fix(ql3): project cnpg runtime trust into private files

deploy/kubernetes/ql3-cluster/overlays/cloudnative-pg/postgres-runtime-patch.yaml

@@ -51,12 +51,21 @@ spec:
               value: ql3-postgres-rw.qinglong3-system.svc
               valueFrom: null
       volumes:
-        - name: postgres-runtime-ca
+        - name: postgres-runtime-projected
-          secret:
+          secret: null
-            secretName: ql3-postgres-ca
+          projected:
-            items:
+            defaultMode: 292
-              - key: ca.crt
+            sources:
-                path: ca.crt
+              - secret:
+                  name: ql3-postgres-ca
+                  items:
+                    - key: ca.crt
+                      path: ca.crt
+              - secret:
+                  name: ql3-cluster-control-runtime
+                  items:
+                    - key: api-credential-pepper-keyring.json
+                      path: api-credential-pepper-keyring.json
         - name: postgres-worker-ingress-ca
           secret:
             secretName: ql3-postgres-ca

scripts/ql3-cloudnativepg-deployment-audit.cjs

@@ -439,8 +439,9 @@ function assertRuntimeBinding(readFile, root, findings) {
   );
   const env = envByName(container);
   const caVolume = podSpec?.volumes?.find(
-    (candidate) => candidate?.name === 'postgres-runtime-ca',
+    (candidate) => candidate?.name === 'postgres-runtime-projected',
   );
+  const projectedSources = caVolume?.projected?.sources;
   if (
     !exactFailClosedApplicationImage(kustomization) ||
     env.get('QL3_POSTGRES_RUNTIME_URL')?.$patch !== 'delete' ||
@@ -458,9 +459,28 @@ function assertRuntimeBinding(readFile, root, findings) {
       'password',
     ) ||
     env.get('QL3_POSTGRES_TLS_SERVERNAME')?.value !== PRIMARY_DNS ||
-    caVolume?.secret?.secretName !== 'ql3-postgres-ca' ||
+    caVolume?.secret !== null ||
-    JSON.stringify(caVolume?.secret?.items) !==
+    caVolume?.projected?.defaultMode !== 292 ||
-      JSON.stringify([{ key: 'ca.crt', path: 'ca.crt' }])
+    JSON.stringify(projectedSources) !==
+      JSON.stringify([
+        {
+          secret: {
+            name: 'ql3-postgres-ca',
+            items: [{ key: 'ca.crt', path: 'ca.crt' }],
+          },
+        },
+        {
+          secret: {
+            name: 'ql3-cluster-control-runtime',
+            items: [
+              {
+                key: 'api-credential-pepper-keyring.json',
+                path: 'api-credential-pepper-keyring.json',
+              },
+            ],
+          },
+        },
+      ])
   ) {
     findings.push(
       finding(

test/back/ql3CloudNativePgDeploymentAudit.test.cjs

@@ -126,6 +126,27 @@ test('rejects runtime DSN authority or a non-primary endpoint', () => {
   );
 });
 
+test('rejects a runtime projection without both operator CA and keyring', () => {
+  const report = auditCloudNativePgDeployment({
+    root: ROOT,
+    readFile: intercept(
+      'deploy/kubernetes/ql3-cluster/overlays/cloudnative-pg/postgres-runtime-patch.yaml',
+      (source) =>
+        source.replace(
+          '                  name: ql3-postgres-ca',
+          '                  name: ql3-cluster-control-runtime',
+        ),
+    ),
+  });
+  assert.equal(report.compatible, false);
+  assert.equal(
+    report.findings.some(
+      (candidate) => candidate.code === 'QL3_CNPG_RUNTIME_BINDING',
+    ),
+    true,
+  );
+});
+
 test('rejects migration credentials or CA from the runtime domain', () => {
   const report = auditCloudNativePgDeployment({
     root: ROOT,