From f8934b401d724378fe5a6ea9dbe63e696b5480b9 Mon Sep 17 00:00:00 2001
From: whyour <imwhyour@gmail.com>
Date: Wed, 26 Aug 2026 04:58:09 +0800
Subject: [PATCH] fix(ql3): project cnpg runtime trust into private files

---
 .../postgres-runtime-patch.yaml               | 21 ++++++++++----
 .../ql3-cloudnativepg-deployment-audit.cjs    | 28 ++++++++++++++++---
 .../ql3CloudNativePgDeploymentAudit.test.cjs  | 21 ++++++++++++++
 3 files changed, 60 insertions(+), 10 deletions(-)

diff --git a/deploy/kubernetes/ql3-cluster/overlays/cloudnative-pg/postgres-runtime-patch.yaml b/deploy/kubernetes/ql3-cluster/overlays/cloudnative-pg/postgres-runtime-patch.yaml
index d6b6f39f..8c15fff0 100644
--- a/deploy/kubernetes/ql3-cluster/overlays/cloudnative-pg/postgres-runtime-patch.yaml
+++ b/deploy/kubernetes/ql3-cluster/overlays/cloudnative-pg/postgres-runtime-patch.yaml
@@ -51,12 +51,21 @@ spec:
               value: ql3-postgres-rw.qinglong3-system.svc
               valueFrom: null
       volumes:
-        - name: postgres-runtime-ca
-          secret:
-            secretName: ql3-postgres-ca
-            items:
-              - key: ca.crt
-                path: ca.crt
+        - name: postgres-runtime-projected
+          secret: null
+          projected:
+            defaultMode: 292
+            sources:
+              - secret:
+                  name: ql3-postgres-ca
+                  items:
+                    - key: ca.crt
+                      path: ca.crt
+              - secret:
+                  name: ql3-cluster-control-runtime
+                  items:
+                    - key: api-credential-pepper-keyring.json
+                      path: api-credential-pepper-keyring.json
         - name: postgres-worker-ingress-ca
           secret:
             secretName: ql3-postgres-ca
diff --git a/scripts/ql3-cloudnativepg-deployment-audit.cjs b/scripts/ql3-cloudnativepg-deployment-audit.cjs
index 4f232f63..26e68f6e 100644
--- a/scripts/ql3-cloudnativepg-deployment-audit.cjs
+++ b/scripts/ql3-cloudnativepg-deployment-audit.cjs
@@ -439,8 +439,9 @@ function assertRuntimeBinding(readFile, root, findings) {
   );
   const env = envByName(container);
   const caVolume = podSpec?.volumes?.find(
-    (candidate) => candidate?.name === 'postgres-runtime-ca',
+    (candidate) => candidate?.name === 'postgres-runtime-projected',
   );
+  const projectedSources = caVolume?.projected?.sources;
   if (
     !exactFailClosedApplicationImage(kustomization) ||
     env.get('QL3_POSTGRES_RUNTIME_URL')?.$patch !== 'delete' ||
@@ -458,9 +459,28 @@ function assertRuntimeBinding(readFile, root, findings) {
       'password',
     ) ||
     env.get('QL3_POSTGRES_TLS_SERVERNAME')?.value !== PRIMARY_DNS ||
-    caVolume?.secret?.secretName !== 'ql3-postgres-ca' ||
-    JSON.stringify(caVolume?.secret?.items) !==
-      JSON.stringify([{ key: 'ca.crt', path: 'ca.crt' }])
+    caVolume?.secret !== null ||
+    caVolume?.projected?.defaultMode !== 292 ||
+    JSON.stringify(projectedSources) !==
+      JSON.stringify([
+        {
+          secret: {
+            name: 'ql3-postgres-ca',
+            items: [{ key: 'ca.crt', path: 'ca.crt' }],
+          },
+        },
+        {
+          secret: {
+            name: 'ql3-cluster-control-runtime',
+            items: [
+              {
+                key: 'api-credential-pepper-keyring.json',
+                path: 'api-credential-pepper-keyring.json',
+              },
+            ],
+          },
+        },
+      ])
   ) {
     findings.push(
       finding(
diff --git a/test/back/ql3CloudNativePgDeploymentAudit.test.cjs b/test/back/ql3CloudNativePgDeploymentAudit.test.cjs
index 36b57917..31ed8935 100644
--- a/test/back/ql3CloudNativePgDeploymentAudit.test.cjs
+++ b/test/back/ql3CloudNativePgDeploymentAudit.test.cjs
@@ -126,6 +126,27 @@ test('rejects runtime DSN authority or a non-primary endpoint', () => {
   );
 });
 
+test('rejects a runtime projection without both operator CA and keyring', () => {
+  const report = auditCloudNativePgDeployment({
+    root: ROOT,
+    readFile: intercept(
+      'deploy/kubernetes/ql3-cluster/overlays/cloudnative-pg/postgres-runtime-patch.yaml',
+      (source) =>
+        source.replace(
+          '                  name: ql3-postgres-ca',
+          '                  name: ql3-cluster-control-runtime',
+        ),
+    ),
+  });
+  assert.equal(report.compatible, false);
+  assert.equal(
+    report.findings.some(
+      (candidate) => candidate.code === 'QL3_CNPG_RUNTIME_BINDING',
+    ),
+    true,
+  );
+});
+
 test('rejects migration credentials or CA from the runtime domain', () => {
   const report = auditCloudNativePgDeployment({
     root: ROOT,