feat(ql3): establish 3.0 incubation baseline

2026-09-22 19:29:13 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,42 @@
+{
+  "schemaVersion": 1,
+  "observedAt": "2026-08-03",
+  "releaseReady": false,
+  "releaseBlockers": [
+    "live-object-store-backup-wal-latest-restore-pitr-evidence"
+  ],
+  "compatibility": {
+    "cloudNativePg": ">=1.26.0",
+    "reviewedCloudNativePg": "1.30.0"
+  },
+  "plugin": {
+    "name": "barman-cloud.cloudnative-pg.io",
+    "version": "0.13.0",
+    "releaseManifest": "https://github.com/cloudnative-pg/plugin-barman-cloud/releases/download/v0.13.0/manifest.yaml",
+    "releaseManifestSha256": "d2e71e7b06822448f1a421f05781846cfdb9cc621e7ef32eef5e20c5133213b0",
+    "controller": {
+      "manifestReference": "ghcr.io/cloudnative-pg/plugin-barman-cloud:v0.13.0",
+      "image": "ghcr.io/cloudnative-pg/plugin-barman-cloud:v0.13.0@sha256:71589dbac582333442812b07b31f7ea4d00324a8358aac7ca507dabf9f4b6c96",
+      "platforms": {
+        "linux/amd64": "sha256:417449fe4f6f0a56acdeb30e4131930815f2b46b9afeb808059b57aa8b4c2ef5",
+        "linux/arm64": "sha256:de612e3ad8633a198b91ffbea53848407424155daf2183d656490d843a83b100"
+      }
+    },
+    "sidecar": {
+      "manifestReference": "ghcr.io/cloudnative-pg/plugin-barman-cloud-sidecar:v0.13.0",
+      "image": "ghcr.io/cloudnative-pg/plugin-barman-cloud-sidecar:v0.13.0@sha256:990361af3319f9e23aafa0f6d7981f99bf1f69b4e6a85cf1bc7d71d6f09bb288",
+      "platforms": {
+        "linux/amd64": "sha256:15cb1a01e7c5235eedac2061cab8208e5f7c39dbda292f9c2d4ddaa0c1f211e6",
+        "linux/arm64": "sha256:f53e168e341661cd76334215ead9dfd69f06117685d3232206192cf25218da71"
+      }
+    }
+  },
+  "certificateAuthority": {
+    "mode": "cert-manager",
+    "version": "1.20.3",
+    "selectionLock": "deploy/kubernetes/ql3-cluster/operators/cert-manager/selection-lock.json",
+    "releaseManifestUses": "cert-manager.io/v1",
+    "requiredSecrets": ["barman-cloud-client-tls", "barman-cloud-server-tls"],
+    "status": "supply-chain-verified"
+  }
+}
@@ -0,0 +1,83 @@
+{
+  "schemaVersion": 1,
+  "observedAt": "2026-08-03",
+  "releaseReady": false,
+  "releaseBlockers": [
+    "live-cert-manager-api-and-plugin-mtls-rotation-evidence"
+  ],
+  "certManager": {
+    "version": "1.20.3",
+    "releaseManifest": "https://github.com/cert-manager/cert-manager/releases/download/v1.20.3/cert-manager.yaml",
+    "releaseManifestSha256": "7ee74ba06845213e96d8ceaff3d20dd51e682765c1418eddda4e8780ba082261",
+    "images": [
+      {
+        "name": "controller",
+        "manifestReference": "quay.io/jetstack/cert-manager-controller:v1.20.3",
+        "image": "quay.io/jetstack/cert-manager-controller:v1.20.3@sha256:6c13d61e0348a5bc3477f8ea9a928624300b30d19b1c72a7d2b90372fc713db4",
+        "platforms": {
+          "linux/amd64": "sha256:1e4af57beb469cc3bb0fb48b9201caea2723819b9ffd3c3ea98568f55b4dd38b",
+          "linux/arm64": "sha256:af62a025ae4f8fd03209b5e0760868296bad5a9370aab0c91ad3b5476bcb282d"
+        }
+      },
+      {
+        "name": "cainjector",
+        "manifestReference": "quay.io/jetstack/cert-manager-cainjector:v1.20.3",
+        "image": "quay.io/jetstack/cert-manager-cainjector:v1.20.3@sha256:06ad347fe0dc2eb84cc355c26f6752e05e87dceb6447f5cd29b963dd66dfd8bd",
+        "platforms": {
+          "linux/amd64": "sha256:a2b12d27950d1603d2c8168c3ccd95d07b93ce6ec4b530316196a31db592a9c0",
+          "linux/arm64": "sha256:3c052c134ad1b93122b957f4d214aaa9d85a37b5ff15acc5b4d86f50e3ed822e"
+        }
+      },
+      {
+        "name": "webhook",
+        "manifestReference": "quay.io/jetstack/cert-manager-webhook:v1.20.3",
+        "image": "quay.io/jetstack/cert-manager-webhook:v1.20.3@sha256:a61e817632cebed3bb59a189327e786fa3fdd7597167d994a1848d98fd55848f",
+        "platforms": {
+          "linux/amd64": "sha256:953a97df613f7da7eda8ce4b1c8d8e6b50963db0800fab595d040db6eb5cb060",
+          "linux/arm64": "sha256:7c510875e038f79f7fba707b5f86d8736777a4dfefcd42179b08844ee75e685b"
+        }
+      }
+    ],
+    "status": "supply-chain-verified"
+  },
+  "compatibility": {
+    "reviewedKubernetes": "1.32.8",
+    "supportedKubernetesMin": "1.32",
+    "supportedKubernetesMax": "1.35",
+    "newerMinorRejected": "1.21.0 requires Kubernetes 1.33 or newer"
+  },
+  "scope": {
+    "profile": "cluster-only",
+    "installNamespace": "cert-manager",
+    "consumerNamespace": "cnpg-system",
+    "requiredBy": "barman-cloud.cloudnative-pg.io@0.13.0"
+  },
+  "pluginTls": {
+    "issuer": {
+      "apiVersion": "cert-manager.io/v1",
+      "kind": "Issuer",
+      "name": "selfsigned-issuer",
+      "namespace": "cnpg-system",
+      "type": "SelfSigned"
+    },
+    "certificates": [
+      {
+        "name": "barman-cloud-client",
+        "secretName": "barman-cloud-client-tls",
+        "commonName": "barman-cloud-client",
+        "usages": ["client auth"],
+        "duration": "2160h",
+        "renewBefore": "360h"
