feat(ql3): establish 3.0 incubation baseline

2026-09-22 02:27:44 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,49 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: ql3-postgres
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: qinglong3
+    app.kubernetes.io/managed-by: cloudnative-pg
+spec:
+  instances: 3
+  imageName: ghcr.io/cloudnative-pg/postgresql:18.4-minimal-trixie@sha256:24d229d801663f95b584416f8ebdfad4849b1a3fa4cfcf95a7f026df7aa6e22d
+  enableSuperuserAccess: false
+  primaryUpdateMethod: switchover
+  failoverDelay: 0
+  switchoverDelay: 60
+  smartShutdownTimeout: 60
+  stopDelay: 300
+  postgresql:
+    parameters:
+      max_connections: '100'
+      password_encryption: scram-sha-256
+      shared_buffers: 128MB
+      synchronous_commit: remote_apply
+    synchronous:
+      method: any
+      number: 1
+      dataDurability: required
+      failoverQuorum: true
+  affinity:
+    enablePodAntiAffinity: true
+    podAntiAffinityType: required
+    topologyKey: kubernetes.io/hostname
+  managed:
+    services:
+      disabledDefaultServices:
+        - r
+        - ro
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: '2'
+      memory: 1Gi
+  storage:
+    size: 20Gi
+  walStorage:
+    size: 5Gi
@@ -0,0 +1,190 @@
+# Example only. Create these values through a secret manager before applying
+# the CloudNativePG resources. Never commit a populated copy.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-migration-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_migration
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-ai-maintenance-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_ai_maintenance
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-ai-credential-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_ai_credential_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-ai-credential-tester-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_ai_credential_tester
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-runtime-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_runtime
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-admin-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_admin
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-package-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_package_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-package-executor-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_package_executor
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-automation-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_automation_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-approval-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_approval_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-worker-credential-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_worker_credential_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-worker-credential-executor-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_worker_credential_executor
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-worker-ingress-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_worker_ingress
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-cluster-control-runtime
+  namespace: qinglong3-system
+type: Opaque
+stringData:
+  api-credential-pepper: REPLACE_WITH_CANONICAL_32_BYTE_BASE64URL
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-cluster-worker-ingress
+  namespace: qinglong3-system
+type: Opaque
+stringData:
+  worker-credential-pepper: REPLACE_WITH_DISTINCT_CANONICAL_32_BYTE_BASE64URL
+  artifact-s3-bucket: REPLACE_WITH_PRIVATE_IMMUTABLE_ARTIFACT_BUCKET
+  artifact-s3-region: REPLACE_WITH_BUCKET_REGION
+  artifact-s3-encryption: s3
+  tls.key: |
+    -----BEGIN PRIVATE KEY-----
+    REPLACE_WITH_WORKER_INGRESS_SERVER_PRIVATE_KEY
+    -----END PRIVATE KEY-----
+  tls.crt: |
+    -----BEGIN CERTIFICATE-----
+    REPLACE_WITH_WORKER_INGRESS_SERVER_CERTIFICATE_CHAIN
+    -----END CERTIFICATE-----
+  client-ca.crt: |
+    -----BEGIN CERTIFICATE-----
+    REPLACE_WITH_WORKER_CLIENT_CA_BUNDLE
+    -----END CERTIFICATE-----
@@ -0,0 +1,311 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-migration
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_migration
+  comment: QingLong reviewed schema migration authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 2
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-migration-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-ai-maintenance
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_ai_maintenance
+  comment: QingLong bounded AI Prompt output retention authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-ai-maintenance-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-ai-credential-manager
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_ai_credential_manager
+  comment: QingLong human AI Provider credential binding authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-ai-credential-manager-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-ai-credential-tester
