fix(ql3): preserve materialization in live fixtures

test/back/ql3CloudNativePgLiveContract.test.cjs

@@ -41,7 +41,7 @@ test('derives a normal tagged preload reference from a reviewed image', () => {
   assert.throws(() => imageTag('registry.example/operand:18.4'));
 });
 
-test('replaces exactly one fail-closed application image only in live rendering', () => {
+test('replaces the exact fail-closed application image count only in live rendering', () => {
   const placeholder = `registry.example.com/qinglong/qinglong3-cluster-control@sha256:${'0'.repeat(
     64,
   )}`;
@@ -52,6 +52,12 @@ test('replaces exactly one fail-closed application image only in live rendering'
   );
   assert.throws(() => localApplicationManifest('kind: Deployment\n'));
   assert.throws(() => localApplicationManifest(`${rendered}---\n${rendered}`));
+  assert.equal(
+    localApplicationManifest(`${rendered}---\n${rendered}`, 2),
+    `kind: Deployment\nspec:\n  image: registry.example.com/qinglong/qinglong3-cluster-control:${VERSION}\n---\nkind: Deployment\nspec:\n  image: registry.example.com/qinglong/qinglong3-cluster-control:${VERSION}\n`,
+  );
+  assert.throws(() => localApplicationManifest(rendered, 2));
+  assert.throws(() => localApplicationManifest(rendered, 0));
 });
 
 test('accepts uniform runtime reporting of the reviewed index or platform digest', () => {

test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs

@@ -6,6 +6,10 @@ const yaml = require('js-yaml');
 const {
   createFixture,
 } = require('../../scripts/ql3-plugin-package-recovery-e2e-fixture.cjs');
+const {
+  runtimeDeploymentResources,
+  runtimeKeyringMaterializationSource,
+} = require('../../scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs');
 const {
   CONTRACT_VERSION,
   MIGRATION_COUNT,
@@ -176,6 +180,40 @@ test('deployment controller rejects the upgrade before creating runtime', () =>
   );
 });
 
+test('runtime deployment preserves private regular-file keyring materialization', () => {
+  const resources = runtimeDeploymentResources({
+    'qinglong.io/test': 'runtime-materialization',
+  });
+  const deployment = resources.find(
+    (resource) => resource.kind === 'Deployment',
+  );
+  const pod = deployment.spec.template.spec;
+  const materializer = pod.initContainers[0];
+  const container = pod.containers[0];
+  assert.equal(materializer.name, 'materialize-runtime-files');
+  assert.equal(materializer.image, container.image);
+  assert.equal(materializer.imagePullPolicy, 'Never');
+  assert.deepEqual(materializer.command.slice(0, 2), ['node', '-e']);
+  assert.equal(materializer.command[2], runtimeKeyringMaterializationSource());
+  assert.match(materializer.command[2], /realpathSync/);
+  assert.match(materializer.command[2], /COPYFILE_EXCL/);
+  assert.match(materializer.command[2], /chmodSync\(output,0o400\)/);
+  assert.equal(
+    container.env.find(
+      (entry) => entry.name === 'QL3_API_CREDENTIAL_PEPPER_KEYRING_FILE',
+    ).value,
+    '/var/run/secrets/qinglong3/runtime/keyring.json',
+  );
+  assert.equal(
+    container.volumeMounts.some((mount) => mount.name.includes('projected')),
+    false,
+  );
+  assert.deepEqual(
+    pod.volumes.map((volume) => volume.name),
+    ['tmp', 'api-credential-keyring-projected', 'runtime-private'],
+  );
+});
+
 test('recovery Job keeps exact ConfigMap-only RBAC and runtime cannot read install authority', () => {
   assert.match(
     live,