@@ -62,6 +72,12 @@ func (r *PostgreSQLInstanceReconciler) Reconcile(ctx context.Context, req ctrl.R
 		setReconcilingCondition(&instance.Status.Conditions, instance.Generation, phaseResult.reconcilingMessage)
 	}
 
+	var reconcileErr error

@@ -0,0 +76,4 @@
+
+// New validates config and constructs an Initializer.
+func New(config Config) (*Initializer, error) {
+	if config.OpenBaoAddress == "" || config.OpenBaoAuthRole == "" || config.OpenBaoAuthMount == "" ||

@@ -0,0 +139,4 @@
+	ctx, cancel := context.WithTimeout(ctx, i.config.Timeout)
+	defer cancel()
+
+	clientConfig := openbao.DefaultConfig()

@@ -0,0 +147,4 @@
+	if err != nil {
+		return nil, dependencyFailure("create OpenBao client")
+	}
+	auth, err := kubernetesauth.NewKubernetesAuth(

@@ -64,2 +68,4 @@
+	var externalSecretStoreName, postgreSQLCABundlePath string
+	var reconcileTimeout time.Duration
 	var tlsOpts []func(*tls.Config)
 	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+

@@ -90,0 +115,4 @@
+		PostgreSQLCABundlePath: postgreSQLCABundlePath, Timeout: reconcileTimeout,
+	})
+	if err != nil {
+		setupLog.Error(err, "Invalid controller dependency configuration")

@@ -181,3 +213,2 @@
 	if err := (&controller.PostgreSQLInstanceReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
+		Client: mgr.GetClient(), Scheme: mgr.GetScheme(), Initializer: instanceInitializer, Timeout: reconcileTimeout,

@@ -63,6 +63,9 @@ spec:
         args:
           - --leader-elect
           - --health-probe-bind-address=:8081
+          - --openbao-address=https://openbao.openbao.svc:8200

@@ -37,0 +35,4 @@
+| `--openbao-auth-mount` | `kubernetes` | Kubernetes auth mount 名称 |
+| `--openbao-auth-role` | 必填 | controller ServiceAccount 对应 role |
+| `--openbao-kv-mount` | `kv` | KV v2 mount；开发可显式用 `secret` |
+| `--openbao-service-account-token-path` | `/var/run/secrets/kubernetes.io/serviceaccount/token` | Kubernetes auth 使用的投射 token 文件 |

@@ -75,0 +90,4 @@
+	return ctrl.Result{}, reconcileErr
+}
+
+func (r *PostgreSQLInstanceReconciler) reconcileDependencies(

@@ -0,0 +87,4 @@
+	if config.OpenBaoConsumerAddress == "" {
+		config.OpenBaoConsumerAddress = config.OpenBaoAddress
+	}
+	if err := validateAddress(config.OpenBaoConsumerAddress); err != nil {

@@ -0,0 +126,4 @@
+		return "", privilegeFailure("initialize PostgreSQL registry")
+	}
+	var version string
+	if err := pool.QueryRow(ctx, "SHOW server_version").Scan(&version); err != nil {

@@ -0,0 +193,4 @@
+		pool.Close()
+		return nil, authenticationFailure("authenticate to PostgreSQL")
+	}
+	return pool, nil

@@ -0,0 +196,4 @@
+	return pool, nil
+}
+
+func validateAddress(value string) error {

@@ -0,0 +205,4 @@
+	return nil
+}
+
+func validateRelativePath(value string, rejectAPILayer bool) error {

@@ -41,3 +46,3 @@
 
-func (m instanceStateMachine) reconcile(instance *databasev1alpha1.PostgreSQLInstance) instancePhaseResult {
+func (m *instanceStateMachine) reconcile(ctx context.Context, instance *databasev1alpha1.PostgreSQLInstance) (ctrl.Result, error) {
 	phase := instance.Status.Phase

@@ -59,3 +71,1 @@
-		phase:              databasev1alpha1.PostgreSQLInstancePhaseValidating,
-		reconcilingMessage: "instance dependencies are being validated",
-	}
+func (m *instanceStateMachine) pending(_ context.Context, instance *databasev1alpha1.PostgreSQLInstance) (ctrl.Result, error) {

@@ -66,2 +76,2 @@
-		phase:              databasev1alpha1.PostgreSQLInstancePhaseDeleting,
-		reconcilingMessage: "instance deletion is reconciling",
+func (m *instanceStateMachine) validate(ctx context.Context, instance *databasev1alpha1.PostgreSQLInstance) (ctrl.Result, error) {
+	if m.initializer == nil {

@@ -27,3 +29,3 @@
 
 type instanceStateMachine struct {
-	handlers map[databasev1alpha1.PostgreSQLInstancePhase]instancePhaseHandler
+	initializer PostgreSQLInstanceInitializer

@@ -0,0 +90,4 @@
+	if err := validateAddress(config.OpenBaoConsumerAddress); err != nil {
+		return nil, err
+	}
+	if !filepath.IsAbs(config.ServiceAccountTokenPath) || validateRelativePath(config.OpenBaoAuthMount, false) != nil ||

@@ -37,6 +38,7 @@ import (
 
 	databasev1alpha1 "git.ddupan.top/panxiao81/postgresql-tenant-operator/api/v1alpha1"
 	"git.ddupan.top/panxiao81/postgresql-tenant-operator/internal/controller"
+	instanceinitializer "git.ddupan.top/panxiao81/postgresql-tenant-operator/internal/instance"