+      },
+      {
+        "name": "barman-cloud-server",
+        "secretName": "barman-cloud-server-tls",
+        "commonName": "barman-cloud",
+        "dnsNames": ["barman-cloud"],
+        "usages": ["server auth"],
+        "duration": "2160h",
+        "renewBefore": "360h"
+      }
+    ]
+  }
+}
@@ -0,0 +1,49 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: ql3-postgres
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: qinglong3
+    app.kubernetes.io/managed-by: cloudnative-pg
+spec:
+  instances: 3
+  imageName: ghcr.io/cloudnative-pg/postgresql:18.4-minimal-trixie@sha256:24d229d801663f95b584416f8ebdfad4849b1a3fa4cfcf95a7f026df7aa6e22d
+  enableSuperuserAccess: false
+  primaryUpdateMethod: switchover
+  failoverDelay: 0
+  switchoverDelay: 60
+  smartShutdownTimeout: 60
+  stopDelay: 300
+  postgresql:
+    parameters:
+      max_connections: '100'
+      password_encryption: scram-sha-256
+      shared_buffers: 128MB
+      synchronous_commit: remote_apply
+    synchronous:
+      method: any
+      number: 1
+      dataDurability: required
+      failoverQuorum: true
+  affinity:
+    enablePodAntiAffinity: true
+    podAntiAffinityType: required
+    topologyKey: kubernetes.io/hostname
+  managed:
+    services:
+      disabledDefaultServices:
+        - r
+        - ro
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '2'
+      memory: 1Gi
+  storage:
+    size: 20Gi
+  walStorage:
+    size: 5Gi
@@ -0,0 +1,190 @@
+# Example only. Create these values through a secret manager before applying
+# the CloudNativePG resources. Never commit a populated copy.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-migration-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_migration
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-ai-maintenance-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_ai_maintenance
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-ai-credential-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_ai_credential_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-ai-credential-tester-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_ai_credential_tester
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-runtime-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_runtime
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-admin-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_admin
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-package-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_package_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-package-executor-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_package_executor
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-automation-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_automation_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-approval-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_approval_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-worker-credential-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_worker_credential_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-worker-credential-executor-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_worker_credential_executor
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-worker-ingress-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_worker_ingress
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-cluster-control-runtime
+  namespace: qinglong3-system
+type: Opaque
+stringData:
+  api-credential-pepper: REPLACE_WITH_CANONICAL_32_BYTE_BASE64URL
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-cluster-worker-ingress
+  namespace: qinglong3-system
+type: Opaque
+stringData:
+  worker-credential-pepper: REPLACE_WITH_DISTINCT_CANONICAL_32_BYTE_BASE64URL
+  artifact-s3-bucket: REPLACE_WITH_PRIVATE_IMMUTABLE_ARTIFACT_BUCKET
+  artifact-s3-region: REPLACE_WITH_BUCKET_REGION
+  artifact-s3-encryption: s3
+  tls.key: |
+    -----BEGIN PRIVATE KEY-----
+    REPLACE_WITH_WORKER_INGRESS_SERVER_PRIVATE_KEY
+    -----END PRIVATE KEY-----
+  tls.crt: |
+    -----BEGIN CERTIFICATE-----
+    REPLACE_WITH_WORKER_INGRESS_SERVER_CERTIFICATE_CHAIN
+    -----END CERTIFICATE-----
+  client-ca.crt: |
+    -----BEGIN CERTIFICATE-----
+    REPLACE_WITH_WORKER_CLIENT_CA_BUNDLE
+    -----END CERTIFICATE-----
@@ -0,0 +1,311 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-migration
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_migration
+  comment: QingLong reviewed schema migration authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 2
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-migration-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-ai-maintenance
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_ai_maintenance
+  comment: QingLong bounded AI Prompt output retention authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-ai-maintenance-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-ai-credential-manager
