feat(ql3): establish 3.0 incubation baseline

2026-09-22 10:32:40 +08:00 · 2026-08-12 00:25:26 +08:00
parent 4bf92dcfeb
commit c699c32461
2817 changed files with 779642 additions and 653 deletions
@@ -0,0 +1,190 @@
+# Example only. Create these values through a secret manager before applying
+# the CloudNativePG resources. Never commit a populated copy.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-migration-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_migration
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-ai-maintenance-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_ai_maintenance
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-ai-credential-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_ai_credential_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-ai-credential-tester-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_ai_credential_tester
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-runtime-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_runtime
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-admin-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_admin
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-package-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_package_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-package-executor-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_package_executor
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-automation-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_automation_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-approval-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_approval_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-worker-credential-manager-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_worker_credential_manager
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-worker-credential-executor-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_worker_credential_executor
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-postgres-worker-ingress-auth
+  namespace: qinglong3-system
+  labels:
+    cnpg.io/reload: 'true'
+type: kubernetes.io/basic-auth
+stringData:
+  username: ql3_worker_ingress
+  password: REPLACE_WITH_SECRET_MANAGER_VALUE
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-cluster-control-runtime
+  namespace: qinglong3-system
+type: Opaque
+stringData:
+  api-credential-pepper: REPLACE_WITH_CANONICAL_32_BYTE_BASE64URL
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ql3-cluster-worker-ingress
+  namespace: qinglong3-system
+type: Opaque
+stringData:
+  worker-credential-pepper: REPLACE_WITH_DISTINCT_CANONICAL_32_BYTE_BASE64URL
+  artifact-s3-bucket: REPLACE_WITH_PRIVATE_IMMUTABLE_ARTIFACT_BUCKET
+  artifact-s3-region: REPLACE_WITH_BUCKET_REGION
+  artifact-s3-encryption: s3
+  tls.key: |
+    -----BEGIN PRIVATE KEY-----
+    REPLACE_WITH_WORKER_INGRESS_SERVER_PRIVATE_KEY
+    -----END PRIVATE KEY-----
+  tls.crt: |
+    -----BEGIN CERTIFICATE-----
+    REPLACE_WITH_WORKER_INGRESS_SERVER_CERTIFICATE_CHAIN
+    -----END CERTIFICATE-----
+  client-ca.crt: |
+    -----BEGIN CERTIFICATE-----
+    REPLACE_WITH_WORKER_CLIENT_CA_BUNDLE
+    -----END CERTIFICATE-----