# Example only. Copy into a private overlay and replace every placeholder.
# The executor must receive only the package-executor database credential.
apiVersion: v1
kind: Secret
metadata:
  name: ql3-cluster-plugin-package-executor
  namespace: qinglong3-system
type: Opaque
stringData:
  postgres-package-executor-url: REPLACE_WITH_PACKAGE_EXECUTOR_DSN
  postgres-tls-servername: REPLACE_WITH_POSTGRES_DNS_NAME
  postgres-ca.crt: REPLACE_WITH_POSTGRES_CA_CERTIFICATE
---
# Source for action-scoped Secret projection Jobs. The batch executor never
# mounts this Secret. Each exact Job selects only the reviewed lowercase
# SHA-256 key(s) for one durable dispatch and checks metadata only.
apiVersion: v1
kind: Secret
metadata:
  name: ql3-cluster-plugin-package-values
  namespace: qinglong3-system
type: Opaque
data: {}

# The controller also needs one private-overlay NetworkPolicy patch containing
# only the exact Kubernetes API endpoint CIDR and TCP port. Start from
# api-server-egress-patch.example.yaml; do not permit arbitrary TCP/443 egress.