Repository: apecloud/kubeblocks

Issue:
[Features] KB actions support HTTP and GRPC


Discussion:

Solution patch:
diff --git a/apis/apps/v1/cluster_types.go b/apis/apps/v1/cluster_types.go
index a3f17c8f1..2ceae1ad3 100644
--- a/apis/apps/v1/cluster_types.go
+++ b/apis/apps/v1/cluster_types.go
@@ -868,11 +868,22 @@ const (
 // ClusterComponentStatus records Component status.
 type ClusterComponentStatus struct {
 	// Specifies the current state of the Component.
+	//
+	// +optional
 	Phase ComponentPhase `json:"phase,omitempty"`
 
 	// Records detailed information about the Component in its current phase.
-	// The keys are either podName, deployName, or statefulSetName, formatted as 'ObjectKind/Name'.
 	//
 	// +optional
 	Message map[string]string `json:"message,omitempty"`
+
+	// Indicates the most recent generation of the component state observed.
+	//
+	// +optional
+	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
+
+	// Indicates whether the component state observed is up-to-date with the desired state.
+	//
+	// +optional
+	UpToDate bool `json:"upToDate,omitempty"`
 }
diff --git a/apis/apps/v1/componentdefinition_types.go b/apis/apps/v1/componentdefinition_types.go
index b959b5d4c..c2ce1ee2e 100644
--- a/apis/apps/v1/componentdefinition_types.go
+++ b/apis/apps/v1/componentdefinition_types.go
@@ -495,6 +495,7 @@ type ComponentDefinitionSpec struct {
 	//     `Immediately`, `RuntimeReady`, `ComponentReady`, and `ClusterReady`.
 	//   - `preTerminate`: Defines the hook to be executed before terminating a Component.
 	//   - `roleProbe`: Defines the procedure which is invoked regularly to assess the role of replicas.
+	//   - `availableProbe`: Defines the procedure which is invoked regularly to assess the availability of the component.
 	//   - `switchover`: Defines the procedure for a controlled transition of a role to a new replica.
 	//     This approach aims to minimize downtime and maintain availability in systems with a leader-follower topology,
 	//     such as before planned maintenance or upgrades on the current leader node.
@@ -1701,6 +1702,7 @@ type ComponentLifecycleActions struct {
 //     `Immediately`, `RuntimeReady`, `ComponentReady`, and `ClusterReady`.
 //   - `preTerminate`: Defines the hook to be executed before terminating a Component.
 //   - `roleProbe`: Defines the procedure which is invoked regularly to assess the role of replicas.
+//   - `availableProbe`: Defines the procedure which is invoked regularly to assess the availability of the component.
 //   - `switchover`: Defines the procedure for a controlled transition of a role to a new replica.
 //   - `memberJoin`: Defines the procedure to add a new replica to the replication group.
 //   - `memberLeave`: Defines the method to remove a replica from the replication group.
@@ -1718,21 +1720,20 @@ type ComponentLifecycleActions struct {
 //     to access context information such as details about pods, components, the overall cluster state,
 //     or database connection credentials.
 //     These variables provide a dynamic and context-aware mechanism for script execution.
-//   - HTTPAction: Performs an HTTP request.
-//     HTTPAction is to be implemented in future version.
-//   - GRPCAction: In future version, Actions will support initiating gRPC calls.
+//   - HTTPAction: Performs a single HTTP(S) request.
+//   - GRPCAction: Issues a unary gRPC call to a target service.
 //     This allows developers to implement Actions using plugins written in programming language like Go,
 //     providing greater flexibility and extensibility.
 //
-// An action is considered successful on returning 0, or HTTP 200 for status HTTP(s) Actions.
+// An action is considered successful on returning 0, or HTTP 2xx for status HTTP actions.
 // Any other return value or HTTP status codes indicate failure,
 // and the action may be retried based on the configured retry policy.
 //
 //   - If an action exceeds the specified timeout duration, it will be terminated, and the action is considered failed.
 //   - If an action produces any data as output, it should be written to stdout,
-//     or included in the HTTP response payload for HTTP(s) actions.
+//     or included in the HTTP response payload for HTTP actions.
 //   - If an action encounters any errors, error messages should be written to stderr,
-//     or detailed in the HTTP response with the appropriate non-200 status code.
+//     or detailed in the HTTP response with the appropriate non-2xx status code.
 type Action struct {
 	// Defines the command to run.
 	//
@@ -1741,6 +1742,45 @@ type Action struct {
 	// +optional
 	Exec *ExecAction `json:"exec,omitempty"`
 
+	// Defines the HTTP request to perform.
+	//
+	// This field cannot be updated.
+	//
+	// +optional
+	HTTP *HTTPAction `json:"http,omitempty"`
+
+	// Defines the gRPC call to issue.
+	//
+	// This field cannot be updated.
+	//
+	// +optional
+	GRPC *GRPCAction `json:"grpc,omitempty"`
+
+	// Defines the criteria used to select the target Pod(s) for executing the Action.
+	// This is useful when there is no default target replica identified.
+	// It allows for precise control over which Pod(s) the Action should run in.
+	//
+	// If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+	// to be removed or added; or a random pod if the Action is triggered at the component level, such as
+	// post-provision or pre-terminate of the component.
+	//
+	// This field cannot be updated.
+	//
+	// +optional
+	TargetPodSelector TargetPodSelector `json:"targetPodSelector,omitempty"`
+
+	// Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+	// The impact of this field depends on the `targetPodSelector` value:
+	//
+	// - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+	// - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+	//   will be selected for the Action.
+	//
+	// This field cannot be updated.
+	//
+	// +optional
+	MatchingKey string `json:"matchingKey,omitempty"`
+
 	// Specifies the maximum duration in seconds that the Action is allowed to run.
 	//
 	// If the Action does not complete within this time frame, it will be terminated.
@@ -1781,6 +1821,10 @@ type Action struct {
 	PreCondition *PreConditionType `json:"preCondition,omitempty"`
 }
 
+func (a *Action) Defined() bool {
+	return a != nil && (a.Exec != nil || a.HTTP != nil || a.GRPC != nil)
+}
+
 // ExecAction describes an Action that executes a command inside a container.
 type ExecAction struct {
 	// Specifies the container image to be used for running the Action.
@@ -1858,6 +1902,153 @@ type ExecAction struct {
 	Container string `json:"container,omitempty"`
 }
 
+// HTTPAction defines an action that performs a single HTTP(S) request.
+//
+// Behavior & templating:
+//   - The request body (`Body`) supports Go text/template syntax. It is rendered with predefined variables
+//     before the request is sent.
+//   - Custom headers (`Headers`) can be specified. Each header value can also use Go text/template
+//     syntax and will be rendered with the same predefined variables.
+//   - Not intended for streaming or large data-transfer workflows (e.g., dataLoad, dataDump).
+//     Designed for one-shot request/response scenarios.
+//
+// Success:
+//   - Any HTTP 2xx status code is considered success by default.
+//   - Non-2xx status codes are treated as failures.
+type HTTPAction struct {
+	// The port to access on the host.
+	// It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+	//
+	// +kubebuilder:validation:Required
+	Port string `json:"port"`
+
+	// The target host to connect to.
+	// Defaults to "127.0.0.1" if not specified.
+	//
+	// +optional
+	Host string `json:"host,omitempty"`
+
+	// The scheme to use for connecting to the host.
+	// Defaults to "HTTP".
+	//
+	// +kubebuilder:validation:Enum={HTTP,HTTPS}
+	// +kubebuilder:default=HTTP
+	// +optional
+	Scheme string `json:"scheme,omitempty"`
+
+	// The path to request on the HTTP server.
+	// Defaults to "/" if not specified.
+	//
+	// +kubebuilder:validation:Pattern="^/.*"
+	// +kubebuilder:default="/"
+	// +optional
+	Path string `json:"path,omitempty"`
+
+	// The HTTP method to use.
+	// Defaults to "GET".
+	//
+	// +kubebuilder:validation:Enum={GET,POST,PUT,DELETE,HEAD,PATCH}
+	// +kubebuilder:default=GET
+	// +optional
+	Method string `json:"method,omitempty"`
+
+	// Custom headers to set in the request.
+	// Header values may use Go text/template syntax, rendered with predefined variables.
+	//
+	// +optional
+	Headers []HTTPHeader `json:"headers,omitempty"`
+
+	// Optional HTTP request body.
+	//
+	// Supports Go text/template syntax; rendered with predefined variables before sending.
+	//
+	// +optional
+	Body string `json:"body,omitempty"`
+
+	// TODO: HTTPS
+}
+
+// HTTPHeader represents a single HTTP header key/value pair.
+type HTTPHeader struct {
+	// Name of the header field.
+	Name string `json:"name"`
+
+	// Value of the header field.
+	Value string `json:"value"`
+}
+
+// GRPCAction describes an action that issues a unary gRPC call to a target service.
+//
+// Reflection & templating:
+//   - This implementation uses gRPC Server Reflection to discover service/method schemas at runtime.
+//     The target service MUST enable reflection. See: https://grpc.io/docs/guides/reflection/.
+//   - Request message field values in `Request` support Go text/template syntax and will be rendered
+//     with predefined action variables before marshaling into the request message.
+//   - Not intended for streaming or large data-transfer operations (e.g., dataLoad, dataDump).
+//     Only unary (non-streaming) RPCs are supported.
+//
+// Success & output:
+//   - After invocation, the `Status` field in `Response` (if set) is inspected; a non-empty value
+//     indicates failure.
+//   - The `Message` field in `Response` (if set) is written to stdout if the invocation succeeds,
+//     or to stderr if it fails.
+type GRPCAction struct {
+	// The port to access on the host.
+	// It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+	//
+	// +kubebuilder:validation:Required
+	Port string `json:"port"`
+
+	// The target host to connect to.
+	// Defaults to "127.0.0.1" if not specified.
+	//
+	// +optional
+	Host string `json:"host,omitempty"`
+
+	// Fully-qualified name of the gRPC service to call.
+	//
+	// +kubebuilder:validation:Required
+	Service string `json:"service"`
+
+	// Name of the method to invoke on the gRPC service.
+	//
+	// +kubebuilder:validation:Required
+	Method string `json:"method"`
+
+	// Request payload for the gRPC method.
+	//
+	// Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+	// Templates are rendered with predefined action variables before the request is sent.
+	//
+	// +optional
+	Request GRPCRequest `json:"request,omitempty"`
+
+	// Required response schema for the gRPC method.
+	//
+	// +optional
+	Response GRPCResponse `json:"response,omitempty"`
+
+	// TODO: TLS
+}
+
+// GRPCRequest is a map of proto field names to their string values.
+type GRPCRequest map[string]string
+
+// GRPCResponse defines which fields in the gRPC response should be treated as status or output.
+type GRPCResponse struct {
+	// Name of the string field in the response that carries status information.
+	// If non-empty, the action fails.
+	//
+	// +optional
+	Status string `json:"status,omitempty"`
+
+	// Name of the field in the response whose value should be output.
+	// Printed to stdout on success, or stderr on failure.
+	//
+	// +optional
+	Message string `json:"message,omitempty"`
+}
+
 // TargetPodSelector defines how to select pod(s) to execute an Action.
 // +enum
 // +kubebuilder:validation:Enum={Any,All,Role,Ordinal}
diff --git a/apis/apps/v1/zz_generated.deepcopy.go b/apis/apps/v1/zz_generated.deepcopy.go
index 5cc634b46..495304d27 100644
--- a/apis/apps/v1/zz_generated.deepcopy.go
+++ b/apis/apps/v1/zz_generated.deepcopy.go
@@ -40,6 +40,16 @@ func (in *Action) DeepCopyInto(out *Action) {
 		*out = new(ExecAction)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = new(HTTPAction)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.GRPC != nil {
+		in, out := &in.GRPC, &out.GRPC
+		*out = new(GRPCAction)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.RetryPolicy != nil {
 		in, out := &in.RetryPolicy, &out.RetryPolicy
 		*out = new(RetryPolicy)
@@ -2065,6 +2075,100 @@ func (in *Exporter) DeepCopy() *Exporter {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GRPCAction) DeepCopyInto(out *GRPCAction) {
+	*out = *in
+	if in.Request != nil {
+		in, out := &in.Request, &out.Request
+		*out = make(GRPCRequest, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	out.Response = in.Response
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GRPCAction.
+func (in *GRPCAction) DeepCopy() *GRPCAction {
+	if in == nil {
+		return nil
+	}
+	out := new(GRPCAction)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in GRPCRequest) DeepCopyInto(out *GRPCRequest) {
+	{
+		in := &in
+		*out = make(GRPCRequest, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GRPCRequest.
+func (in GRPCRequest) DeepCopy() GRPCRequest {
+	if in == nil {
+		return nil
+	}
+	out := new(GRPCRequest)
+	in.DeepCopyInto(out)
+	return *out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GRPCResponse) DeepCopyInto(out *GRPCResponse) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GRPCResponse.
+func (in *GRPCResponse) DeepCopy() *GRPCResponse {
+	if in == nil {
+		return nil
+	}
+	out := new(GRPCResponse)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPAction) DeepCopyInto(out *HTTPAction) {
+	*out = *in
+	if in.Headers != nil {
+		in, out := &in.Headers, &out.Headers
+		*out = make([]HTTPHeader, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPAction.
+func (in *HTTPAction) DeepCopy() *HTTPAction {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPAction)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPHeader) DeepCopyInto(out *HTTPHeader) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPHeader.
+func (in *HTTPHeader) DeepCopy() *HTTPHeader {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPHeader)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *HostNetwork) DeepCopyInto(out *HostNetwork) {
 	*out = *in
diff --git a/config/crd/bases/apps.kubeblocks.io_clusters.yaml b/config/crd/bases/apps.kubeblocks.io_clusters.yaml
index 7a294fb09..c6f16659f 100644
--- a/config/crd/bases/apps.kubeblocks.io_clusters.yaml
+++ b/config/crd/bases/apps.kubeblocks.io_clusters.yaml
@@ -515,6 +515,149 @@ spec:
                                     - Ordinal
                                     type: string
                                 type: object
+                              grpc:
+                                description: |-
+                                  Defines the gRPC call to issue.
+
+
+                                  This field cannot be updated.
+                                properties:
+                                  host:
+                                    description: |-
+                                      The target host to connect to.
+                                      Defaults to "127.0.0.1" if not specified.
+                                    type: string
+                                  method:
+                                    description: Name of the method to invoke on the
+                                      gRPC service.
+                                    type: string
+                                  port:
+                                    description: |-
+                                      The port to access on the host.
+                                      It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                                    type: string
+                                  request:
+                                    additionalProperties:
+                                      type: string
+                                    description: |-
+                                      Request payload for the gRPC method.
+
+
+                                      Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                      Templates are rendered with predefined action variables before the request is sent.
+                                    type: object
+                                  response:
+                                    description: Required response schema for the
+                                      gRPC method.
+                                    properties:
+                                      message:
+                                        description: |-
+                                          Name of the field in the response whose value should be output.
+                                          Printed to stdout on success, or stderr on failure.
+                                        type: string
+                                      status:
+                                        description: |-
+                                          Name of the string field in the response that carries status information.
+                                          If non-empty, the action fails.
+                                        type: string
+                                    type: object
+                                  service:
+                                    description: Fully-qualified name of the gRPC
+                                      service to call.
+                                    type: string
+                                required:
+                                - method
+                                - port
+                                - service
+                                type: object
+                              http:
+                                description: |-
+                                  Defines the HTTP request to perform.
+
+
+                                  This field cannot be updated.
+                                properties:
+                                  body:
+                                    description: |-
+                                      Optional HTTP request body.
+
+
+                                      Supports Go text/template syntax; rendered with predefined variables before sending.
+                                    type: string
+                                  headers:
+                                    description: |-
+                                      Custom headers to set in the request.
+                                      Header values may use Go text/template syntax, rendered with predefined variables.
+                                    items:
+                                      description: HTTPHeader represents a single
+                                        HTTP header key/value pair.
+                                      properties:
+                                        name:
+                                          description: Name of the header field.
+                                          type: string
+                                        value:
+                                          description: Value of the header field.
+                                          type: string
+                                      required:
+                                      - name
+                                      - value
+                                      type: object
+                                    type: array
+                                  host:
+                                    description: |-
+                                      The target host to connect to.
+                                      Defaults to "127.0.0.1" if not specified.
+                                    type: string
+                                  method:
+                                    default: GET
+                                    description: |-
+                                      The HTTP method to use.
+                                      Defaults to "GET".
+                                    enum:
+                                    - GET
+                                    - POST
+                                    - PUT
+                                    - DELETE
+                                    - HEAD
+                                    - PATCH
+                                    type: string
+                                  path:
+                                    default: /
+                                    description: |-
+                                      The path to request on the HTTP server.
+                                      Defaults to "/" if not specified.
+                                    pattern: ^/.*
+                                    type: string
+                                  port:
+                                    description: |-
+                                      The port to access on the host.
+                                      It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                                    type: string
+                                  scheme:
+                                    default: HTTP
+                                    description: |-
+                                      The scheme to use for connecting to the host.
+                                      Defaults to "HTTP".
+                                    enum:
+                                    - HTTP
+                                    - HTTPS
+                                    type: string
+                                required:
+                                - port
+                                type: object
+                              matchingKey:
+                                description: |-
+                                  Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                                  The impact of this field depends on the `targetPodSelector` value:
+
+
+                                  - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                                  - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                                    will be selected for the Action.
+
+
+                                  This field cannot be updated.
+                                type: string
                               preCondition:
                                 description: |-
                                   Specifies the state that the cluster must reach before the Action is executed.
@@ -561,6 +704,25 @@ spec:
                                     format: int64
                                     type: integer
                                 type: object
+                              targetPodSelector:
+                                description: |-
+                                  Defines the criteria used to select the target Pod(s) for executing the Action.
+                                  This is useful when there is no default target replica identified.
+                                  It allows for precise control over which Pod(s) the Action should run in.
+
+
+                                  If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                                  to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                                  post-provision or pre-terminate of the component.
+
+
+                                  This field cannot be updated.
+                                enum:
+                                - Any
+                                - All
+                                - Role
+                                - Ordinal
+                                type: string
                               timeoutSeconds:
                                 default: 0
                                 description: |-
@@ -11565,6 +11727,149 @@ spec:
                                         - Ordinal
                                         type: string
                                     type: object
+                                  grpc:
+                                    description: |-
+                                      Defines the gRPC call to issue.
+
+
+                                      This field cannot be updated.
+                                    properties:
+                                      host:
+                                        description: |-
+                                          The target host to connect to.
+                                          Defaults to "127.0.0.1" if not specified.
+                                        type: string
+                                      method:
+                                        description: Name of the method to invoke
+                                          on the gRPC service.
+                                        type: string
+                                      port:
+                                        description: |-
+                                          The port to access on the host.
+                                          It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                                        type: string
+                                      request:
+                                        additionalProperties:
+                                          type: string
+                                        description: |-
+                                          Request payload for the gRPC method.
+
+
+                                          Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                          Templates are rendered with predefined action variables before the request is sent.
+                                        type: object
+                                      response:
+                                        description: Required response schema for
+                                          the gRPC method.
+                                        properties:
+                                          message:
+                                            description: |-
+                                              Name of the field in the response whose value should be output.
+                                              Printed to stdout on success, or stderr on failure.
+                                            type: string
+                                          status:
+                                            description: |-
+                                              Name of the string field in the response that carries status information.
+                                              If non-empty, the action fails.
+                                            type: string
+                                        type: object
+                                      service:
+                                        description: Fully-qualified name of the gRPC
+                                          service to call.
+                                        type: string
+                                    required:
+                                    - method
+                                    - port
+                                    - service
+                                    type: object
+                                  http:
+                                    description: |-
+                                      Defines the HTTP request to perform.
+
+
+                                      This field cannot be updated.
+                                    properties:
+                                      body:
+                                        description: |-
+                                          Optional HTTP request body.
+
+
+                                          Supports Go text/template syntax; rendered with predefined variables before sending.
+                                        type: string
+                                      headers:
+                                        description: |-
+                                          Custom headers to set in the request.
+                                          Header values may use Go text/template syntax, rendered with predefined variables.
+                                        items:
+                                          description: HTTPHeader represents a single
+                                            HTTP header key/value pair.
+                                          properties:
+                                            name:
+                                              description: Name of the header field.
+                                              type: string
+                                            value:
+                                              description: Value of the header field.
+                                              type: string
+                                          required:
+                                          - name
+                                          - value
+                                          type: object
+                                        type: array
+                                      host:
+                                        description: |-
+                                          The target host to connect to.
+                                          Defaults to "127.0.0.1" if not specified.
+                                        type: string
+                                      method:
+                                        default: GET
+                                        description: |-
+                                          The HTTP method to use.
+                                          Defaults to "GET".
+                                        enum:
+                                        - GET
+                                        - POST
+                                        - PUT
+                                        - DELETE
+                                        - HEAD
+                                        - PATCH
+                                        type: string
+                                      path:
+                                        default: /
+                                        description: |-
+                                          The path to request on the HTTP server.
+                                          Defaults to "/" if not specified.
+                                        pattern: ^/.*
+                                        type: string
+                                      port:
+                                        description: |-
+                                          The port to access on the host.
+                                          It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                                        type: string
+                                      scheme:
+                                        default: HTTP
+                                        description: |-
+                                          The scheme to use for connecting to the host.
+                                          Defaults to "HTTP".
+                                        enum:
+                                        - HTTP
+                                        - HTTPS
+                                        type: string
+                                    required:
+                                    - port
+                                    type: object
+                                  matchingKey:
+                                    description: |-
+                                      Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                                      The impact of this field depends on the `targetPodSelector` value:
+
+
+                                      - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                                      - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                                        will be selected for the Action.
+
+
+                                      This field cannot be updated.
+                                    type: string
                                   preCondition:
                                     description: |-
                                       Specifies the state that the cluster must reach before the Action is executed.
@@ -11611,6 +11916,25 @@ spec:
                                         format: int64
                                         type: integer
                                     type: object
+                                  targetPodSelector:
+                                    description: |-
+                                      Defines the criteria used to select the target Pod(s) for executing the Action.
+                                      This is useful when there is no default target replica identified.
+                                      It allows for precise control over which Pod(s) the Action should run in.
+
+
+                                      If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                                      to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                                      post-provision or pre-terminate of the component.
+
+
+                                      This field cannot be updated.
+                                    enum:
+                                    - Any
+                                    - All
+                                    - Role
+                                    - Ordinal
+                                    type: string
                                   timeoutSeconds:
                                     default: 0
                                     description: |-
@@ -17362,10 +17686,14 @@ spec:
                     message:
                       additionalProperties:
                         type: string
-                      description: |-
-                        Records detailed information about the Component in its current phase.
-                        The keys are either podName, deployName, or statefulSetName, formatted as 'ObjectKind/Name'.
+                      description: Records detailed information about the Component
+                        in its current phase.
                       type: object
+                    observedGeneration:
+                      description: Indicates the most recent generation of the component
+                        state observed.
+                      format: int64
+                      type: integer
                     phase:
                       description: Specifies the current state of the Component.
                       enum:
@@ -17378,6 +17706,10 @@ spec:
                       - Stopped
                       - Failed
                       type: string
+                    upToDate:
+                      description: Indicates whether the component state observed
+                        is up-to-date with the desired state.
+                      type: boolean
                   type: object
                 description: Records the current status information of all Components
                   within the Cluster.
@@ -17488,10 +17820,14 @@ spec:
                     message:
                       additionalProperties:
                         type: string
-                      description: |-
-                        Records detailed information about the Component in its current phase.
-                        The keys are either podName, deployName, or statefulSetName, formatted as 'ObjectKind/Name'.
+                      description: Records detailed information about the Component
+                        in its current phase.
                       type: object
+                    observedGeneration:
+                      description: Indicates the most recent generation of the component
+                        state observed.
+                      format: int64
+                      type: integer
                     phase:
                       description: Specifies the current state of the Component.
                       enum:
@@ -17504,6 +17840,10 @@ spec:
                       - Stopped
                       - Failed
                       type: string
+                    upToDate:
+                      description: Indicates whether the component state observed
+                        is up-to-date with the desired state.
+                      type: boolean
                   type: object
                 description: Records the current status information of all shardings
                   within the Cluster.
diff --git a/config/crd/bases/apps.kubeblocks.io_componentdefinitions.yaml b/config/crd/bases/apps.kubeblocks.io_componentdefinitions.yaml
index 516819ec9..743527b79 100644
--- a/config/crd/bases/apps.kubeblocks.io_componentdefinitions.yaml
+++ b/config/crd/bases/apps.kubeblocks.io_componentdefinitions.yaml
@@ -4399,6 +4399,7 @@ spec:
                       `Immediately`, `RuntimeReady`, `ComponentReady`, and `ClusterReady`.
                     - `preTerminate`: Defines the hook to be executed before terminating a Component.
                     - `roleProbe`: Defines the procedure which is invoked regularly to assess the role of replicas.
+                    - `availableProbe`: Defines the procedure which is invoked regularly to assess the availability of the component.
                     - `switchover`: Defines the procedure for a controlled transition of a role to a new replica.
                       This approach aims to minimize downtime and maintain availability in systems with a leader-follower topology,
                       such as before planned maintenance or upgrades on the current leader node.
@@ -4640,6 +4641,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -4686,6 +4829,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -4918,12 +5080,154 @@ spec:
                           Defaults to 3. Minimum value is 1.
                         format: int32
                         type: integer
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
                       initialDelaySeconds:
                         description: |-
                           Specifies the number of seconds to wait after the container has started before the RoleProbe
                           begins to detect the container's role.
                         format: int32
                         type: integer
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       periodSeconds:
                         description: |-
                           Specifies the frequency at which the probe is conducted. This value is expressed in seconds.
@@ -4982,6 +5286,25 @@ spec:
                           Defaults to 1. Minimum value is 1.
                         format: int32
                         type: integer
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -5229,6 +5552,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -5275,6 +5740,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -5515,30 +5999,172 @@ spec:
                             - Ordinal
                             type: string
                         type: object
-                      preCondition:
+                      grpc:
                         description: |-
-                          Specifies the state that the cluster must reach before the Action is executed.
-                          Currently, this is only applicable to the `postProvision` action.
-
-
-                          The conditions are as follows:
+                          Defines the gRPC call to issue.
 
