(variables.values.emptyDir) && variables.values.emptyDir.sizeLimit == '1Ki'))
+      message: Secret action Job volumes are outside the exact-key projection contract

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/cloudnative-pg/cron-job-patch.yaml

@@ -17,6 +17,82 @@
       value: '16'
     - name: QL3_PLUGIN_PACKAGE_EXECUTOR_REVOCATION_MAX_PAGES
       value: '16'
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_CONTROLLER_ENABLED
+      value: 'true'
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_CONTROLLER_LIMIT
+      value: '8'
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_NAMESPACE
+      value: qinglong3-system
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_SERVICE_ACCOUNT
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: serviceAccountName
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_SOURCE_SECRET
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: sourceSecretName
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_IMAGE
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: image
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_CA_SECRET
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresCaSecretName
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_CA_KEY
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresCaKey
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_SERVERNAME
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresServerName
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_URL_SECRET
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresUrlSecretName
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_URL_KEY
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresUrlSecretKey
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_AUTH_SECRET
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresAuthSecretName
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_HOST
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresHost
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_PORT
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresPort
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_DATABASE
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresDatabase
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_USERNAME_KEY
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresUsernameKey
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_PASSWORD_KEY
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresPasswordKey
     - name: QL3_POSTGRES_TLS_MODE
       value: verify-full
     - name: QL3_POSTGRES_TLS_CA_FILE

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/cloudnative-pg/kustomization.yaml

@@ -17,6 +17,11 @@ patches:
       kind: NetworkPolicy
       name: ql3-plugin-package-executor
     path: network-policy-patch.yaml
+  - target:
+      version: v1
+      kind: ConfigMap
+      name: ql3-plugin-package-secret-action-admission
+    path: secret-action-admission-config-patch.yaml
 
 images:
   - name: qinglong3-cluster-admin

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/cloudnative-pg/secret-action-admission-config-patch.yaml

@@ -0,0 +1,18 @@
+- op: replace
+  path: /data
+  value:
+    image: registry.example.com/qinglong/qinglong3-cluster-admin@sha256:0000000000000000000000000000000000000000000000000000000000000000
+    serviceAccountName: ql3-plugin-package-secret-action
+    sourceSecretName: ql3-cluster-plugin-package-values
+    postgresConnectionMode: fields
+    postgresCaSecretName: ql3-postgres-ca
+    postgresCaKey: ca.crt
+    postgresServerName: ql3-postgres-rw.qinglong3-system.svc
+    postgresUrlSecretName: ''
+    postgresUrlSecretKey: ''
+    postgresAuthSecretName: ql3-postgres-package-executor-auth
+    postgresHost: ql3-postgres-rw.qinglong3-system.svc
+    postgresPort: '5432'
+    postgresDatabase: qinglong
+    postgresUsernameKey: username
+    postgresPasswordKey: password

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/config.example.yaml

@@ -21,3 +21,7 @@ metadata:
   namespace: qinglong3-system
 type: Opaque
 data: {}
+
+# The controller also needs one private-overlay NetworkPolicy patch containing
+# only the exact Kubernetes API endpoint CIDR and TCP port. Start from
+# api-server-egress-patch.example.yaml; do not permit arbitrary TCP/443 egress.