feat(ql3): admit plugin secret action jobs

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/cloudnative-pg/cron-job-patch.yaml

@@ -17,6 +17,82 @@
       value: '16'
     - name: QL3_PLUGIN_PACKAGE_EXECUTOR_REVOCATION_MAX_PAGES
       value: '16'
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_CONTROLLER_ENABLED
+      value: 'true'
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_CONTROLLER_LIMIT
+      value: '8'
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_NAMESPACE
+      value: qinglong3-system
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_SERVICE_ACCOUNT
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: serviceAccountName
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_SOURCE_SECRET
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: sourceSecretName
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_IMAGE
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: image
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_CA_SECRET
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresCaSecretName
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_CA_KEY
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresCaKey
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_SERVERNAME
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresServerName
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_URL_SECRET
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresUrlSecretName
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_URL_KEY
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresUrlSecretKey
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_AUTH_SECRET
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresAuthSecretName
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_HOST
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresHost
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_PORT
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresPort
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_DATABASE
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresDatabase
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_USERNAME_KEY
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresUsernameKey
+    - name: QL3_PLUGIN_PACKAGE_SECRET_ACTION_POSTGRES_PASSWORD_KEY
+      valueFrom:
+        configMapKeyRef:
+          name: ql3-plugin-package-secret-action-admission
+          key: postgresPasswordKey
     - name: QL3_POSTGRES_TLS_MODE
       value: verify-full
     - name: QL3_POSTGRES_TLS_CA_FILE

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/cloudnative-pg/kustomization.yaml

@@ -17,6 +17,11 @@ patches:
       kind: NetworkPolicy
       name: ql3-plugin-package-executor
     path: network-policy-patch.yaml
+  - target:
+      version: v1
+      kind: ConfigMap
+      name: ql3-plugin-package-secret-action-admission
+    path: secret-action-admission-config-patch.yaml
 
 images:
   - name: qinglong3-cluster-admin

deploy/kubernetes/ql3-cluster/operations/plugin-package-executor/cloudnative-pg/secret-action-admission-config-patch.yaml

@@ -0,0 +1,18 @@
+- op: replace
+  path: /data
+  value:
+    image: registry.example.com/qinglong/qinglong3-cluster-admin@sha256:0000000000000000000000000000000000000000000000000000000000000000
+    serviceAccountName: ql3-plugin-package-secret-action
+    sourceSecretName: ql3-cluster-plugin-package-values
+    postgresConnectionMode: fields
+    postgresCaSecretName: ql3-postgres-ca
+    postgresCaKey: ca.crt
+    postgresServerName: ql3-postgres-rw.qinglong3-system.svc
+    postgresUrlSecretName: ''
+    postgresUrlSecretKey: ''
+    postgresAuthSecretName: ql3-postgres-package-executor-auth
+    postgresHost: ql3-postgres-rw.qinglong3-system.svc
+    postgresPort: '5432'
+    postgresDatabase: qinglong
+    postgresUsernameKey: username
+    postgresPasswordKey: password