 
-                          - `Immediately`: Executed right after the Component object is created.
-                            The readiness of the Component and its resources is not guaranteed at this stage.
-                          - `RuntimeReady`: The Action is triggered after the Component object has been created and all associated
-                            runtime resources (e.g. Pods) are in a ready state.
-                          - `ComponentReady`: The Action is triggered after the Component itself is in a ready state.
-                            This process does not affect the readiness state of the Component or the Cluster.
-                          - `ClusterReady`: The Action is executed after the Cluster is in a ready state.
-                            This execution does not alter the Component or the Cluster's state of readiness.
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
 
 
-                          This field cannot be updated.
-                        type: string
-                      retryPolicy:
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
                         description: |-
-                          Defines the strategy to be taken when retrying the Action after a failure.
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
+                      preCondition:
+                        description: |-
+                          Specifies the state that the cluster must reach before the Action is executed.
+                          Currently, this is only applicable to the `postProvision` action.
+
+
+                          The conditions are as follows:
+
+
+                          - `Immediately`: Executed right after the Component object is created.
+                            The readiness of the Component and its resources is not guaranteed at this stage.
+                          - `RuntimeReady`: The Action is triggered after the Component object has been created and all associated
+                            runtime resources (e.g. Pods) are in a ready state.
+                          - `ComponentReady`: The Action is triggered after the Component itself is in a ready state.
+                            This process does not affect the readiness state of the Component or the Cluster.
+                          - `ClusterReady`: The Action is executed after the Cluster is in a ready state.
+                            This execution does not alter the Component or the Cluster's state of readiness.
+
+
+                          This field cannot be updated.
+                        type: string
+                      retryPolicy:
+                        description: |-
+                          Defines the strategy to be taken when retrying the Action after a failure.
 
 
                           It specifies the conditions under which the Action should be retried and the limits to apply,
@@ -5561,6 +6187,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -5800,6 +6445,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -5846,6 +6633,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -6087,6 +6893,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -6133,6 +7081,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -6367,6 +7334,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -6413,6 +7522,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -6647,6 +7775,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -6693,6 +7963,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -6927,6 +8216,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -6973,6 +8404,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -7189,26 +8639,168 @@ spec:
 
                               This field cannot be updated.
                             type: string
-                          targetPodSelector:
+                          targetPodSelector:
+                            description: |-
+                              Defines the criteria used to select the target Pod(s) for executing the Action.
+                              This is useful when there is no default target replica identified.
+                              It allows for precise control over which Pod(s) the Action should run in.
+
+
+                              If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                              to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                              post-provision or pre-terminate of the component.
+
+
+                              This field cannot be updated.
+                            enum:
+                            - Any
+                            - All
+                            - Role
+                            - Ordinal
+                            type: string
+                        type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
                             description: |-
-                              Defines the criteria used to select the target Pod(s) for executing the Action.
-                              This is useful when there is no default target replica identified.
-                              It allows for precise control over which Pod(s) the Action should run in.
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
 
 
-                              If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
-                              to be removed or added; or a random pod if the Action is triggered at the component level, such as
-                              post-provision or pre-terminate of the component.
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
 
