fix(ql3): materialize projected runtime files

2026-09-23 03:18:09 +08:00 · 2026-08-26 04:09:47 +08:00
parent 9c58b15d2b
commit beb490c48c
9 changed files with 273 additions and 30 deletions
@@ -967,8 +967,12 @@ and is fixed to `verify-full` in the committed deployment. The servername is
 mandatory, must be an explicit DNS name rather than an IP literal, and must
 match the endpoint certificate SAN. Only
 `postgres-ca.crt` and `api-credential-pepper-keyring.json` are projected from
-this Secret into the runtime private mount; only the URL and servername remain
-environment values. The keyring is a canonical, bounded 1–2 generation file;
+this Secret only into a hardened init container. It resolves one kubelet
+`..data` generation, copies both values without replacement into a Pod-private
+memory volume, and changes each regular file to `0400`; the long-running
+container can read only that materialized volume, never the symlink-backed
+Secret projection. Only the URL and servername remain environment values. The
+keyring is a canonical, bounded 1–2 generation file;
 the singleton above is the bootstrap form. The CA loader requires an absolute
 path to a regular file that is not group/world writable, 1–256 KiB, and
 contains 1–16 unique PEM X.509 CA certificates with no trailing data.