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_ai_credential_tester
+  comment: QingLong one-shot AI Provider credential connectivity tester
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 2
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-ai-credential-tester-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-runtime
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_runtime
+  comment: QingLong cluster-control runtime authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 32
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-runtime-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-admin
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_admin
+  comment: QingLong short-lived administration authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-admin-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-package-manager
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_package_manager
+  comment: QingLong human Plugin Package management authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-package-manager-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-package-executor
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_package_executor
+  comment: QingLong system Plugin Package execution and recovery authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-package-executor-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-automation-manager
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_automation_manager
+  comment: QingLong human Task and Trigger management authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-automation-manager-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-approval-manager
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_approval_manager
+  comment: QingLong strongly authenticated human Approval inspection and decision authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-approval-manager-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-worker-credential-manager
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_worker_credential_manager
+  comment: QingLong human Worker credential planning and approval authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-worker-credential-manager-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-worker-credential-executor
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_worker_credential_executor
+  comment: QingLong system Worker credential delivery execution authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 4
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-worker-credential-executor-auth
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: DatabaseRole
+metadata:
+  name: ql3-postgres-worker-ingress
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database-role
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  cluster:
+    name: ql3-postgres
+  name: ql3_worker_ingress
+  comment: QingLong authenticated Worker ingress authority
+  login: true
+  superuser: false
+  createdb: false
+  createrole: false
+  replication: false
+  bypassrls: false
+  connectionLimit: 32
+  databaseRoleReclaimPolicy: retain
+  passwordSecret:
+    name: ql3-postgres-worker-ingress-auth
@@ -0,0 +1,13 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: ql3-postgres-qinglong
+  labels:
+    app.kubernetes.io/name: ql3-postgres
+    app.kubernetes.io/component: database
+    app.kubernetes.io/part-of: qinglong3
+spec:
+  name: qinglong
+  owner: ql3_migration
+  cluster:
+    name: ql3-postgres
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: qinglong3-system
+
+resources:
+  - cluster.yaml
+  - database-roles.yaml
+  - database.yaml
@@ -0,0 +1,25 @@
+{
+  "schemaVersion": 1,
+  "observedAt": "2026-07-24",
+  "operator": {
+    "name": "cloudnative-pg",
+    "version": "1.30.0",
+    "image": "ghcr.io/cloudnative-pg/cloudnative-pg:1.30.0@sha256:a2701eb97cdd2a34b1fdb2cb51987f544b706e40bec72ae7146cd8580efefebb",
+    "platforms": {
+      "linux/amd64": "sha256:091d306935cfdf646debfe78010d59ebfb572150eb6eb922b0203873c0c68841",
+      "linux/arm64": "sha256:6c7926147fd23a053dea6605d61c013d43bfd411be3532e7500ef2d2b68bb98c"
+    },
+    "releaseManifest": "https://github.com/cloudnative-pg/cloudnative-pg/releases/download/v1.30.0/cnpg-1.30.0.yaml",
+    "releaseManifestSha256": "sha256:f8bede43fe4ee0d478c2355b204a36876b2ae4faac60f2a9452280b293da3b88",
+    "signatureBundle": "https://github.com/cloudnative-pg/cloudnative-pg/releases/download/v1.30.0/cnpg-1.30.0.sigstore.json",
+    "certificateIdentityRegexp": "^https://github.com/cloudnative-pg/cloudnative-pg/.github/workflows/release-publish.yml@refs/tags/v1\\.30\\.0$"
+  },
+  "operand": {
+    "postgresqlVersion": "18.4",
+    "image": "ghcr.io/cloudnative-pg/postgresql:18.4-minimal-trixie@sha256:24d229d801663f95b584416f8ebdfad4849b1a3fa4cfcf95a7f026df7aa6e22d",
+    "platforms": {
+      "linux/amd64": "sha256:67e56bcbe50a58e60509815dd89e58effc5f331ab844f66331d945cd42131e8d",
+      "linux/arm64": "sha256:2adbb634a1c0af8cb036e81200aaa7c8b62517bf5e501699926b337bd9f863f1"
+    }
+  }
+}