 
-                              This field cannot be updated.
-                            enum:
-                            - Any
-                            - All
-                            - Role
-                            - Ordinal
-                            type: string
-                        type: object
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -7255,6 +8847,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -7484,6 +9095,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -7530,6 +9283,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -7781,12 +9553,154 @@ spec:
                           Defaults to 3. Minimum value is 1.
                         format: int32
                         type: integer
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
                       initialDelaySeconds:
                         description: |-
                           Specifies the number of seconds to wait after the container has started before the RoleProbe
                           begins to detect the container's role.
                         format: int32
                         type: integer
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       periodSeconds:
                         description: |-
                           Specifies the frequency at which the probe is conducted. This value is expressed in seconds.
@@ -7845,6 +9759,25 @@ spec:
                           Defaults to 1. Minimum value is 1.
                         format: int32
                         type: integer
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -8086,6 +10019,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -8132,6 +10207,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
diff --git a/config/crd/bases/apps.kubeblocks.io_components.yaml b/config/crd/bases/apps.kubeblocks.io_components.yaml
index 8a8e4de4a..65297f42f 100644
--- a/config/crd/bases/apps.kubeblocks.io_components.yaml
+++ b/config/crd/bases/apps.kubeblocks.io_components.yaml
@@ -387,6 +387,148 @@ spec:
                               - Ordinal
                               type: string
                           type: object
+                        grpc:
+                          description: |-
+                            Defines the gRPC call to issue.
+
+
+                            This field cannot be updated.
+                          properties:
+                            host:
+                              description: |-
+                                The target host to connect to.
+                                Defaults to "127.0.0.1" if not specified.
+                              type: string
+                            method:
+                              description: Name of the method to invoke on the gRPC
+                                service.
+                              type: string
+                            port:
+                              description: |-
+                                The port to access on the host.
+                                It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                              type: string
+                            request:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                Request payload for the gRPC method.
+
+
+                                Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                Templates are rendered with predefined action variables before the request is sent.
+                              type: object
+                            response:
+                              description: Required response schema for the gRPC method.
+                              properties:
+                                message:
+                                  description: |-
+                                    Name of the field in the response whose value should be output.
+                                    Printed to stdout on success, or stderr on failure.
+                                  type: string
+                                status:
+                                  description: |-
+                                    Name of the string field in the response that carries status information.
+                                    If non-empty, the action fails.
+                                  type: string
+                              type: object
+                            service:
+                              description: Fully-qualified name of the gRPC service
+                                to call.
+                              type: string
+                          required:
+                          - method
+                          - port
+                          - service
+                          type: object
+                        http:
+                          description: |-
+                            Defines the HTTP request to perform.
+
+
+                            This field cannot be updated.
+                          properties:
+                            body:
+                              description: |-
+                                Optional HTTP request body.
+
+
+                                Supports Go text/template syntax; rendered with predefined variables before sending.
+                              type: string
+                            headers:
+                              description: |-
+                                Custom headers to set in the request.
+                                Header values may use Go text/template syntax, rendered with predefined variables.
+                              items:
+                                description: HTTPHeader represents a single HTTP header
+                                  key/value pair.
+                                properties:
+                                  name:
+                                    description: Name of the header field.
+                                    type: string
+                                  value:
+                                    description: Value of the header field.
+                                    type: string
+                                required:
+                                - name
+                                - value
+                                type: object
+                              type: array
+                            host:
+                              description: |-
+                                The target host to connect to.
+                                Defaults to "127.0.0.1" if not specified.
+                              type: string
+                            method:
+                              default: GET
+                              description: |-
+                                The HTTP method to use.
+                                Defaults to "GET".
+                              enum:
+                              - GET
+                              - POST
+                              - PUT
+                              - DELETE
+                              - HEAD
+                              - PATCH
+                              type: string
+                            path:
+                              default: /
+                              description: |-
+                                The path to request on the HTTP server.
+                                Defaults to "/" if not specified.
+                              pattern: ^/.*
+                              type: string
+                            port:
+                              description: |-
+                                The port to access on the host.
+                                It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                              type: string
+                            scheme:
+                              default: HTTP
+                              description: |-
+                                The scheme to use for connecting to the host.
+                                Defaults to "HTTP".
+                              enum:
+                              - HTTP
+                              - HTTPS
+                              type: string
+                          required:
+                          - port
+                          type: object
+                        matchingKey:
+                          description: |-
+                            Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                            The impact of this field depends on the `targetPodSelector` value:
+
+
+                            - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                            - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                              will be selected for the Action.
+
+
+                            This field cannot be updated.
+                          type: string
                         preCondition:
                           description: |-
                             Specifies the state that the cluster must reach before the Action is executed.
@@ -433,6 +575,25 @@ spec:
                               format: int64
                               type: integer
                           type: object
+                        targetPodSelector:
+                          description: |-
+                            Defines the criteria used to select the target Pod(s) for executing the Action.
+                            This is useful when there is no default target replica identified.
+                            It allows for precise control over which Pod(s) the Action should run in.
+
+
+                            If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                            to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                            post-provision or pre-terminate of the component.
+
+
+                            This field cannot be updated.
+                          enum:
+                          - Any
+                          - All
+                          - Role
+                          - Ordinal
+                          type: string
                         timeoutSeconds:
                           default: 0
                           description: |-
diff --git a/config/crd/bases/apps.kubeblocks.io_rollouts.yaml b/config/crd/bases/apps.kubeblocks.io_rollouts.yaml
index dd923a11e..94756f8b5 100644
--- a/config/crd/bases/apps.kubeblocks.io_rollouts.yaml
+++ b/config/crd/bases/apps.kubeblocks.io_rollouts.yaml
@@ -363,6 +363,151 @@ spec:
                                               - Ordinal
                                               type: string
                                           type: object
+                                        grpc:
+                                          description: |-
+                                            Defines the gRPC call to issue.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              description: Name of the method to invoke
+                                                on the gRPC service.
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                                              type: string
+                                            request:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                Request payload for the gRPC method.
+
+
+                                                Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                                Templates are rendered with predefined action variables before the request is sent.
+                                              type: object
+                                            response:
+                                              description: Required response schema
+                                                for the gRPC method.
+                                              properties:
+                                                message:
+                                                  description: |-
+                                                    Name of the field in the response whose value should be output.
+                                                    Printed to stdout on success, or stderr on failure.
+                                                  type: string
+                                                status:
+                                                  description: |-
+                                                    Name of the string field in the response that carries status information.
+                                                    If non-empty, the action fails.
+                                                  type: string
+                                              type: object
+                                            service:
+                                              description: Fully-qualified name of
+                                                the gRPC service to call.
+                                              type: string
+                                          required:
+                                          - method
+                                          - port
+                                          - service
+                                          type: object
+                                        http:
+                                          description: |-
+                                            Defines the HTTP request to perform.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            body:
+                                              description: |-
+                                                Optional HTTP request body.
+
+
+                                                Supports Go text/template syntax; rendered with predefined variables before sending.
+                                              type: string
+                                            headers:
+                                              description: |-
+                                                Custom headers to set in the request.
+                                                Header values may use Go text/template syntax, rendered with predefined variables.
+                                              items:
+                                                description: HTTPHeader represents
+                                                  a single HTTP header key/value pair.
+                                                properties:
+                                                  name:
+                                                    description: Name of the header
+                                                      field.
+                                                    type: string
+                                                  value:
+                                                    description: Value of the header
+                                                      field.
+                                                    type: string
+                                                required:
+                                                - name
+                                                - value
+                                                type: object
+                                              type: array
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              default: GET
+                                              description: |-
+                                                The HTTP method to use.
+                                                Defaults to "GET".
+                                              enum:
+                                              - GET
+                                              - POST
+                                              - PUT
+                                              - DELETE
+                                              - HEAD
+                                              - PATCH
+                                              type: string
+                                            path:
+                                              default: /
+                                              description: |-
+                                                The path to request on the HTTP server.
+                                                Defaults to "/" if not specified.
+                                              pattern: ^/.*
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                                              type: string
+                                            scheme:
+                                              default: HTTP
+                                              description: |-
+                                                The scheme to use for connecting to the host.
+                                                Defaults to "HTTP".
+                                              enum:
+                                              - HTTP
+                                              - HTTPS
+                                              type: string
+                                          required:
+                                          - port
+                                          type: object
+                                        matchingKey:
+                                          description: |-
+                                            Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                                            The impact of this field depends on the `targetPodSelector` value:
+
+
+                                            - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                                            - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                                              will be selected for the Action.
+
+
+                                            This field cannot be updated.
+                                          type: string
                                         preCondition:
                                           description: |-
                                             Specifies the state that the cluster must reach before the Action is executed.
@@ -409,6 +554,25 @@ spec:
                                               format: int64
                                               type: integer
                                           type: object
+                                        targetPodSelector:
+                                          description: |-
+                                            Defines the criteria used to select the target Pod(s) for executing the Action.
+                                            This is useful when there is no default target replica identified.
+                                            It allows for precise control over which Pod(s) the Action should run in.
+
+
+                                            If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                                            to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                                            post-provision or pre-terminate of the component.
+
+
+                                            This field cannot be updated.
+                                          enum:
+                                          - Any
+                                          - All
+                                          - Role
+                                          - Ordinal
+                                          type: string
                                         timeoutSeconds:
                                           default: 0
                                           description: |-
@@ -651,6 +815,151 @@ spec:
                                               - Ordinal
                                               type: string
                                           type: object
+                                        grpc:
+                                          description: |-
+                                            Defines the gRPC call to issue.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              description: Name of the method to invoke
+                                                on the gRPC service.
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                                              type: string
+                                            request:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                Request payload for the gRPC method.
+
+
+                                                Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                                Templates are rendered with predefined action variables before the request is sent.
+                                              type: object
+                                            response:
+                                              description: Required response schema
+                                                for the gRPC method.
+                                              properties:
+                                                message:
+                                                  description: |-
+                                                    Name of the field in the response whose value should be output.
+                                                    Printed to stdout on success, or stderr on failure.
+                                                  type: string
+                                                status:
+                                                  description: |-
+                                                    Name of the string field in the response that carries status information.
+                                                    If non-empty, the action fails.
+                                                  type: string
+                                              type: object
+                                            service:
+                                              description: Fully-qualified name of
+                                                the gRPC service to call.
+                                              type: string
+                                          required:
+                                          - method
+                                          - port
+                                          - service
+                                          type: object
+                                        http:
+                                          description: |-
+                                            Defines the HTTP request to perform.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            body:
+                                              description: |-
+                                                Optional HTTP request body.
+
+
+                                                Supports Go text/template syntax; rendered with predefined variables before sending.
+                                              type: string
+                                            headers:
+                                              description: |-
+                                                Custom headers to set in the request.
+                                                Header values may use Go text/template syntax, rendered with predefined variables.
+                                              items:
+                                                description: HTTPHeader represents
+                                                  a single HTTP header key/value pair.
+                                                properties:
+                                                  name:
+                                                    description: Name of the header
+                                                      field.
+                                                    type: string
+                                                  value:
+                                                    description: Value of the header
+                                                      field.
+                                                    type: string
+                                                required:
+                                                - name
+                                                - value
+                                                type: object
+                                              type: array
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              default: GET
+                                              description: |-
+                                                The HTTP method to use.
+                                                Defaults to "GET".
+                                              enum:
+                                              - GET
+                                              - POST
+                                              - PUT
+                                              - DELETE
+                                              - HEAD
+                                              - PATCH
+                                              type: string
+                                            path:
+                                              default: /
+                                              description: |-
+                                                The path to request on the HTTP server.
+                                                Defaults to "/" if not specified.
+                                              pattern: ^/.*
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                                              type: string
+                                            scheme:
+                                              default: HTTP
+                                              description: |-
+                                                The scheme to use for connecting to the host.
+                                                Defaults to "HTTP".
+                                              enum:
+                                              - HTTP
+                                              - HTTPS
+                                              type: string
+                                          required:
+                                          - port
+                                          type: object
+                                        matchingKey:
+                                          description: |-
+                                            Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                                            The impact of this field depends on the `targetPodSelector` value:
+
+
+                                            - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                                            - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                                              will be selected for the Action.
+
+
+                                            This field cannot be updated.
+                                          type: string
                                         preCondition:
                                           description: |-
                                             Specifies the state that the cluster must reach before the Action is executed.
@@ -697,6 +1006,25 @@ spec:
                                               format: int64
                                               type: integer
                                           type: object
+                                        targetPodSelector:
+                                          description: |-
+                                            Defines the criteria used to select the target Pod(s) for executing the Action.
+                                            This is useful when there is no default target replica identified.
+                                            It allows for precise control over which Pod(s) the Action should run in.
+
+
+                                            If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                                            to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                                            post-provision or pre-terminate of the component.
+
+
+                                            This field cannot be updated.
+                                          enum:
+                                          - Any
+                                          - All
+                                          - Role
+                                          - Ordinal
+                                          type: string
                                         timeoutSeconds:
                                           default: 0
                                           description: |-
@@ -3420,6 +3748,151 @@ spec:
                                               - Ordinal
                                               type: string
                                           type: object
+                                        grpc:
+                                          description: |-
+                                            Defines the gRPC call to issue.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              description: Name of the method to invoke
+                                                on the gRPC service.
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                                              type: string
+                                            request:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                Request payload for the gRPC method.
+
+
+                                                Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                                Templates are rendered with predefined action variables before the request is sent.
+                                              type: object
+                                            response:
+                                              description: Required response schema
+                                                for the gRPC method.
+                                              properties:
+                                                message:
+                                                  description: |-
+                                                    Name of the field in the response whose value should be output.
+                                                    Printed to stdout on success, or stderr on failure.
+                                                  type: string
+                                                status:
+                                                  description: |-
+                                                    Name of the string field in the response that carries status information.
+                                                    If non-empty, the action fails.
+                                                  type: string
+                                              type: object
+                                            service:
+                                              description: Fully-qualified name of
+                                                the gRPC service to call.
+                                              type: string
+                                          required:
+                                          - method
+                                          - port
+                                          - service
+                                          type: object
+                                        http:
+                                          description: |-
+                                            Defines the HTTP request to perform.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            body:
+                                              description: |-
+                                                Optional HTTP request body.
+
+
+                                                Supports Go text/template syntax; rendered with predefined variables before sending.
+                                              type: string
+                                            headers:
+                                              description: |-
+                                                Custom headers to set in the request.
+                                                Header values may use Go text/template syntax, rendered with predefined variables.
+                                              items:
+                                                description: HTTPHeader represents
+                                                  a single HTTP header key/value pair.
+                                                properties:
+                                                  name:
+                                                    description: Name of the header
+                                                      field.
+                                                    type: string
+                                                  value:
+                                                    description: Value of the header
+                                                      field.
+                                                    type: string
+                                                required:
+                                                - name
+                                                - value
+                                                type: object
+                                              type: array
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              default: GET
+                                              description: |-
+                                                The HTTP method to use.
+                                                Defaults to "GET".
+                                              enum:
+                                              - GET
+                                              - POST
+                                              - PUT
+                                              - DELETE
+                                              - HEAD
+                                              - PATCH
+                                              type: string
+                                            path:
+                                              default: /
+                                              description: |-
+                                                The path to request on the HTTP server.
+                                                Defaults to "/" if not specified.
+                                              pattern: ^/.*
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                                              type: string
+                                            scheme:
+                                              default: HTTP
+                                              description: |-
+                                                The scheme to use for connecting to the host.
+                                                Defaults to "HTTP".
+                                              enum:
+                                              - HTTP
+                                              - HTTPS
+                                              type: string
+                                          required:
+                                          - port
+                                          type: object
+                                        matchingKey:
+                                          description: |-
+                                            Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                                            The impact of this field depends on the `targetPodSelector` value:
+
+
+                                            - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                                            - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                                              will be selected for the Action.
+
+
+                                            This field cannot be updated.
+                                          type: string
                                         preCondition:
                                           description: |-
                                             Specifies the state that the cluster must reach before the Action is executed.
@@ -3466,6 +3939,25 @@ spec:
                                               format: int64
                                               type: integer
                                           type: object
+                                        targetPodSelector:
+                                          description: |-
+                                            Defines the criteria used to select the target Pod(s) for executing the Action.
+                                            This is useful when there is no default target replica identified.
+                                            It allows for precise control over which Pod(s) the Action should run in.
+
+
+                                            If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                                            to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                                            post-provision or pre-terminate of the component.
+
+
+                                            This field cannot be updated.
+                                          enum:
+                                          - Any
+                                          - All
+                                          - Role
+                                          - Ordinal
+                                          type: string
                                         timeoutSeconds:
                                           default: 0
                                           description: |-
@@ -3708,6 +4200,151 @@ spec:
                                               - Ordinal
                                               type: string
                                           type: object
+                                        grpc:
+                                          description: |-
+                                            Defines the gRPC call to issue.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              description: Name of the method to invoke
+                                                on the gRPC service.
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                                              type: string
+                                            request:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                Request payload for the gRPC method.
+
+
+                                                Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                                Templates are rendered with predefined action variables before the request is sent.
+                                              type: object
+                                            response:
+                                              description: Required response schema
+                                                for the gRPC method.
+                                              properties:
+                                                message:
+                                                  description: |-
+                                                    Name of the field in the response whose value should be output.
+                                                    Printed to stdout on success, or stderr on failure.
+                                                  type: string
+                                                status:
+                                                  description: |-
+                                                    Name of the string field in the response that carries status information.
+                                                    If non-empty, the action fails.
+                                                  type: string
+                                              type: object
+                                            service:
+                                              description: Fully-qualified name of
+                                                the gRPC service to call.
+                                              type: string
+                                          required:
+                                          - method
+                                          - port
+                                          - service
+                                          type: object
+                                        http:
+                                          description: |-
+                                            Defines the HTTP request to perform.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            body:
+                                              description: |-
+                                                Optional HTTP request body.
+
+
+                                                Supports Go text/template syntax; rendered with predefined variables before sending.
+                                              type: string
+                                            headers:
+                                              description: |-
+                                                Custom headers to set in the request.
+                                                Header values may use Go text/template syntax, rendered with predefined variables.
+                                              items:
+                                                description: HTTPHeader represents
+                                                  a single HTTP header key/value pair.
+                                                properties:
+                                                  name:
+                                                    description: Name of the header
+                                                      field.
+                                                    type: string
+                                                  value:
+                                                    description: Value of the header
+                                                      field.
+                                                    type: string
+                                                required:
+                                                - name
+                                                - value
+                                                type: object
+                                              type: array
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              default: GET
+                                              description: |-
+                                                The HTTP method to use.
+                                                Defaults to "GET".
+                                              enum:
+                                              - GET
+                                              - POST
+                                              - PUT
+                                              - DELETE
+                                              - HEAD
+                                              - PATCH
+                                              type: string
+                                            path:
+                                              default: /
+                                              description: |-
+                                                The path to request on the HTTP server.
+                                                Defaults to "/" if not specified.
+                                              pattern: ^/.*
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                                              type: string
+                                            scheme:
+                                              default: HTTP
+                                              description: |-
+                                                The scheme to use for connecting to the host.
+                                                Defaults to "HTTP".
+                                              enum:
+                                              - HTTP
+                                              - HTTPS
+                                              type: string
+                                          required:
+                                          - port
+                                          type: object
+                                        matchingKey:
+                                          description: |-
+                                            Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                                            The impact of this field depends on the `targetPodSelector` value:
+
+
+                                            - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                                            - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                                              will be selected for the Action.
+
+
+                                            This field cannot be updated.
+                                          type: string
                                         preCondition:
                                           description: |-
                                             Specifies the state that the cluster must reach before the Action is executed.
@@ -3754,6 +4391,25 @@ spec:
                                               format: int64
                                               type: integer
                                           type: object
+                                        targetPodSelector:
+                                          description: |-
+                                            Defines the criteria used to select the target Pod(s) for executing the Action.
+                                            This is useful when there is no default target replica identified.
+                                            It allows for precise control over which Pod(s) the Action should run in.
+
+
+                                            If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                                            to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                                            post-provision or pre-terminate of the component.
+
+
+                                            This field cannot be updated.
+                                          enum:
+                                          - Any
+                                          - All
+                                          - Role
+                                          - Ordinal
+                                          type: string
                                         timeoutSeconds:
                                           default: 0
                                           description: |-
diff --git a/config/crd/bases/apps.kubeblocks.io_shardingdefinitions.yaml b/config/crd/bases/apps.kubeblocks.io_shardingdefinitions.yaml
index 0fa5e0834..792f47b32 100644
--- a/config/crd/bases/apps.kubeblocks.io_shardingdefinitions.yaml
+++ b/config/crd/bases/apps.kubeblocks.io_shardingdefinitions.yaml
@@ -288,6 +288,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -334,6 +476,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -568,6 +729,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -614,6 +917,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -840,6 +1162,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -886,6 +1350,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -1112,6 +1595,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -1158,6 +1783,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
diff --git a/config/crd/bases/workloads.kubeblocks.io_instancesets.yaml b/config/crd/bases/workloads.kubeblocks.io_instancesets.yaml
index 6a8c4e513..38b90a184 100644
--- a/config/crd/bases/workloads.kubeblocks.io_instancesets.yaml
+++ b/config/crd/bases/workloads.kubeblocks.io_instancesets.yaml
@@ -292,6 +292,148 @@ spec:
                               - Ordinal
                               type: string
                           type: object
+                        grpc:
+                          description: |-
+                            Defines the gRPC call to issue.
+
+
+                            This field cannot be updated.
+                          properties:
+                            host:
+                              description: |-
+                                The target host to connect to.
+                                Defaults to "127.0.0.1" if not specified.
+                              type: string
+                            method:
+                              description: Name of the method to invoke on the gRPC
+                                service.
+                              type: string
+                            port:
+                              description: |-
+                                The port to access on the host.
+                                It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                              type: string
+                            request:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                Request payload for the gRPC method.
+
+
+                                Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                Templates are rendered with predefined action variables before the request is sent.
+                              type: object
+                            response:
+                              description: Required response schema for the gRPC method.
+                              properties:
+                                message:
+                                  description: |-
+                                    Name of the field in the response whose value should be output.
+                                    Printed to stdout on success, or stderr on failure.
+                                  type: string
+                                status:
+                                  description: |-
+                                    Name of the string field in the response that carries status information.
+                                    If non-empty, the action fails.
+                                  type: string
+                              type: object
+                            service:
+                              description: Fully-qualified name of the gRPC service
+                                to call.
+                              type: string
+                          required:
+                          - method
+                          - port
+                          - service
+                          type: object
+                        http:
+                          description: |-
+                            Defines the HTTP request to perform.
+
+
+                            This field cannot be updated.
+                          properties:
+                            body:
+                              description: |-
+                                Optional HTTP request body.
+
+
+                                Supports Go text/template syntax; rendered with predefined variables before sending.
+                              type: string
+                            headers:
+                              description: |-
+                                Custom headers to set in the request.
+                                Header values may use Go text/template syntax, rendered with predefined variables.
+                              items:
+                                description: HTTPHeader represents a single HTTP header
+                                  key/value pair.
+                                properties:
+                                  name:
+                                    description: Name of the header field.
+                                    type: string
+                                  value:
+                                    description: Value of the header field.
+                                    type: string
+                                required:
+                                - name
+                                - value
+                                type: object
+                              type: array
+                            host:
+                              description: |-
+                                The target host to connect to.
+                                Defaults to "127.0.0.1" if not specified.
+                              type: string
+                            method:
+                              default: GET
+                              description: |-
+                                The HTTP method to use.
+                                Defaults to "GET".
+                              enum:
+                              - GET
+                              - POST
+                              - PUT
+                              - DELETE
+                              - HEAD
+                              - PATCH
+                              type: string
+                            path:
+                              default: /
+                              description: |-
+                                The path to request on the HTTP server.
+                                Defaults to "/" if not specified.
+                              pattern: ^/.*
+                              type: string
+                            port:
+                              description: |-
+                                The port to access on the host.
+                                It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                              type: string
+                            scheme:
+                              default: HTTP
+                              description: |-
+                                The scheme to use for connecting to the host.
+                                Defaults to "HTTP".
+                              enum:
+                              - HTTP
+                              - HTTPS
+                              type: string
+                          required:
+                          - port
+                          type: object
+                        matchingKey:
+                          description: |-
+                            Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                            The impact of this field depends on the `targetPodSelector` value:
+
+
+                            - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                            - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                              will be selected for the Action.
+
+
+                            This field cannot be updated.
+                          type: string
                         preCondition:
                           description: |-
                             Specifies the state that the cluster must reach before the Action is executed.
@@ -338,6 +480,25 @@ spec:
                               format: int64
                               type: integer
                           type: object
+                        targetPodSelector:
+                          description: |-
+                            Defines the criteria used to select the target Pod(s) for executing the Action.
+                            This is useful when there is no default target replica identified.
+                            It allows for precise control over which Pod(s) the Action should run in.
+
+
+                            If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                            to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                            post-provision or pre-terminate of the component.
+
+
+                            This field cannot be updated.
+                          enum:
+                          - Any
+                          - All
+                          - Role
+                          - Ordinal
+                          type: string
                         timeoutSeconds:
                           default: 0
                           description: |-
@@ -2542,6 +2703,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -2588,6 +2891,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index af83f9701..aabaddad1 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -340,24 +340,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - configmap
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - configmap/finalizers
-  verbs:
-  - update
 - apiGroups:
   - ""
   resources:
diff --git a/controllers/apps/cluster/transformer_cluster_component_status.go b/controllers/apps/cluster/transformer_cluster_component_status.go
index e279548a0..f486edfba 100644
--- a/controllers/apps/cluster/transformer_cluster_component_status.go
+++ b/controllers/apps/cluster/transformer_cluster_component_status.go
@@ -21,6 +21,8 @@ package cluster
 
