refactor: 分离公共基础设施与 Database 适配器

cmd/database.go

@@ -9,7 +9,7 @@ import (
 )
 
 func setupInstanceObservation(manager ctrl.Manager, namespace, rootCert string) (*application.InstanceService, error) {
-	credentials, err := kubernetes.NewSecretCredentials(manager.GetConfig(), namespace)
+	credentials, err := kubernetes.NewSecretCredentials(manager.GetAPIReader(), namespace)
 	if err != nil {
 		return nil, err
 	}

cmd/openbao.go

@@ -20,13 +20,10 @@ import (
 	"errors"
 	"flag"
 	"net/http"
-	"net/url"
-	"strings"
 
-	bao "github.com/openbao/openbao/api/v2"
 	ctrl "sigs.k8s.io/controller-runtime"
 
-	"git.ddupan.top/panxiao81/ayatori/internal/database/adapter/openbao"
+	"git.ddupan.top/panxiao81/ayatori/internal/infra/openbao"
 )
 
 type openBaoOptions struct {
@@ -48,31 +45,11 @@ func (o *openBaoOptions) bindFlags(flags *flag.FlagSet) {
 	flags.StringVar(&o.identity.Audience, "openbao-token-audience", "openbao", "SA JWT audience，须匹配 OpenBao role")
 }
 
-func (o openBaoOptions) client() (*bao.Client, error) {
-	address, err := url.Parse(o.address)
-	if err != nil || address.Scheme != "https" || address.Host == "" || address.User != nil ||
-		address.RawQuery != "" || address.ForceQuery || address.Fragment != "" ||
-		(address.Path != "" && address.Path != "/") {
-		return nil, errors.New("OpenBao address must be an absolute HTTPS URL without credentials, query, fragment or path")
-	}
-	// NewConfig 不读取 BAO_TOKEN/BAO_SKIP_VERIFY 等环境配置，不允许旁路 Kubernetes 身份或 TLS。
-	config := bao.NewConfig()
-	config.Address = strings.TrimSuffix(o.address, "/")
-	if config.Error != nil || config.ConfigureTLS(&bao.TLSConfig{CACert: o.caCert}) != nil {
-		return nil, errors.New("cannot configure OpenBao TLS trust")
-	}
-	client, err := bao.NewClient(config)
-	if err != nil {
-		return nil, errors.New("cannot construct OpenBao client")
-	}
-	return client, nil
-}
-
 func setupOpenBaoAuthentication(manager ctrl.Manager, options openBaoOptions) error {
 	if options.address == "" {
 		return nil
 	}
-	client, err := options.client()
+	client, err := openbao.NewClient(options.address, options.caCert)
 	if err != nil {
 		return err
 	}

cmd/openbao_test.go

@@ -1,67 +0,0 @@
-/*
-Copyright 2026.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"flag"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-func TestOpenBaoClientDoesNotUseEnvironmentIdentityOrAddress(t *testing.T) {
-	t.Setenv("BAO_TOKEN", "TEST-ONLY-unwanted-static-token")
-	t.Setenv("BAO_ADDR", "http://unwanted.invalid")
-	t.Setenv("BAO_SKIP_VERIFY", "true")
-	var options openBaoOptions
-	options.bindFlags(flag.NewFlagSet("test", flag.ContinueOnError))
-	options.address = "https://bao.example/"
-	client, err := options.client()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if client.Address() != "https://bao.example" || client.Token() != "" {
-		t.Fatal("ambient environment replaced the explicit connection or identity")
-	}
-	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer server.Close()
-	options.address = server.URL
-	untrusted, err := options.client()
-	if err != nil {
-		t.Fatal(err)
-	}
-	untrusted.SetMaxRetries(0)
-	if _, err := untrusted.Sys().HealthWithContext(t.Context()); err == nil {
-		t.Fatal("BAO_SKIP_VERIFY bypassed TLS validation")
-	}
-}
-
-func TestOpenBaoClientRejectsUnsafeConfiguration(t *testing.T) {
-	for _, address := range []string{
-		"", "http://bao.example", "https://user:[email protected]",
-		"https://bao.example/?token=secret", "https://bao.example/#secret", "https://bao.example/path",
-	} {
-		if _, err := (openBaoOptions{address: address}).client(); err == nil {
-			t.Fatal("accepted unsafe OpenBao address")
-		}
-	}
-	if _, err := (openBaoOptions{address: "https://bao.example", caCert: "/nonexistent/fixture-ca"}).client(); err == nil {
-		t.Fatal("accepted missing explicit CA")
-	}
-}