feat(ql3): validate cluster credential key rotation

2026-09-23 11:27:31 +08:00 · 2026-08-26 03:31:13 +08:00
parent b45a5e04b7
commit ac0992081e
23 changed files with 1119 additions and 167 deletions
@@ -113,11 +113,8 @@ spec:
                secretKeyRef:
                  name: ql3-cluster-control-runtime
                  key: postgres-tls-servername
-            - name: QL3_API_CREDENTIAL_PEPPER
-              valueFrom:
-                secretKeyRef:
-                  name: ql3-cluster-control-runtime
-                  key: api-credential-pepper
+            - name: QL3_API_CREDENTIAL_PEPPER_KEYRING_FILE
+              value: /var/run/secrets/qinglong3/postgres-runtime/api-credential-pepper-keyring.json
            - name: QL3_POSTGRES_WORKER_INGRESS_URL
              valueFrom:
                secretKeyRef:
@@ -250,6 +247,8 @@ spec:
            items:
              - key: postgres-ca.crt
                path: ca.crt
+              - key: api-credential-pepper-keyring.json
+                path: api-credential-pepper-keyring.json
        - name: postgres-worker-ingress-ca
          secret:
            secretName: ql3-cluster-worker-ingress