 import (
 	"fmt"
+	"math"
+	"strconv"
 
 	"golang.org/x/exp/maps"
 	corev1 "k8s.io/api/core/v1"
@@ -48,10 +50,6 @@ func (t *clusterComponentStatusTransformer) Transform(ctx graph.TransformContext
 	if transCtx.OrigCluster.IsDeleting() {
 		return nil
 	}
-
-	if !transCtx.OrigCluster.IsStatusUpdating() {
-		return nil
-	}
 	return t.transform(transCtx)
 }
 
@@ -144,6 +142,8 @@ func (t *clusterComponentStatusTransformer) transformCompStatus(transCtx *cluste
 			Message: map[string]string{
 				"reason": "the component to be created",
 			},
+			ObservedGeneration: cluster.Generation,
+			UpToDate:           false,
 		}
 	}
 	for name := range deleteSet {
@@ -152,6 +152,8 @@ func (t *clusterComponentStatusTransformer) transformCompStatus(transCtx *cluste
 			Message: map[string]string{
 				"reason": "the component is under deleting",
 			},
+			ObservedGeneration: cluster.Generation,
+			UpToDate:           false,
 		}
 	}
 	for name := range updateSet {
@@ -167,10 +169,7 @@ func (t *clusterComponentStatusTransformer) buildClusterCompStatus(transCtx *clu
 	)
 
 	phase := status.Phase
-	if string(status.Phase) != string(comp.Status.Phase) {
-		status.Phase = comp.Status.Phase
-		status.Message = comp.Status.Message
-	}
+	status = t.clusterCompStatus(cluster, comp)
 
 	if phase != status.Phase {
 		msg := clusterCompNShardingPhaseTransitionMsg("component", compName, status.Phase)
@@ -183,6 +182,22 @@ func (t *clusterComponentStatusTransformer) buildClusterCompStatus(transCtx *clu
 	return status
 }
 
+func (t *clusterComponentStatusTransformer) clusterCompStatus(cluster *appsv1.Cluster, comp *appsv1.Component) appsv1.ClusterComponentStatus {
+	status := appsv1.ClusterComponentStatus{
+		Phase:              comp.Status.Phase,
+		Message:            comp.Status.Message,
+		ObservedGeneration: 0,
+		UpToDate:           false,
+	}
+	generation, ok := comp.Annotations[constant.KubeBlocksGenerationKey]
+	if ok {
+		ig, _ := strconv.ParseInt(generation, 10, 64)
+		status.ObservedGeneration = ig
+		status.UpToDate = comp.Generation == comp.Status.ObservedGeneration && ig == cluster.Generation
+	}
+	return status
+}
+
 func (t *clusterComponentStatusTransformer) transformShardingStatus(transCtx *clusterTransformContext, shardingComps map[string][]*appsv1.Component) {
 	var (
 		cluster = transCtx.Cluster
@@ -211,6 +226,8 @@ func (t *clusterComponentStatusTransformer) transformShardingStatus(transCtx *cl
 			Message: map[string]string{
 				"reason": "the sharding to be created",
 			},
+			ObservedGeneration: cluster.Generation,
+			UpToDate:           false,
 		}
 	}
 	for name := range deleteSet {
@@ -219,6 +236,8 @@ func (t *clusterComponentStatusTransformer) transformShardingStatus(transCtx *cl
 			Message: map[string]string{
 				"reason": "the sharding is under deleting",
 			},
+			ObservedGeneration: cluster.Generation,
+			UpToDate:           false,
 		}
 	}
 	for name := range updateSet {
@@ -234,11 +253,7 @@ func (t *clusterComponentStatusTransformer) buildClusterShardingStatus(transCtx
 	)
 
 	phase := status.Phase
-	newPhase, newMessage := t.shardingPhaseNMessage(comps)
-	if status.Phase != newPhase {
-		status.Phase = newPhase
-		status.Message = newMessage
-	}
+	status = t.clusterShardingStatus(cluster, comps)
 
 	if phase != status.Phase {
 		msg := clusterCompNShardingPhaseTransitionMsg("sharding", shardingName, status.Phase)
@@ -251,20 +266,30 @@ func (t *clusterComponentStatusTransformer) buildClusterShardingStatus(transCtx
 	return status
 }
 
-func (t *clusterComponentStatusTransformer) shardingPhaseNMessage(comps []*appsv1.Component) (appsv1.ComponentPhase, map[string]string) {
-	statusList := make([]appsv1.ClusterComponentStatus, 0)
-	phasedMessage := map[appsv1.ComponentPhase]map[string]string{}
+func (t *clusterComponentStatusTransformer) clusterShardingStatus(cluster *appsv1.Cluster, comps []*appsv1.Component) appsv1.ClusterComponentStatus {
+	var (
+		statusList    = make([]appsv1.ClusterComponentStatus, 0)
+		phasedMessage = map[appsv1.ComponentPhase]map[string]string{}
+		generation    = int64(math.MaxInt64)
+		upToDate      = true
+	)
 	for _, comp := range comps {
-		phase := comp.Status.Phase
-		message := comp.Status.Message
-		if _, ok := phasedMessage[phase]; !ok {
-			phasedMessage[phase] = message
+		status := t.clusterCompStatus(cluster, comp)
+		statusList = append(statusList, status)
+		if _, ok := phasedMessage[status.Phase]; !ok {
+			phasedMessage[status.Phase] = status.Message
 		}
-		statusList = append(statusList, appsv1.ClusterComponentStatus{Phase: phase})
+		generation = min(status.ObservedGeneration, generation)
+		upToDate = upToDate && status.UpToDate
 	}
 	if len(phasedMessage) == 0 {
 		// ???
-		return "", map[string]string{"reason": "the component objects are not found"}
+		return appsv1.ClusterComponentStatus{
+			Phase:              "",
+			Message:            map[string]string{"reason": "the component objects are not found"},
+			ObservedGeneration: 0,
+			UpToDate:           false,
+		}
 	}
 
 	composedPhase := composeClusterPhase(statusList)
@@ -272,7 +297,12 @@ func (t *clusterComponentStatusTransformer) shardingPhaseNMessage(comps []*appsv
 		composedPhase = appsv1.FailedClusterPhase
 	}
 	phase := appsv1.ComponentPhase(composedPhase)
-	return phase, phasedMessage[phase]
+	return appsv1.ClusterComponentStatus{
+		Phase:              phase,
+		Message:            phasedMessage[phase],
+		ObservedGeneration: generation,
+		UpToDate:           upToDate,
+	}
 }
 
 func clusterCompNShardingPhaseTransitionMsg(kind, name string, phase appsv1.ComponentPhase) string {
diff --git a/controllers/apps/cluster/transformer_cluster_status.go b/controllers/apps/cluster/transformer_cluster_status.go
index a11d35daa..1124cb781 100644
--- a/controllers/apps/cluster/transformer_cluster_status.go
+++ b/controllers/apps/cluster/transformer_cluster_status.go
@@ -20,7 +20,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 package cluster
 
 import (
-	"fmt"
+	"slices"
 
 	"golang.org/x/exp/maps"
 	"k8s.io/apimachinery/pkg/api/meta"
@@ -40,23 +40,10 @@ func (t *clusterStatusTransformer) Transform(ctx graph.TransformContext, dag *gr
 	cluster := transCtx.Cluster
 	graphCli, _ := transCtx.Client.(model.GraphClient)
 
-	switch {
-	case origCluster.IsUpdating():
-		transCtx.Logger.Info(fmt.Sprintf("update cluster status after applying resources, generation: %d", cluster.Generation))
-		cluster.Status.ObservedGeneration = cluster.Generation
-		t.markClusterDagStatusAction(graphCli, dag, origCluster, cluster)
-	case origCluster.IsStatusUpdating():
-		defer func() { t.markClusterDagStatusAction(graphCli, dag, origCluster, cluster) }()
-		// reconcile the phase and conditions of the cluster.status
-		if err := t.reconcileClusterStatus(transCtx, cluster); err != nil {
-			return err
-		}
-	case origCluster.IsDeleting():
-		return fmt.Errorf("unexpected cluster status: %s", origCluster.Status.Phase)
-	default:
-		panic(fmt.Sprintf("runtime error - unknown cluster status: %+v", origCluster))
+	defer func() { t.markClusterDagStatusAction(graphCli, dag, origCluster, cluster) }()
+	if err := t.reconcileClusterStatus(cluster); err != nil {
+		return err
 	}
-
 	return nil
 }
 
@@ -66,17 +53,12 @@ func (t *clusterStatusTransformer) markClusterDagStatusAction(graphCli model.Gra
 	}
 }
 
-func (t *clusterStatusTransformer) reconcileClusterStatus(transCtx *clusterTransformContext, cluster *appsv1.Cluster) error {
+func (t *clusterStatusTransformer) reconcileClusterStatus(cluster *appsv1.Cluster) error {
 	if len(cluster.Status.Components) == 0 && len(cluster.Status.Shardings) == 0 {
 		return nil
 	}
-
-	// t.removeDeletedCompNSharding(transCtx, cluster)
-
 	oldPhase := t.reconcileClusterPhase(cluster)
-
 	t.syncClusterConditions(cluster, oldPhase)
-
 	return nil
 }
 
@@ -94,6 +76,16 @@ func (t *clusterStatusTransformer) reconcileClusterPhase(cluster *appsv1.Cluster
 	if newPhase != "" {
 		cluster.Status.Phase = newPhase
 	}
+	cluster.Status.ObservedGeneration = slices.MinFunc(statusList, func(a, b appsv1.ClusterComponentStatus) int {
+		diff := a.ObservedGeneration - b.ObservedGeneration
+		if diff == 0 {
+			return 0
+		}
+		if diff < 0 {
+			return -1
+		}
+		return 1
+	}).ObservedGeneration
 	return phase
 }
 
diff --git a/controllers/apps/component/transformer_component_workload.go b/controllers/apps/component/transformer_component_workload.go
index 54232a982..18495bc15 100644
--- a/controllers/apps/component/transformer_component_workload.go
+++ b/controllers/apps/component/transformer_component_workload.go
@@ -448,7 +448,7 @@ func hasMemberJoinNDataActionDefined(lifecycleActions *appsv1.ComponentLifecycle
 	}
 	hasActionDefined := func(actions []*appsv1.Action) bool {
 		for _, action := range actions {
-			if action == nil || action.Exec == nil {
+			if !action.Defined() {
 				return false
 			}
 		}
diff --git a/controllers/apps/component/transformer_component_workload_ops.go b/controllers/apps/component/transformer_component_workload_ops.go
index 547552a2a..708ae9929 100644
--- a/controllers/apps/component/transformer_component_workload_ops.go
+++ b/controllers/apps/component/transformer_component_workload_ops.go
@@ -264,6 +264,9 @@ func (r *componentWorkloadOps) buildDataReplicationTask() error {
 
 	// replicas to be created
 	newReplicas := r.desiredCompPodNameSet.Difference(r.runningItsPodNameSet).UnsortedList()
+	if len(newReplicas) == 0 {
+		return nil
+	}
 
