feat(ql3): validate cluster credential key rotation

2026-09-20 16:07:11 +08:00 · 2026-08-26 03:31:13 +08:00
parent b45a5e04b7
commit ac0992081e
23 changed files with 1119 additions and 167 deletions
@@ -760,7 +760,11 @@ async function main() {
      );
    }
    applySecret('ql3-cluster-control-runtime', 'Opaque', {
-      'api-credential-pepper': randomSecret(),
+      'api-credential-pepper-keyring.json': `${JSON.stringify({
+        schemaVersion: 1,
+        activePepperKeyId: 'legacy-v1',
+        keys: [{ pepperKeyId: 'legacy-v1', pepper: randomSecret() }],
+      })}\n`,
    });
    const workerIngressTls = createWorkerIngressTls(tempDirectory);
    applySecret('ql3-cluster-worker-ingress', 'Opaque', {