feat(ql3): establish 3.0 incubation baseline

2026-09-22 19:29:13 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,84 @@
+# Example only. Copy into a private overlay and replace every placeholder.
+# This file is intentionally excluded from all committed Kustomizations.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-plugin-package-management-identity
+  namespace: qinglong3-system
+type: Opaque
+stringData:
+  keyset.json: |
+    {
+      "schemaVersion": 1,
+      "generation": 1,
+      "issuer": "https://identity.example.test/",
+      "audience": "qinglong3-package-management",
+      "keys": [
+        {
+          "alg": "EdDSA",
+          "crv": "Ed25519",
+          "kid": "REPLACE_WITH_KEY_ID",
+          "kty": "OKP",
+          "use": "sig",
+          "x": "REPLACE_WITH_ED25519_PUBLIC_JWK_X"
+        }
+      ],
+      "revokedKids": [],
+      "assuranceMappings": [
+        {
+          "acr": "urn:example:mfa",
+          "assurance": "multi_factor",
+          "requiredAmr": ["pwd", "otp"]
+        }
+      ],
+      "constraints": {
+        "maxAssertionBytes": 8192,
+        "maxLifetimeMs": 300000,
+        "maxAuthenticationAgeMs": 300000,
+        "clockSkewMs": 5000
+      }
+    }
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-plugin-package-management-tls
+  namespace: qinglong3-system
+type: kubernetes.io/tls
+stringData:
+  tls.crt: REPLACE_WITH_SERVER_CERTIFICATE_CHAIN
+  tls.key: REPLACE_WITH_SERVER_PRIVATE_KEY
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ql3-plugin-publisher-trust
+  namespace: qinglong3-system
+data:
+  publishers.json: |
+    {
+      "schema": "qinglong/plugin-package-publisher-trust@v1",
+      "keys": [
+        {
+          "publisher": "REPLACE_WITH_PUBLISHER",
+          "keyId": "REPLACE_WITH_KEY_ID",
+          "publicKeyPem": "REPLACE_WITH_ED25519_PUBLIC_KEY_PEM",
+          "notBeforeMs": 0,
+          "notAfterMs": 1
+        }
+      ]
+    }
+---
+# Non-CloudNativePG deployments only. The reviewed CloudNativePG overlay uses
+# the operator-managed ql3-postgres-package-manager-auth and ql3-postgres-ca
+# Secrets instead of this resource.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-cluster-plugin-package-management-database
+  namespace: qinglong3-system
+type: Opaque
+stringData:
+  postgres-package-manager-url: REPLACE_WITH_PACKAGE_MANAGER_DSN
+  postgres-tls-servername: REPLACE_WITH_POSTGRES_DNS_NAME
+  postgres-ca.crt: REPLACE_WITH_POSTGRES_CA_CERTIFICATE