 	// replicas in provisioning that the data has not been loaded
 	provisioningReplicas, err := component.GetReplicasStatusFunc(r.protoITS, func(s component.ReplicaStatus) bool {
@@ -273,17 +276,13 @@ func (r *componentWorkloadOps) buildDataReplicationTask() error {
 		return err
 	}
 
-	replicas := append(slices.Clone(newReplicas), provisioningReplicas...)
-	if len(replicas) == 0 {
-		return nil
-	}
-
 	// the source replica
-	source, err := r.sourceReplica(r.synthesizeComp.LifecycleActions.DataDump)
+	source, err := r.sourceReplica(r.synthesizeComp.LifecycleActions.DataDump, provisioningReplicas)
 	if err != nil {
 		return err
 	}
 
+	replicas := append(slices.Clone(newReplicas), provisioningReplicas...)
 	parameters, err := component.NewReplicaTask(r.synthesizeComp.FullCompName, r.synthesizeComp.Generation, source, replicas)
 	if err != nil {
 		return err
@@ -298,16 +297,23 @@ func (r *componentWorkloadOps) buildDataReplicationTask() error {
 	return createOrUpdateEnvConfigMap(transCtx, r.dag, parameters)
 }
 
-func (r *componentWorkloadOps) sourceReplica(dataDump *appsv1.Action) (*corev1.Pod, error) {
+func (r *componentWorkloadOps) sourceReplica(dataDump *appsv1.Action, provisioningReplicas []string) (*corev1.Pod, error) {
 	pods, err := component.ListOwnedPods(r.transCtx.Context, r.cli,
 		r.synthesizeComp.Namespace, r.synthesizeComp.ClusterName, r.synthesizeComp.Name)
 	if err != nil {
 		return nil, err
 	}
+	if len(provisioningReplicas) > 0 {
+		// exclude provisioning replicas
+		pods = slices.DeleteFunc(pods, func(pod *corev1.Pod) bool {
+			return slices.Contains(provisioningReplicas, pod.Name)
+		})
+	}
 	if len(pods) > 0 {
-		if len(dataDump.Exec.TargetPodSelector) == 0 {
-			dataDump.Exec.TargetPodSelector = appsv1.AnyReplica
+		if len(dataDump.TargetPodSelector) == 0 && (dataDump.Exec == nil || len(dataDump.Exec.TargetPodSelector) == 0) {
+			dataDump.TargetPodSelector = appsv1.AnyReplica
 		}
+		// TODO: idempotence for provisioning replicas
 		pods, err = lifecycle.SelectTargetPods(pods, nil, dataDump)
 		if err != nil {
 			return nil, err
diff --git a/controllers/parameters/reconfigure_controller.go b/controllers/parameters/reconfigure_controller.go
index 2220a4600..112ef2a01 100644
--- a/controllers/parameters/reconfigure_controller.go
+++ b/controllers/parameters/reconfigure_controller.go
@@ -74,8 +74,8 @@ var reconfigureRequiredLabels = []string{
 	constant.CMConfigurationSpecProviderLabelKey,
 }
 
-// +kubebuilder:rbac:groups=core,resources=configmap,verbs=get;list;watch;create;update;patch;delete
-// +kubebuilder:rbac:groups=core,resources=configmap/finalizers,verbs=update
+// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=core,resources=configmaps/finalizers,verbs=update
 
 // Reconcile is part of the main kubernetes reconciliation loop which aims to
 // move the current state of the cluster closer to the desired state.
diff --git a/deploy/helm/config/rbac/role.yaml b/deploy/helm/config/rbac/role.yaml
index af83f9701..aabaddad1 100644
--- a/deploy/helm/config/rbac/role.yaml
+++ b/deploy/helm/config/rbac/role.yaml
@@ -340,24 +340,6 @@ rules:
   - patch
   - update
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - configmap
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - configmap/finalizers
-  verbs:
-  - update
 - apiGroups:
   - ""
   resources:
diff --git a/deploy/helm/crds/apps.kubeblocks.io_clusters.yaml b/deploy/helm/crds/apps.kubeblocks.io_clusters.yaml
index 7a294fb09..c6f16659f 100644
--- a/deploy/helm/crds/apps.kubeblocks.io_clusters.yaml
+++ b/deploy/helm/crds/apps.kubeblocks.io_clusters.yaml
@@ -515,6 +515,149 @@ spec:
                                     - Ordinal
                                     type: string
                                 type: object
+                              grpc:
+                                description: |-
+                                  Defines the gRPC call to issue.
+
+
+                                  This field cannot be updated.
+                                properties:
+                                  host:
+                                    description: |-
+                                      The target host to connect to.
+                                      Defaults to "127.0.0.1" if not specified.
+                                    type: string
+                                  method:
+                                    description: Name of the method to invoke on the
+                                      gRPC service.
+                                    type: string
+                                  port:
+                                    description: |-
+                                      The port to access on the host.
+                                      It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                                    type: string
+                                  request:
+                                    additionalProperties:
+                                      type: string
+                                    description: |-
+                                      Request payload for the gRPC method.
+
+
+                                      Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                      Templates are rendered with predefined action variables before the request is sent.
+                                    type: object
+                                  response:
+                                    description: Required response schema for the
+                                      gRPC method.
+                                    properties:
+                                      message:
+                                        description: |-
+                                          Name of the field in the response whose value should be output.
+                                          Printed to stdout on success, or stderr on failure.
+                                        type: string
+                                      status:
+                                        description: |-
+                                          Name of the string field in the response that carries status information.
+                                          If non-empty, the action fails.
+                                        type: string
+                                    type: object
+                                  service:
+                                    description: Fully-qualified name of the gRPC
+                                      service to call.
+                                    type: string
+                                required:
+                                - method
+                                - port
+                                - service
+                                type: object
+                              http:
+                                description: |-
+                                  Defines the HTTP request to perform.
+
+
+                                  This field cannot be updated.
+                                properties:
+                                  body:
+                                    description: |-
+                                      Optional HTTP request body.
+
+
+                                      Supports Go text/template syntax; rendered with predefined variables before sending.
+                                    type: string
+                                  headers:
+                                    description: |-
+                                      Custom headers to set in the request.
+                                      Header values may use Go text/template syntax, rendered with predefined variables.
+                                    items:
+                                      description: HTTPHeader represents a single
+                                        HTTP header key/value pair.
+                                      properties:
+                                        name:
+                                          description: Name of the header field.
+                                          type: string
+                                        value:
+                                          description: Value of the header field.
+                                          type: string
+                                      required:
+                                      - name
+                                      - value
+                                      type: object
+                                    type: array
+                                  host:
+                                    description: |-
+                                      The target host to connect to.
+                                      Defaults to "127.0.0.1" if not specified.
+                                    type: string
+                                  method:
+                                    default: GET
+                                    description: |-
+                                      The HTTP method to use.
+                                      Defaults to "GET".
+                                    enum:
+                                    - GET
+                                    - POST
+                                    - PUT
+                                    - DELETE
+                                    - HEAD
+                                    - PATCH
+                                    type: string
+                                  path:
+                                    default: /
+                                    description: |-
+                                      The path to request on the HTTP server.
+                                      Defaults to "/" if not specified.
+                                    pattern: ^/.*
+                                    type: string
+                                  port:
+                                    description: |-
+                                      The port to access on the host.
+                                      It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                                    type: string
+                                  scheme:
+                                    default: HTTP
+                                    description: |-
+                                      The scheme to use for connecting to the host.
+                                      Defaults to "HTTP".
+                                    enum:
+                                    - HTTP
+                                    - HTTPS
+                                    type: string
+                                required:
+                                - port
+                                type: object
+                              matchingKey:
+                                description: |-
+                                  Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                                  The impact of this field depends on the `targetPodSelector` value:
+
+
+                                  - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                                  - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                                    will be selected for the Action.
+
+
+                                  This field cannot be updated.
+                                type: string
                               preCondition:
                                 description: |-
                                   Specifies the state that the cluster must reach before the Action is executed.
@@ -561,6 +704,25 @@ spec:
                                     format: int64
                                     type: integer
                                 type: object
+                              targetPodSelector:
+                                description: |-
+                                  Defines the criteria used to select the target Pod(s) for executing the Action.
+                                  This is useful when there is no default target replica identified.
+                                  It allows for precise control over which Pod(s) the Action should run in.
+
+
+                                  If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                                  to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                                  post-provision or pre-terminate of the component.
+
+
+                                  This field cannot be updated.
+                                enum:
+                                - Any
+                                - All
+                                - Role
+                                - Ordinal
+                                type: string
                               timeoutSeconds:
                                 default: 0
                                 description: |-
@@ -11565,6 +11727,149 @@ spec:
                                         - Ordinal
                                         type: string
                                     type: object
+                                  grpc:
+                                    description: |-
+                                      Defines the gRPC call to issue.
+
+
+                                      This field cannot be updated.
+                                    properties:
+                                      host:
+                                        description: |-
+                                          The target host to connect to.
+                                          Defaults to "127.0.0.1" if not specified.
+                                        type: string
+                                      method:
+                                        description: Name of the method to invoke
+                                          on the gRPC service.
+                                        type: string
+                                      port:
+                                        description: |-
+                                          The port to access on the host.
+                                          It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                                        type: string
+                                      request:
+                                        additionalProperties:
+                                          type: string
+                                        description: |-
+                                          Request payload for the gRPC method.
+
+
+                                          Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                          Templates are rendered with predefined action variables before the request is sent.
+                                        type: object
+                                      response:
+                                        description: Required response schema for
+                                          the gRPC method.
+                                        properties:
+                                          message:
+                                            description: |-
+                                              Name of the field in the response whose value should be output.
+                                              Printed to stdout on success, or stderr on failure.
+                                            type: string
+                                          status:
+                                            description: |-
+                                              Name of the string field in the response that carries status information.
+                                              If non-empty, the action fails.
+                                            type: string
+                                        type: object
+                                      service:
+                                        description: Fully-qualified name of the gRPC
+                                          service to call.
+                                        type: string
+                                    required:
+                                    - method
+                                    - port
+                                    - service
+                                    type: object
+                                  http:
+                                    description: |-
+                                      Defines the HTTP request to perform.
+
+
+                                      This field cannot be updated.
+                                    properties:
+                                      body:
+                                        description: |-
+                                          Optional HTTP request body.
+
+
+                                          Supports Go text/template syntax; rendered with predefined variables before sending.
+                                        type: string
+                                      headers:
+                                        description: |-
+                                          Custom headers to set in the request.
+                                          Header values may use Go text/template syntax, rendered with predefined variables.
+                                        items:
+                                          description: HTTPHeader represents a single
+                                            HTTP header key/value pair.
+                                          properties:
+                                            name:
+                                              description: Name of the header field.
+                                              type: string
+                                            value:
+                                              description: Value of the header field.
+                                              type: string
+                                          required:
+                                          - name
+                                          - value
+                                          type: object
+                                        type: array
+                                      host:
+                                        description: |-
+                                          The target host to connect to.
+                                          Defaults to "127.0.0.1" if not specified.
+                                        type: string
+                                      method:
+                                        default: GET
+                                        description: |-
+                                          The HTTP method to use.
+                                          Defaults to "GET".
+                                        enum:
+                                        - GET
+                                        - POST
+                                        - PUT
+                                        - DELETE
+                                        - HEAD
+                                        - PATCH
+                                        type: string
+                                      path:
+                                        default: /
+                                        description: |-
+                                          The path to request on the HTTP server.
+                                          Defaults to "/" if not specified.
+                                        pattern: ^/.*
+                                        type: string
+                                      port:
+                                        description: |-
+                                          The port to access on the host.
+                                          It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                                        type: string
+                                      scheme:
+                                        default: HTTP
+                                        description: |-
+                                          The scheme to use for connecting to the host.
+                                          Defaults to "HTTP".
+                                        enum:
+                                        - HTTP
+                                        - HTTPS
+                                        type: string
+                                    required:
+                                    - port
+                                    type: object
+                                  matchingKey:
+                                    description: |-
+                                      Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                                      The impact of this field depends on the `targetPodSelector` value:
+
+
+                                      - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                                      - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                                        will be selected for the Action.
+
+
+                                      This field cannot be updated.
+                                    type: string
                                   preCondition:
                                     description: |-
                                       Specifies the state that the cluster must reach before the Action is executed.
@@ -11611,6 +11916,25 @@ spec:
                                         format: int64
                                         type: integer
                                     type: object
+                                  targetPodSelector:
+                                    description: |-
+                                      Defines the criteria used to select the target Pod(s) for executing the Action.
+                                      This is useful when there is no default target replica identified.
+                                      It allows for precise control over which Pod(s) the Action should run in.
+
+
+                                      If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                                      to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                                      post-provision or pre-terminate of the component.
+
+
+                                      This field cannot be updated.
+                                    enum:
+                                    - Any
+                                    - All
+                                    - Role
+                                    - Ordinal
+                                    type: string
                                   timeoutSeconds:
                                     default: 0
                                     description: |-
@@ -17362,10 +17686,14 @@ spec:
                     message:
                       additionalProperties:
                         type: string
-                      description: |-
-                        Records detailed information about the Component in its current phase.
-                        The keys are either podName, deployName, or statefulSetName, formatted as 'ObjectKind/Name'.
+                      description: Records detailed information about the Component
+                        in its current phase.
                       type: object
+                    observedGeneration:
+                      description: Indicates the most recent generation of the component
+                        state observed.
+                      format: int64
+                      type: integer
                     phase:
                       description: Specifies the current state of the Component.
                       enum:
@@ -17378,6 +17706,10 @@ spec:
                       - Stopped
                       - Failed
                       type: string
+                    upToDate:
+                      description: Indicates whether the component state observed
+                        is up-to-date with the desired state.
+                      type: boolean
                   type: object
                 description: Records the current status information of all Components
                   within the Cluster.
@@ -17488,10 +17820,14 @@ spec:
                     message:
                       additionalProperties:
                         type: string
-                      description: |-
-                        Records detailed information about the Component in its current phase.
-                        The keys are either podName, deployName, or statefulSetName, formatted as 'ObjectKind/Name'.
+                      description: Records detailed information about the Component
+                        in its current phase.
                       type: object
+                    observedGeneration:
+                      description: Indicates the most recent generation of the component
+                        state observed.
+                      format: int64
+                      type: integer
                     phase:
                       description: Specifies the current state of the Component.
                       enum:
@@ -17504,6 +17840,10 @@ spec:
                       - Stopped
                       - Failed
                       type: string
+                    upToDate:
+                      description: Indicates whether the component state observed
+                        is up-to-date with the desired state.
+                      type: boolean
                   type: object
                 description: Records the current status information of all shardings
                   within the Cluster.
diff --git a/deploy/helm/crds/apps.kubeblocks.io_componentdefinitions.yaml b/deploy/helm/crds/apps.kubeblocks.io_componentdefinitions.yaml
index 516819ec9..743527b79 100644
--- a/deploy/helm/crds/apps.kubeblocks.io_componentdefinitions.yaml
+++ b/deploy/helm/crds/apps.kubeblocks.io_componentdefinitions.yaml
@@ -4399,6 +4399,7 @@ spec:
                       `Immediately`, `RuntimeReady`, `ComponentReady`, and `ClusterReady`.
                     - `preTerminate`: Defines the hook to be executed before terminating a Component.
                     - `roleProbe`: Defines the procedure which is invoked regularly to assess the role of replicas.
+                    - `availableProbe`: Defines the procedure which is invoked regularly to assess the availability of the component.
                     - `switchover`: Defines the procedure for a controlled transition of a role to a new replica.
                       This approach aims to minimize downtime and maintain availability in systems with a leader-follower topology,
                       such as before planned maintenance or upgrades on the current leader node.
@@ -4640,6 +4641,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -4686,6 +4829,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -4918,12 +5080,154 @@ spec:
                           Defaults to 3. Minimum value is 1.
                         format: int32
                         type: integer
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
                       initialDelaySeconds:
                         description: |-
                           Specifies the number of seconds to wait after the container has started before the RoleProbe
                           begins to detect the container's role.
                         format: int32
                         type: integer
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       periodSeconds:
                         description: |-
                           Specifies the frequency at which the probe is conducted. This value is expressed in seconds.
@@ -4982,6 +5286,25 @@ spec:
                           Defaults to 1. Minimum value is 1.
                         format: int32
                         type: integer
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -5229,6 +5552,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -5275,6 +5740,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -5515,30 +5999,172 @@ spec:
                             - Ordinal
                             type: string
                         type: object
-                      preCondition:
+                      grpc:
                         description: |-
-                          Specifies the state that the cluster must reach before the Action is executed.
-                          Currently, this is only applicable to the `postProvision` action.
-
-
-                          The conditions are as follows:
+                          Defines the gRPC call to issue.
 