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_ai_credential_manager
+  comment: QingLong human AI Provider credential binding authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-ai-credential-manager-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-ai-credential-tester
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_ai_credential_tester
+  comment: QingLong one-shot AI Provider credential connectivity tester
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 2
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-ai-credential-tester-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-runtime
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_runtime
+  comment: QingLong cluster-control runtime authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 32
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-runtime-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-admin
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_admin
+  comment: QingLong short-lived administration authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-admin-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-package-manager
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_package_manager
+  comment: QingLong human Plugin Package management authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-package-manager-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-package-executor
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_package_executor
+  comment: QingLong system Plugin Package execution and recovery authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-package-executor-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-automation-manager
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_automation_manager
+  comment: QingLong human Task and Trigger management authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-automation-manager-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-approval-manager
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_approval_manager
+  comment: QingLong strongly authenticated human Approval inspection and decision authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-approval-manager-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-worker-credential-manager
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_worker_credential_manager
+  comment: QingLong human Worker credential planning and approval authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-worker-credential-manager-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-worker-credential-executor
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_worker_credential_executor
+  comment: QingLong system Worker credential delivery execution authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-worker-credential-executor-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-worker-ingress
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_worker_ingress
+  comment: QingLong authenticated Worker ingress authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 32
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-worker-ingress-auth
@@ -0,0 +1,13 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: ql3-postgres-qinglong
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  name: qinglong
+  owner: ql3_migration
+  cluster:
+    name: ql3-postgres
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: qinglong3-system
+
+resources:
+  - cluster.yaml
+  - database-roles.yaml
+  - database.yaml
@@ -0,0 +1,25 @@
+{
+  "schemaVersion": 1,
+  "observedAt": "2026-07-24",
+  "operator": {
+    "name": "cloudnative-pg",
+    "version": "1.30.0",
+    "image": "ghcr.io/cloudnative-pg/cloudnative-pg:1.30.0@sha256:a2701eb97cdd2a34b1fdb2cb51987f544b706e40bec72ae7146cd8580efefebb",
+    "platforms": {
+      "linux/amd64": "sha256:091d306935cfdf646debfe78010d59ebfb572150eb6eb922b0203873c0c68841",
+      "linux/arm64": "sha256:6c7926147fd23a053dea6605d61c013d43bfd411be3532e7500ef2d2b68bb98c"
+    },
+    "releaseManifest": "https://github.com/cloudnative-pg/cloudnative-pg/releases/download/v1.30.0/cnpg-1.30.0.yaml",
+    "releaseManifestSha256": "sha256:f8bede43fe4ee0d478c2355b204a36876b2ae4faac60f2a9452280b293da3b88",
+    "signatureBundle": "https://github.com/cloudnative-pg/cloudnative-pg/releases/download/v1.30.0/cnpg-1.30.0.sigstore.json",
+    "certificateIdentityRegexp": "^https://github.com/cloudnative-pg/cloudnative-pg/.github/workflows/release-publish.yml@refs/tags/v1\\.30\\.0$"
+  },
+  "operand": {
+    "postgresqlVersion": "18.4",
+    "image": "ghcr.io/cloudnative-pg/postgresql:18.4-minimal-trixie@sha256:24d229d801663f95b584416f8ebdfad4849b1a3fa4cfcf95a7f026df7aa6e22d",
+    "platforms": {
+      "linux/amd64": "sha256:67e56bcbe50a58e60509815dd89e58effc5f331ab844f66331d945cd42131e8d",
+      "linux/arm64": "sha256:2adbb634a1c0af8cb036e81200aaa7c8b62517bf5e501699926b337bd9f863f1"
+    }
+  }
+}