 
-                          - `Immediately`: Executed right after the Component object is created.
-                            The readiness of the Component and its resources is not guaranteed at this stage.
-                          - `RuntimeReady`: The Action is triggered after the Component object has been created and all associated
-                            runtime resources (e.g. Pods) are in a ready state.
-                          - `ComponentReady`: The Action is triggered after the Component itself is in a ready state.
-                            This process does not affect the readiness state of the Component or the Cluster.
-                          - `ClusterReady`: The Action is executed after the Cluster is in a ready state.
-                            This execution does not alter the Component or the Cluster's state of readiness.
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
 
 
-                          This field cannot be updated.
-                        type: string
-                      retryPolicy:
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
                         description: |-
-                          Defines the strategy to be taken when retrying the Action after a failure.
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
+                      preCondition:
+                        description: |-
+                          Specifies the state that the cluster must reach before the Action is executed.
+                          Currently, this is only applicable to the `postProvision` action.
+
+
+                          The conditions are as follows:
+
+
+                          - `Immediately`: Executed right after the Component object is created.
+                            The readiness of the Component and its resources is not guaranteed at this stage.
+                          - `RuntimeReady`: The Action is triggered after the Component object has been created and all associated
+                            runtime resources (e.g. Pods) are in a ready state.
+                          - `ComponentReady`: The Action is triggered after the Component itself is in a ready state.
+                            This process does not affect the readiness state of the Component or the Cluster.
+                          - `ClusterReady`: The Action is executed after the Cluster is in a ready state.
+                            This execution does not alter the Component or the Cluster's state of readiness.
+
+
+                          This field cannot be updated.
+                        type: string
+                      retryPolicy:
+                        description: |-
+                          Defines the strategy to be taken when retrying the Action after a failure.
 
 
                           It specifies the conditions under which the Action should be retried and the limits to apply,
@@ -5561,6 +6187,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -5800,6 +6445,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -5846,6 +6633,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -6087,6 +6893,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -6133,6 +7081,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -6367,6 +7334,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -6413,6 +7522,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -6647,6 +7775,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -6693,6 +7963,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -6927,6 +8216,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -6973,6 +8404,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -7189,26 +8639,168 @@ spec:
 
                               This field cannot be updated.
                             type: string
-                          targetPodSelector:
+                          targetPodSelector:
+                            description: |-
+                              Defines the criteria used to select the target Pod(s) for executing the Action.
+                              This is useful when there is no default target replica identified.
+                              It allows for precise control over which Pod(s) the Action should run in.
+
+
+                              If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                              to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                              post-provision or pre-terminate of the component.
+
+
+                              This field cannot be updated.
+                            enum:
+                            - Any
+                            - All
+                            - Role
+                            - Ordinal
+                            type: string
+                        type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
                             description: |-
-                              Defines the criteria used to select the target Pod(s) for executing the Action.
-                              This is useful when there is no default target replica identified.
-                              It allows for precise control over which Pod(s) the Action should run in.
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
 
 
-                              If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
-                              to be removed or added; or a random pod if the Action is triggered at the component level, such as
-                              post-provision or pre-terminate of the component.
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
 
 
-                              This field cannot be updated.
-                            enum:
-                            - Any
-                            - All
-                            - Role
-                            - Ordinal
-                            type: string
-                        type: object
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -7255,6 +8847,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -7484,6 +9095,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -7530,6 +9283,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -7781,12 +9553,154 @@ spec:
                           Defaults to 3. Minimum value is 1.
                         format: int32
                         type: integer
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
                       initialDelaySeconds:
                         description: |-
                           Specifies the number of seconds to wait after the container has started before the RoleProbe
                           begins to detect the container's role.
                         format: int32
                         type: integer
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       periodSeconds:
                         description: |-
                           Specifies the frequency at which the probe is conducted. This value is expressed in seconds.
@@ -7845,6 +9759,25 @@ spec:
                           Defaults to 1. Minimum value is 1.
                         format: int32
                         type: integer
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -8086,6 +10019,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -8132,6 +10207,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
diff --git a/deploy/helm/crds/apps.kubeblocks.io_components.yaml b/deploy/helm/crds/apps.kubeblocks.io_components.yaml
index 8a8e4de4a..65297f42f 100644
--- a/deploy/helm/crds/apps.kubeblocks.io_components.yaml
+++ b/deploy/helm/crds/apps.kubeblocks.io_components.yaml
@@ -387,6 +387,148 @@ spec:
                               - Ordinal
                               type: string
                           type: object
+                        grpc:
+                          description: |-
+                            Defines the gRPC call to issue.
+
+
+                            This field cannot be updated.
+                          properties:
+                            host:
+                              description: |-
+                                The target host to connect to.
+                                Defaults to "127.0.0.1" if not specified.
+                              type: string
+                            method:
+                              description: Name of the method to invoke on the gRPC
+                                service.
+                              type: string
+                            port:
+                              description: |-
+                                The port to access on the host.
+                                It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                              type: string
+                            request:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                Request payload for the gRPC method.
+
+
+                                Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                Templates are rendered with predefined action variables before the request is sent.
+                              type: object
+                            response:
+                              description: Required response schema for the gRPC method.
+                              properties:
+                                message:
+                                  description: |-
+                                    Name of the field in the response whose value should be output.
+                                    Printed to stdout on success, or stderr on failure.
+                                  type: string
+                                status:
+                                  description: |-
+                                    Name of the string field in the response that carries status information.
+                                    If non-empty, the action fails.
+                                  type: string
+                              type: object
+                            service:
+                              description: Fully-qualified name of the gRPC service
+                                to call.
+                              type: string
+                          required:
+                          - method
+                          - port
+                          - service
+                          type: object
+                        http:
+                          description: |-
+                            Defines the HTTP request to perform.
+
+
+                            This field cannot be updated.
+                          properties:
+                            body:
+                              description: |-
+                                Optional HTTP request body.
+
+
+                                Supports Go text/template syntax; rendered with predefined variables before sending.
+                              type: string
+                            headers:
+                              description: |-
+                                Custom headers to set in the request.
+                                Header values may use Go text/template syntax, rendered with predefined variables.
+                              items:
+                                description: HTTPHeader represents a single HTTP header
+                                  key/value pair.
+                                properties:
+                                  name:
+                                    description: Name of the header field.
+                                    type: string
+                                  value:
+                                    description: Value of the header field.
+                                    type: string
+                                required:
+                                - name
+                                - value
+                                type: object
+                              type: array
+                            host:
+                              description: |-
+                                The target host to connect to.
+                                Defaults to "127.0.0.1" if not specified.
+                              type: string
+                            method:
+                              default: GET
+                              description: |-
+                                The HTTP method to use.
+                                Defaults to "GET".
+                              enum:
+                              - GET
+                              - POST
+                              - PUT
+                              - DELETE
+                              - HEAD
+                              - PATCH
+                              type: string
+                            path:
+                              default: /
+                              description: |-
+                                The path to request on the HTTP server.
+                                Defaults to "/" if not specified.
+                              pattern: ^/.*
+                              type: string
+                            port:
+                              description: |-
+                                The port to access on the host.
+                                It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                              type: string
+                            scheme:
+                              default: HTTP
+                              description: |-
+                                The scheme to use for connecting to the host.
+                                Defaults to "HTTP".
+                              enum:
+                              - HTTP
+                              - HTTPS
+                              type: string
+                          required:
+                          - port
+                          type: object
+                        matchingKey:
+                          description: |-
+                            Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                            The impact of this field depends on the `targetPodSelector` value:
+
+
+                            - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                            - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                              will be selected for the Action.
+
+
+                            This field cannot be updated.
+                          type: string
                         preCondition:
                           description: |-
                             Specifies the state that the cluster must reach before the Action is executed.
@@ -433,6 +575,25 @@ spec:
                               format: int64
                               type: integer
                           type: object
+                        targetPodSelector:
+                          description: |-
+                            Defines the criteria used to select the target Pod(s) for executing the Action.
+                            This is useful when there is no default target replica identified.
+                            It allows for precise control over which Pod(s) the Action should run in.
+
+
+                            If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                            to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                            post-provision or pre-terminate of the component.
+
+
+                            This field cannot be updated.
+                          enum:
+                          - Any
+                          - All
+                          - Role
+                          - Ordinal
+                          type: string
                         timeoutSeconds:
                           default: 0
                           description: |-
diff --git a/deploy/helm/crds/apps.kubeblocks.io_rollouts.yaml b/deploy/helm/crds/apps.kubeblocks.io_rollouts.yaml
index dd923a11e..94756f8b5 100644
--- a/deploy/helm/crds/apps.kubeblocks.io_rollouts.yaml
+++ b/deploy/helm/crds/apps.kubeblocks.io_rollouts.yaml
@@ -363,6 +363,151 @@ spec:
                                               - Ordinal
                                               type: string
                                           type: object
+                                        grpc:
+                                          description: |-
+                                            Defines the gRPC call to issue.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              description: Name of the method to invoke
+                                                on the gRPC service.
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                                              type: string
+                                            request:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                Request payload for the gRPC method.
+
+
+                                                Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                                Templates are rendered with predefined action variables before the request is sent.
+                                              type: object
+                                            response:
+                                              description: Required response schema
+                                                for the gRPC method.
+                                              properties:
+                                                message:
+                                                  description: |-
+                                                    Name of the field in the response whose value should be output.
+                                                    Printed to stdout on success, or stderr on failure.
+                                                  type: string
+                                                status:
+                                                  description: |-
+                                                    Name of the string field in the response that carries status information.
+                                                    If non-empty, the action fails.
+                                                  type: string
+                                              type: object
+                                            service:
+                                              description: Fully-qualified name of
+                                                the gRPC service to call.
+                                              type: string
+                                          required:
+                                          - method
+                                          - port
+                                          - service
+                                          type: object
+                                        http:
+                                          description: |-
+                                            Defines the HTTP request to perform.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            body:
+                                              description: |-
+                                                Optional HTTP request body.
+
+
+                                                Supports Go text/template syntax; rendered with predefined variables before sending.
+                                              type: string
+                                            headers:
+                                              description: |-
+                                                Custom headers to set in the request.
+                                                Header values may use Go text/template syntax, rendered with predefined variables.
+                                              items:
+                                                description: HTTPHeader represents
+                                                  a single HTTP header key/value pair.
+                                                properties:
+                                                  name:
+                                                    description: Name of the header
+                                                      field.
+                                                    type: string
+                                                  value:
+                                                    description: Value of the header
+                                                      field.
+                                                    type: string
+                                                required:
+                                                - name
+                                                - value
+                                                type: object
+                                              type: array
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              default: GET
+                                              description: |-
+                                                The HTTP method to use.
+                                                Defaults to "GET".
+                                              enum:
+                                              - GET
+                                              - POST
+                                              - PUT
+                                              - DELETE
+                                              - HEAD
+                                              - PATCH
+                                              type: string
+                                            path:
+                                              default: /
+                                              description: |-
+                                                The path to request on the HTTP server.
+                                                Defaults to "/" if not specified.
+                                              pattern: ^/.*
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                                              type: string
+                                            scheme:
+                                              default: HTTP
+                                              description: |-
+                                                The scheme to use for connecting to the host.
+                                                Defaults to "HTTP".
+                                              enum:
+                                              - HTTP
+                                              - HTTPS
+                                              type: string
+                                          required:
+                                          - port
+                                          type: object
+                                        matchingKey:
+                                          description: |-
+                                            Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                                            The impact of this field depends on the `targetPodSelector` value:
+
+
+                                            - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                                            - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                                              will be selected for the Action.
+
+
+                                            This field cannot be updated.
+                                          type: string
                                         preCondition:
                                           description: |-
                                             Specifies the state that the cluster must reach before the Action is executed.
@@ -409,6 +554,25 @@ spec:
                                               format: int64
                                               type: integer
                                           type: object
+                                        targetPodSelector:
+                                          description: |-
+                                            Defines the criteria used to select the target Pod(s) for executing the Action.
+                                            This is useful when there is no default target replica identified.
+                                            It allows for precise control over which Pod(s) the Action should run in.
+
+
+                                            If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                                            to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                                            post-provision or pre-terminate of the component.
+
+
+                                            This field cannot be updated.
+                                          enum:
+                                          - Any
+                                          - All
+                                          - Role
+                                          - Ordinal
+                                          type: string
                                         timeoutSeconds:
                                           default: 0
                                           description: |-
@@ -651,6 +815,151 @@ spec:
                                               - Ordinal
                                               type: string
                                           type: object
+                                        grpc:
+                                          description: |-
+                                            Defines the gRPC call to issue.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              description: Name of the method to invoke
+                                                on the gRPC service.
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                                              type: string
+                                            request:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                Request payload for the gRPC method.
+
+
+                                                Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                                Templates are rendered with predefined action variables before the request is sent.
+                                              type: object
+                                            response:
+                                              description: Required response schema
+                                                for the gRPC method.
+                                              properties:
+                                                message:
+                                                  description: |-
+                                                    Name of the field in the response whose value should be output.
+                                                    Printed to stdout on success, or stderr on failure.
+                                                  type: string
+                                                status:
+                                                  description: |-
+                                                    Name of the string field in the response that carries status information.
+                                                    If non-empty, the action fails.
+                                                  type: string
+                                              type: object
+                                            service:
+                                              description: Fully-qualified name of
+                                                the gRPC service to call.
+                                              type: string
+                                          required:
+                                          - method
+                                          - port
+                                          - service
+                                          type: object
+                                        http:
+                                          description: |-
+                                            Defines the HTTP request to perform.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            body:
+                                              description: |-
+                                                Optional HTTP request body.
+
+
+                                                Supports Go text/template syntax; rendered with predefined variables before sending.
+                                              type: string
+                                            headers:
+                                              description: |-
+                                                Custom headers to set in the request.
+                                                Header values may use Go text/template syntax, rendered with predefined variables.
+                                              items:
+                                                description: HTTPHeader represents
+                                                  a single HTTP header key/value pair.
+                                                properties:
+                                                  name:
+                                                    description: Name of the header
+                                                      field.
+                                                    type: string
+                                                  value:
+                                                    description: Value of the header
+                                                      field.
+                                                    type: string
+                                                required:
+                                                - name
+                                                - value
+                                                type: object
+                                              type: array
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              default: GET
+                                              description: |-
+                                                The HTTP method to use.
+                                                Defaults to "GET".
+                                              enum:
+                                              - GET
+                                              - POST
+                                              - PUT
+                                              - DELETE
+                                              - HEAD
+                                              - PATCH
+                                              type: string
+                                            path:
+                                              default: /
+                                              description: |-
+                                                The path to request on the HTTP server.
+                                                Defaults to "/" if not specified.
+                                              pattern: ^/.*
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                                              type: string
+                                            scheme:
+                                              default: HTTP
+                                              description: |-
+                                                The scheme to use for connecting to the host.
+                                                Defaults to "HTTP".
+                                              enum:
+                                              - HTTP
+                                              - HTTPS
+                                              type: string
+                                          required:
+                                          - port
+                                          type: object
+                                        matchingKey:
+                                          description: |-
+                                            Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                                            The impact of this field depends on the `targetPodSelector` value:
+
+
+                                            - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                                            - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                                              will be selected for the Action.
+
+
+                                            This field cannot be updated.
+                                          type: string
                                         preCondition:
                                           description: |-
                                             Specifies the state that the cluster must reach before the Action is executed.
@@ -697,6 +1006,25 @@ spec:
                                               format: int64
                                               type: integer
                                           type: object
+                                        targetPodSelector:
+                                          description: |-
+                                            Defines the criteria used to select the target Pod(s) for executing the Action.
+                                            This is useful when there is no default target replica identified.
+                                            It allows for precise control over which Pod(s) the Action should run in.
+
+
+                                            If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                                            to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                                            post-provision or pre-terminate of the component.
+
+
+                                            This field cannot be updated.
+                                          enum:
+                                          - Any
+                                          - All
+                                          - Role
+                                          - Ordinal
+                                          type: string
                                         timeoutSeconds:
                                           default: 0
                                           description: |-
@@ -3420,6 +3748,151 @@ spec:
                                               - Ordinal
                                               type: string
                                           type: object
+                                        grpc:
+                                          description: |-
+                                            Defines the gRPC call to issue.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              description: Name of the method to invoke
+                                                on the gRPC service.
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                                              type: string
+                                            request:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                Request payload for the gRPC method.
+
+
+                                                Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                                Templates are rendered with predefined action variables before the request is sent.
+                                              type: object
+                                            response:
+                                              description: Required response schema
+                                                for the gRPC method.
+                                              properties:
+                                                message:
+                                                  description: |-
+                                                    Name of the field in the response whose value should be output.
+                                                    Printed to stdout on success, or stderr on failure.
+                                                  type: string
+                                                status:
+                                                  description: |-
+                                                    Name of the string field in the response that carries status information.
+                                                    If non-empty, the action fails.
+                                                  type: string
+                                              type: object
+                                            service:
+                                              description: Fully-qualified name of
+                                                the gRPC service to call.
+                                              type: string
+                                          required:
+                                          - method
+                                          - port
+                                          - service
+                                          type: object
+                                        http:
+                                          description: |-
+                                            Defines the HTTP request to perform.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            body:
+                                              description: |-
+                                                Optional HTTP request body.
+
+
+                                                Supports Go text/template syntax; rendered with predefined variables before sending.
+                                              type: string
+                                            headers:
+                                              description: |-
+                                                Custom headers to set in the request.
+                                                Header values may use Go text/template syntax, rendered with predefined variables.
+                                              items:
+                                                description: HTTPHeader represents
+                                                  a single HTTP header key/value pair.
+                                                properties:
+                                                  name:
+                                                    description: Name of the header
+                                                      field.
+                                                    type: string
+                                                  value:
+                                                    description: Value of the header
+                                                      field.
+                                                    type: string
+                                                required:
+                                                - name
+                                                - value
+                                                type: object
+                                              type: array
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              default: GET
+                                              description: |-
+                                                The HTTP method to use.
+                                                Defaults to "GET".
+                                              enum:
+                                              - GET
+                                              - POST
+                                              - PUT
+                                              - DELETE
+                                              - HEAD
+                                              - PATCH
+                                              type: string
+                                            path:
+                                              default: /
+                                              description: |-
+                                                The path to request on the HTTP server.
+                                                Defaults to "/" if not specified.
+                                              pattern: ^/.*
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                                              type: string
+                                            scheme:
+                                              default: HTTP
+                                              description: |-
+                                                The scheme to use for connecting to the host.
+                                                Defaults to "HTTP".
+                                              enum:
+                                              - HTTP
+                                              - HTTPS
+                                              type: string
+                                          required:
+                                          - port
+                                          type: object
+                                        matchingKey:
+                                          description: |-
+                                            Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                                            The impact of this field depends on the `targetPodSelector` value:
+
+
+                                            - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                                            - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                                              will be selected for the Action.
+
+
+                                            This field cannot be updated.
+                                          type: string
                                         preCondition:
                                           description: |-
                                             Specifies the state that the cluster must reach before the Action is executed.
@@ -3466,6 +3939,25 @@ spec:
                                               format: int64
                                               type: integer
                                           type: object
+                                        targetPodSelector:
+                                          description: |-
+                                            Defines the criteria used to select the target Pod(s) for executing the Action.
+                                            This is useful when there is no default target replica identified.
+                                            It allows for precise control over which Pod(s) the Action should run in.
+
+
+                                            If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                                            to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                                            post-provision or pre-terminate of the component.
+
+
+                                            This field cannot be updated.
+                                          enum:
+                                          - Any
+                                          - All
+                                          - Role
+                                          - Ordinal
+                                          type: string
                                         timeoutSeconds:
                                           default: 0
                                           description: |-
@@ -3708,6 +4200,151 @@ spec:
                                               - Ordinal
                                               type: string
                                           type: object
+                                        grpc:
+                                          description: |-
+                                            Defines the gRPC call to issue.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              description: Name of the method to invoke
+                                                on the gRPC service.
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                                              type: string
+                                            request:
+                                              additionalProperties:
+                                                type: string
+                                              description: |-
+                                                Request payload for the gRPC method.
+
+
+                                                Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                                Templates are rendered with predefined action variables before the request is sent.
+                                              type: object
+                                            response:
+                                              description: Required response schema
+                                                for the gRPC method.
+                                              properties:
+                                                message:
+                                                  description: |-
+                                                    Name of the field in the response whose value should be output.
+                                                    Printed to stdout on success, or stderr on failure.
+                                                  type: string
+                                                status:
+                                                  description: |-
+                                                    Name of the string field in the response that carries status information.
+                                                    If non-empty, the action fails.
+                                                  type: string
+                                              type: object
+                                            service:
+                                              description: Fully-qualified name of
+                                                the gRPC service to call.
+                                              type: string
+                                          required:
+                                          - method
+                                          - port
+                                          - service
+                                          type: object
+                                        http:
+                                          description: |-
+                                            Defines the HTTP request to perform.
+
+
+                                            This field cannot be updated.
+                                          properties:
+                                            body:
+                                              description: |-
+                                                Optional HTTP request body.
+
+
+                                                Supports Go text/template syntax; rendered with predefined variables before sending.
+                                              type: string
+                                            headers:
+                                              description: |-
+                                                Custom headers to set in the request.
+                                                Header values may use Go text/template syntax, rendered with predefined variables.
+                                              items:
+                                                description: HTTPHeader represents
+                                                  a single HTTP header key/value pair.
+                                                properties:
+                                                  name:
+                                                    description: Name of the header
+                                                      field.
+                                                    type: string
+                                                  value:
+                                                    description: Value of the header
+                                                      field.
+                                                    type: string
+                                                required:
+                                                - name
+                                                - value
+                                                type: object
+                                              type: array
+                                            host:
+                                              description: |-
+                                                The target host to connect to.
+                                                Defaults to "127.0.0.1" if not specified.
+                                              type: string
+                                            method:
+                                              default: GET
+                                              description: |-
+                                                The HTTP method to use.
+                                                Defaults to "GET".
+                                              enum:
+                                              - GET
+                                              - POST
+                                              - PUT
+                                              - DELETE
+                                              - HEAD
+                                              - PATCH
+                                              type: string
+                                            path:
+                                              default: /
+                                              description: |-
+                                                The path to request on the HTTP server.
+                                                Defaults to "/" if not specified.
+                                              pattern: ^/.*
+                                              type: string
+                                            port:
+                                              description: |-
+                                                The port to access on the host.
+                                                It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                                              type: string
+                                            scheme:
+                                              default: HTTP
+                                              description: |-
+                                                The scheme to use for connecting to the host.
+                                                Defaults to "HTTP".
+                                              enum:
+                                              - HTTP
+                                              - HTTPS
+                                              type: string
+                                          required:
+                                          - port
+                                          type: object
+                                        matchingKey:
+                                          description: |-
+                                            Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                                            The impact of this field depends on the `targetPodSelector` value:
+
+
+                                            - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                                            - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                                              will be selected for the Action.
+
+
+                                            This field cannot be updated.
+                                          type: string
                                         preCondition:
                                           description: |-
                                             Specifies the state that the cluster must reach before the Action is executed.
@@ -3754,6 +4391,25 @@ spec:
                                               format: int64
                                               type: integer
                                           type: object
+                                        targetPodSelector:
+                                          description: |-
+                                            Defines the criteria used to select the target Pod(s) for executing the Action.
+                                            This is useful when there is no default target replica identified.
+                                            It allows for precise control over which Pod(s) the Action should run in.
+
+
+                                            If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                                            to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                                            post-provision or pre-terminate of the component.
+
+
+                                            This field cannot be updated.
+                                          enum:
+                                          - Any
+                                          - All
+                                          - Role
+                                          - Ordinal
+                                          type: string
                                         timeoutSeconds:
                                           default: 0
                                           description: |-
diff --git a/deploy/helm/crds/apps.kubeblocks.io_shardingdefinitions.yaml b/deploy/helm/crds/apps.kubeblocks.io_shardingdefinitions.yaml
index 0fa5e0834..792f47b32 100644
--- a/deploy/helm/crds/apps.kubeblocks.io_shardingdefinitions.yaml
+++ b/deploy/helm/crds/apps.kubeblocks.io_shardingdefinitions.yaml
@@ -288,6 +288,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -334,6 +476,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -568,6 +729,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -614,6 +917,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -840,6 +1162,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -886,6 +1350,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
@@ -1112,6 +1595,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -1158,6 +1783,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
diff --git a/deploy/helm/crds/workloads.kubeblocks.io_instancesets.yaml b/deploy/helm/crds/workloads.kubeblocks.io_instancesets.yaml
index 6a8c4e513..38b90a184 100644
--- a/deploy/helm/crds/workloads.kubeblocks.io_instancesets.yaml
+++ b/deploy/helm/crds/workloads.kubeblocks.io_instancesets.yaml
@@ -292,6 +292,148 @@ spec:
                               - Ordinal
                               type: string
                           type: object
+                        grpc:
+                          description: |-
+                            Defines the gRPC call to issue.
+
+
+                            This field cannot be updated.
+                          properties:
+                            host:
+                              description: |-
+                                The target host to connect to.
+                                Defaults to "127.0.0.1" if not specified.
+                              type: string
+                            method:
+                              description: Name of the method to invoke on the gRPC
+                                service.
+                              type: string
+                            port:
+                              description: |-
+                                The port to access on the host.
+                                It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                              type: string
+                            request:
+                              additionalProperties:
+                                type: string
+                              description: |-
+                                Request payload for the gRPC method.
+
+
+                                Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                                Templates are rendered with predefined action variables before the request is sent.
+                              type: object
+                            response:
+                              description: Required response schema for the gRPC method.
+                              properties:
+                                message:
+                                  description: |-
+                                    Name of the field in the response whose value should be output.
+                                    Printed to stdout on success, or stderr on failure.
+                                  type: string
+                                status:
+                                  description: |-
+                                    Name of the string field in the response that carries status information.
+                                    If non-empty, the action fails.
+                                  type: string
+                              type: object
+                            service:
+                              description: Fully-qualified name of the gRPC service
+                                to call.
+                              type: string
+                          required:
+                          - method
+                          - port
+                          - service
+                          type: object
+                        http:
+                          description: |-
+                            Defines the HTTP request to perform.
+
+
+                            This field cannot be updated.
+                          properties:
+                            body:
+                              description: |-
+                                Optional HTTP request body.
+
+
+                                Supports Go text/template syntax; rendered with predefined variables before sending.
+                              type: string
+                            headers:
+                              description: |-
+                                Custom headers to set in the request.
+                                Header values may use Go text/template syntax, rendered with predefined variables.
+                              items:
+                                description: HTTPHeader represents a single HTTP header
+                                  key/value pair.
+                                properties:
+                                  name:
+                                    description: Name of the header field.
+                                    type: string
+                                  value:
+                                    description: Value of the header field.
+                                    type: string
+                                required:
+                                - name
+                                - value
+                                type: object
+                              type: array
+                            host:
+                              description: |-
+                                The target host to connect to.
+                                Defaults to "127.0.0.1" if not specified.
+                              type: string
+                            method:
+                              default: GET
+                              description: |-
+                                The HTTP method to use.
+                                Defaults to "GET".
+                              enum:
+                              - GET
+                              - POST
+                              - PUT
+                              - DELETE
+                              - HEAD
+                              - PATCH
+                              type: string
+                            path:
+                              default: /
+                              description: |-
+                                The path to request on the HTTP server.
+                                Defaults to "/" if not specified.
+                              pattern: ^/.*
+                              type: string
+                            port:
+                              description: |-
+                                The port to access on the host.
+                                It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                              type: string
+                            scheme:
+                              default: HTTP
+                              description: |-
+                                The scheme to use for connecting to the host.
+                                Defaults to "HTTP".
+                              enum:
+                              - HTTP
+                              - HTTPS
+                              type: string
+                          required:
+                          - port
+                          type: object
+                        matchingKey:
+                          description: |-
+                            Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                            The impact of this field depends on the `targetPodSelector` value:
+
+
+                            - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                            - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                              will be selected for the Action.
+
+
+                            This field cannot be updated.
+                          type: string
                         preCondition:
                           description: |-
                             Specifies the state that the cluster must reach before the Action is executed.
@@ -338,6 +480,25 @@ spec:
                               format: int64
                               type: integer
                           type: object
+                        targetPodSelector:
+                          description: |-
+                            Defines the criteria used to select the target Pod(s) for executing the Action.
+                            This is useful when there is no default target replica identified.
+                            It allows for precise control over which Pod(s) the Action should run in.
+
+
+                            If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                            to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                            post-provision or pre-terminate of the component.
+
+
+                            This field cannot be updated.
+                          enum:
+                          - Any
+                          - All
+                          - Role
+                          - Ordinal
+                          type: string
                         timeoutSeconds:
                           default: 0
                           description: |-
@@ -2542,6 +2703,148 @@ spec:
                             - Ordinal
                             type: string
                         type: object
+                      grpc:
+                        description: |-
+                          Defines the gRPC call to issue.
+
+
+                          This field cannot be updated.
+                        properties:
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            description: Name of the method to invoke on the gRPC
+                              service.
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "50051") or a named port defined in the container spec.
+                            type: string
+                          request:
+                            additionalProperties:
+                              type: string
+                            description: |-
+                              Request payload for the gRPC method.
+
+
+                              Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+                              Templates are rendered with predefined action variables before the request is sent.
+                            type: object
+                          response:
+                            description: Required response schema for the gRPC method.
+                            properties:
+                              message:
+                                description: |-
+                                  Name of the field in the response whose value should be output.
+                                  Printed to stdout on success, or stderr on failure.
+                                type: string
+                              status:
+                                description: |-
+                                  Name of the string field in the response that carries status information.
+                                  If non-empty, the action fails.
+                                type: string
+                            type: object
+                          service:
+                            description: Fully-qualified name of the gRPC service
+                              to call.
+                            type: string
+                        required:
+                        - method
+                        - port
+                        - service
+                        type: object
+                      http:
+                        description: |-
+                          Defines the HTTP request to perform.
+
+
+                          This field cannot be updated.
+                        properties:
+                          body:
+                            description: |-
+                              Optional HTTP request body.
+
+
+                              Supports Go text/template syntax; rendered with predefined variables before sending.
+                            type: string
+                          headers:
+                            description: |-
+                              Custom headers to set in the request.
+                              Header values may use Go text/template syntax, rendered with predefined variables.
+                            items:
+                              description: HTTPHeader represents a single HTTP header
+                                key/value pair.
+                              properties:
+                                name:
+                                  description: Name of the header field.
+                                  type: string
+                                value:
+                                  description: Value of the header field.
+                                  type: string
+                              required:
+                              - name
+                              - value
+                              type: object
+                            type: array
+                          host:
+                            description: |-
+                              The target host to connect to.
+                              Defaults to "127.0.0.1" if not specified.
+                            type: string
+                          method:
+                            default: GET
+                            description: |-
+                              The HTTP method to use.
+                              Defaults to "GET".
+                            enum:
+                            - GET
+                            - POST
+                            - PUT
+                            - DELETE
+                            - HEAD
+                            - PATCH
+                            type: string
+                          path:
+                            default: /
+                            description: |-
+                              The path to request on the HTTP server.
+                              Defaults to "/" if not specified.
+                            pattern: ^/.*
+                            type: string
+                          port:
+                            description: |-
+                              The port to access on the host.
+                              It may be a numeric string (e.g., "8080") or a named port defined in the container spec.
+                            type: string
+                          scheme:
+                            default: HTTP
+                            description: |-
+                              The scheme to use for connecting to the host.
+                              Defaults to "HTTP".
+                            enum:
+                            - HTTP
+                            - HTTPS
+                            type: string
+                        required:
+                        - port
+                        type: object
+                      matchingKey:
+                        description: |-
+                          Used in conjunction with the `targetPodSelector` field to refine the selection of target pod(s) for Action execution.
+                          The impact of this field depends on the `targetPodSelector` value:
+
+
+                          - When `targetPodSelector` is set to `Any` or `All`, this field will be ignored.
+                          - When `targetPodSelector` is set to `Role`, only those replicas whose role matches the `matchingKey`
+                            will be selected for the Action.
+
+
+                          This field cannot be updated.
+                        type: string
                       preCondition:
                         description: |-
                           Specifies the state that the cluster must reach before the Action is executed.
@@ -2588,6 +2891,25 @@ spec:
                             format: int64
                             type: integer
                         type: object
+                      targetPodSelector:
+                        description: |-
+                          Defines the criteria used to select the target Pod(s) for executing the Action.
+                          This is useful when there is no default target replica identified.
+                          It allows for precise control over which Pod(s) the Action should run in.
+
+
+                          If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+                          to be removed or added; or a random pod if the Action is triggered at the component level, such as
+                          post-provision or pre-terminate of the component.
+
+
+                          This field cannot be updated.
+                        enum:
+                        - Any
+                        - All
+                        - Role
+                        - Ordinal
+                        type: string
                       timeoutSeconds:
                         default: 0
                         description: |-
diff --git a/docs/developer_docs/api-reference/cluster.md b/docs/developer_docs/api-reference/cluster.md
index fd85517a6..18a20e3c6 100644
--- a/docs/developer_docs/api-reference/cluster.md
+++ b/docs/developer_docs/api-reference/cluster.md
@@ -1587,6 +1587,7 @@ with <code>preCondition</code> specifying when the action should be fired relati
 <code>Immediately</code>, <code>RuntimeReady</code>, <code>ComponentReady</code>, and <code>ClusterReady</code>.</li>
 <li><code>preTerminate</code>: Defines the hook to be executed before terminating a Component.</li>
 <li><code>roleProbe</code>: Defines the procedure which is invoked regularly to assess the role of replicas.</li>
+<li><code>availableProbe</code>: Defines the procedure which is invoked regularly to assess the availability of the component.</li>
 <li><code>switchover</code>: Defines the procedure for a controlled transition of a role to a new replica.
 This approach aims to minimize downtime and maintain availability in systems with a leader-follower topology,
 such as before planned maintenance or upgrades on the current leader node.</li>
@@ -2295,6 +2296,7 @@ with <code>preCondition</code> specifying when the action should be fired relati
 <code>Immediately</code>, <code>RuntimeReady</code>, <code>ComponentReady</code>, and <code>ClusterReady</code>.</li>
 <li><code>preTerminate</code>: Defines the hook to be executed before terminating a Component.</li>
 <li><code>roleProbe</code>: Defines the procedure which is invoked regularly to assess the role of replicas.</li>
+<li><code>availableProbe</code>: Defines the procedure which is invoked regularly to assess the availability of the component.</li>
 <li><code>switchover</code>: Defines the procedure for a controlled transition of a role to a new replica.</li>
 <li><code>memberJoin</code>: Defines the procedure to add a new replica to the replication group.</li>
 <li><code>memberLeave</code>: Defines the method to remove a replica from the replication group.</li>
@@ -2312,21 +2314,20 @@ A set of predefined environment variables are available and can be leveraged wit
 to access context information such as details about pods, components, the overall cluster state,
 or database connection credentials.
 These variables provide a dynamic and context-aware mechanism for script execution.</li>
-<li>HTTPAction: Performs an HTTP request.
-HTTPAction is to be implemented in future version.</li>
-<li>GRPCAction: In future version, Actions will support initiating gRPC calls.
+<li>HTTPAction: Performs a single HTTP(S) request.</li>
+<li>GRPCAction: Issues a unary gRPC call to a target service.
 This allows developers to implement Actions using plugins written in programming language like Go,
 providing greater flexibility and extensibility.</li>
 </ul>
-<p>An action is considered successful on returning 0, or HTTP 200 for status HTTP(s) Actions.
+<p>An action is considered successful on returning 0, or HTTP 2xx for status HTTP actions.
 Any other return value or HTTP status codes indicate failure,
 and the action may be retried based on the configured retry policy.</p>
 <ul>
 <li>If an action exceeds the specified timeout duration, it will be terminated, and the action is considered failed.</li>
 <li>If an action produces any data as output, it should be written to stdout,
-or included in the HTTP response payload for HTTP(s) actions.</li>
+or included in the HTTP response payload for HTTP actions.</li>
 <li>If an action encounters any errors, error messages should be written to stderr,
-or detailed in the HTTP response with the appropriate non-200 status code.</li>
+or detailed in the HTTP response with the appropriate non-2xx status code.</li>
 </ul>
 </div>
 <table>
@@ -2354,6 +2355,75 @@ ExecAction
 </tr>
 <tr>
 <td>
+<code>http</code><br/>
+<em>
+<a href="#apps.kubeblocks.io/v1.HTTPAction">
+HTTPAction
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Defines the HTTP request to perform.</p>
+<p>This field cannot be updated.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>grpc</code><br/>
+<em>
+<a href="#apps.kubeblocks.io/v1.GRPCAction">
+GRPCAction
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Defines the gRPC call to issue.</p>
+<p>This field cannot be updated.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>targetPodSelector</code><br/>
+<em>
+<a href="#apps.kubeblocks.io/v1.TargetPodSelector">
+TargetPodSelector
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Defines the criteria used to select the target Pod(s) for executing the Action.
+This is useful when there is no default target replica identified.
+It allows for precise control over which Pod(s) the Action should run in.</p>
+<p>If not specified, the Action will be executed in the pod where the Action is triggered, such as the pod
+to be removed or added; or a random pod if the Action is triggered at the component level, such as
+post-provision or pre-terminate of the component.</p>
+<p>This field cannot be updated.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>matchingKey</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Used in conjunction with the <code>targetPodSelector</code> field to refine the selection of target pod(s) for Action execution.
+The impact of this field depends on the <code>targetPodSelector</code> value:</p>
+<ul>
+<li>When <code>targetPodSelector</code> is set to <code>Any</code> or <code>All</code>, this field will be ignored.</li>
+<li>When <code>targetPodSelector</code> is set to <code>Role</code>, only those replicas whose role matches the <code>matchingKey</code>
+will be selected for the Action.</li>
+</ul>
+<p>This field cannot be updated.</p>
+</td>
+</tr>
+<tr>
+<td>
 <code>timeoutSeconds</code><br/>
 <em>
 int32
@@ -3385,6 +3455,7 @@ ComponentPhase
 </em>
 </td>
 <td>
+<em>(Optional)</em>
 <p>Specifies the current state of the Component.</p>
 </td>
 </tr>
@@ -3397,8 +3468,31 @@ map[string]string
 </td>
 <td>
 <em>(Optional)</em>
-<p>Records detailed information about the Component in its current phase.
-The keys are either podName, deployName, or statefulSetName, formatted as &lsquo;ObjectKind/Name&rsquo;.</p>
+<p>Records detailed information about the Component in its current phase.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>observedGeneration</code><br/>
+<em>
+int64
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Indicates the most recent generation of the component state observed.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>upToDate</code><br/>
+<em>
+bool
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Indicates whether the component state observed is up-to-date with the desired state.</p>
 </td>
 </tr>
 </tbody>
@@ -5373,6 +5467,7 @@ with <code>preCondition</code> specifying when the action should be fired relati
 <code>Immediately</code>, <code>RuntimeReady</code>, <code>ComponentReady</code>, and <code>ClusterReady</code>.</li>
 <li><code>preTerminate</code>: Defines the hook to be executed before terminating a Component.</li>
 <li><code>roleProbe</code>: Defines the procedure which is invoked regularly to assess the role of replicas.</li>
+<li><code>availableProbe</code>: Defines the procedure which is invoked regularly to assess the availability of the component.</li>
 <li><code>switchover</code>: Defines the procedure for a controlled transition of a role to a new replica.
 This approach aims to minimize downtime and maintain availability in systems with a leader-follower topology,
 such as before planned maintenance or upgrades on the current leader node.</li>
@@ -7750,6 +7845,325 @@ If empty, Prometheus uses the default value <code>http</code>.</p>
 </tr>
 </tbody>
 </table>
+<h3 id="apps.kubeblocks.io/v1.GRPCAction">GRPCAction
+</h3>
+<p>
+(<em>Appears on:</em><a href="#apps.kubeblocks.io/v1.Action">Action</a>)
+</p>
+<div>
+<p>GRPCAction describes an action that issues a unary gRPC call to a target service.</p>
+<p>Reflection &amp; templating:
+  - This implementation uses gRPC Server Reflection to discover service/method schemas at runtime.
+    The target service MUST enable reflection. See: <a href="https://grpc.io/docs/guides/reflection/">https://grpc.io/docs/guides/reflection/</a>.
+  - Request message field values in <code>Request</code> support Go text/template syntax and will be rendered
+    with predefined action variables before marshaling into the request message.
+  - Not intended for streaming or large data-transfer operations (e.g., dataLoad, dataDump).
+Only unary (non-streaming) RPCs are supported.</p>
+<p>Success &amp; output:
+  - After invocation, the <code>Status</code> field in <code>Response</code> (if set) is inspected; a non-empty value
+    indicates failure.
+  - The <code>Message</code> field in <code>Response</code> (if set) is written to stdout if the invocation succeeds,
+or to stderr if it fails.</p>
+</div>
+<table>
+<thead>
+<tr>
+<th>Field</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>
+<code>port</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<p>The port to access on the host.
+It may be a numeric string (e.g., &ldquo;50051&rdquo;) or a named port defined in the container spec.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>host</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>The target host to connect to.
+Defaults to &ldquo;127.0.0.1&rdquo; if not specified.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>service</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<p>Fully-qualified name of the gRPC service to call.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>method</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<p>Name of the method to invoke on the gRPC service.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>request</code><br/>
+<em>
+<a href="#apps.kubeblocks.io/v1.GRPCRequest">
+GRPCRequest
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Request payload for the gRPC method.</p>
+<p>Keys are proto field names (lowerCamelCase); values are strings that can include Go templates.
+Templates are rendered with predefined action variables before the request is sent.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>response</code><br/>
+<em>
+<a href="#apps.kubeblocks.io/v1.GRPCResponse">
+GRPCResponse
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Required response schema for the gRPC method.</p>
+</td>
+</tr>
+</tbody>
+</table>
+<h3 id="apps.kubeblocks.io/v1.GRPCRequest">GRPCRequest
+(<code>map[string]string</code> alias)</h3>
+<p>
+(<em>Appears on:</em><a href="#apps.kubeblocks.io/v1.GRPCAction">GRPCAction</a>)
+</p>
+<div>
+<p>GRPCRequest is a map of proto field names to their string values.</p>
+</div>
+<h3 id="apps.kubeblocks.io/v1.GRPCResponse">GRPCResponse
+</h3>
+<p>
+(<em>Appears on:</em><a href="#apps.kubeblocks.io/v1.GRPCAction">GRPCAction</a>)
+</p>
+<div>
+<p>GRPCResponse defines which fields in the gRPC response should be treated as status or output.</p>
+</div>
+<table>
+<thead>
+<tr>
+<th>Field</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>
+<code>status</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Name of the string field in the response that carries status information.
+If non-empty, the action fails.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>message</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Name of the field in the response whose value should be output.
+Printed to stdout on success, or stderr on failure.</p>
+</td>
+</tr>
+</tbody>
+</table>
+<h3 id="apps.kubeblocks.io/v1.HTTPAction">HTTPAction
+</h3>
+<p>
+(<em>Appears on:</em><a href="#apps.kubeblocks.io/v1.Action">Action</a>)
+</p>
+<div>
+<p>HTTPAction defines an action that performs a single HTTP(S) request.</p>
+<p>Behavior &amp; templating:
+  - The request body (<code>Body</code>) supports Go text/template syntax. It is rendered with predefined variables
+    before the request is sent.
+  - Custom headers (<code>Headers</code>) can be specified. Each header value can also use Go text/template
+    syntax and will be rendered with the same predefined variables.
+  - Not intended for streaming or large data-transfer workflows (e.g., dataLoad, dataDump).
+Designed for one-shot request/response scenarios.</p>
+<p>Success:
+  - Any HTTP 2xx status code is considered success by default.
+- Non-2xx status codes are treated as failures.</p>
+</div>
+<table>
+<thead>
+<tr>
+<th>Field</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>
+<code>port</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<p>The port to access on the host.
+It may be a numeric string (e.g., &ldquo;8080&rdquo;) or a named port defined in the container spec.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>host</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>The target host to connect to.
+Defaults to &ldquo;127.0.0.1&rdquo; if not specified.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>scheme</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>The scheme to use for connecting to the host.
+Defaults to &ldquo;HTTP&rdquo;.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>path</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>The path to request on the HTTP server.
+Defaults to &ldquo;/&rdquo; if not specified.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>method</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>The HTTP method to use.
+Defaults to &ldquo;GET&rdquo;.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>headers</code><br/>
+<em>
+<a href="#apps.kubeblocks.io/v1.HTTPHeader">
+[]HTTPHeader
+</a>
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Custom headers to set in the request.
+Header values may use Go text/template syntax, rendered with predefined variables.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>body</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>Optional HTTP request body.</p>
+<p>Supports Go text/template syntax; rendered with predefined variables before sending.</p>
+</td>
+</tr>
+</tbody>
+</table>
+<h3 id="apps.kubeblocks.io/v1.HTTPHeader">HTTPHeader
+</h3>
+<p>
+(<em>Appears on:</em><a href="#apps.kubeblocks.io/v1.HTTPAction">HTTPAction</a>)
+</p>
+<div>
+<p>HTTPHeader represents a single HTTP header key/value pair.</p>
+</div>
+<table>
+<thead>
+<tr>
+<th>Field</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>
+<code>name</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<p>Name of the header field.</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>value</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<p>Value of the header field.</p>
+</td>
+</tr>
+</tbody>
+</table>
 <h3 id="apps.kubeblocks.io/v1.HostNetwork">HostNetwork
 </h3>
 <p>
@@ -12433,7 +12847,7 @@ VarOption
 <h3 id="apps.kubeblocks.io/v1.TargetPodSelector">TargetPodSelector
 (<code>string</code> alias)</h3>
 <p>
-(<em>Appears on:</em><a href="#apps.kubeblocks.io/v1.ExecAction">ExecAction</a>)
+(<em>Appears on:</em><a href="#apps.kubeblocks.io/v1.Action">Action</a>, <a href="#apps.kubeblocks.io/v1.ExecAction">ExecAction</a>)
 </p>
 <div>
 <p>TargetPodSelector defines how to select pod(s) to execute an Action.</p>
diff --git a/go.mod b/go.mod
index bbddc7803..59aa82abf 100644
--- a/go.mod
+++ b/go.mod
@@ -19,13 +19,14 @@ require (
 	github.com/evanphx/json-patch/v5 v5.8.0
 	github.com/fasthttp/router v1.4.20
 	github.com/fsnotify/fsnotify v1.7.0
-	github.com/go-logr/logr v1.4.2
+	github.com/go-logr/logr v1.4.3
 	github.com/go-logr/zapr v1.3.0
 	github.com/go-sql-driver/mysql v1.7.1
 	github.com/golang/mock v1.6.0
 	github.com/google/cel-go v0.17.8
 	github.com/google/go-cmp v0.7.0
 	github.com/imdario/mergo v0.3.14
+	github.com/jhump/protoreflect v1.17.0
 	github.com/jinzhu/copier v0.4.0
 	github.com/json-iterator/go v1.1.12
 	github.com/klauspost/compress v1.17.8
@@ -44,7 +45,7 @@ require (
 	github.com/spf13/cobra v1.8.0
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.16.0
-	github.com/stretchr/testify v1.9.0
+	github.com/stretchr/testify v1.10.0
 	github.com/sykesm/zap-logfmt v0.0.4
 	github.com/valyala/fasthttp v1.50.0
 	go.uber.org/automaxprocs v1.6.0
@@ -54,8 +55,8 @@ require (
 	golang.org/x/mod v0.25.0
 	golang.org/x/net v0.40.0
 	golang.org/x/text v0.26.0
-	google.golang.org/grpc v1.63.2
-	google.golang.org/protobuf v1.36.5
+	google.golang.org/grpc v1.74.2
+	google.golang.org/protobuf v1.36.6
 	gopkg.in/ini.v1 v1.67.0
 	gopkg.in/yaml.v2 v2.4.0
 	k8s.io/api v0.29.14
@@ -84,7 +85,8 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bhmj/xpression v0.9.1 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/bufbuild/protocompile v0.14.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cockroachdb/apd/v3 v3.2.1 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
@@ -141,7 +143,7 @@ require (
 	github.com/prometheus/common v0.52.3 // indirect
 	github.com/prometheus/procfs v0.12.0 // indirect
 	github.com/protocolbuffers/txtpbfmt v0.0.0-20230328191034-3462fbc510c0 // indirect
-	github.com/rogpeppe/go-internal v1.12.0 // indirect
+	github.com/rogpeppe/go-internal v1.13.1 // indirect
 	github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee // indirect
 	github.com/sergi/go-diff v1.2.0 // indirect
 	github.com/shoenig/go-m1cpu v0.1.6 // indirect
@@ -155,27 +157,27 @@ require (
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.3 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
-	go.opentelemetry.io/otel v1.25.0 // indirect
+	go.opentelemetry.io/otel v1.36.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.24.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.24.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 // indirect
-	go.opentelemetry.io/otel/metric v1.25.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.25.0 // indirect
-	go.opentelemetry.io/otel/trace v1.25.0 // indirect
+	go.opentelemetry.io/otel/metric v1.36.0 // indirect
+	go.opentelemetry.io/otel/trace v1.36.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.1.0 // indirect
 	go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/oauth2 v0.27.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/sync v0.15.0 // indirect
 	golang.org/x/sys v0.33.0 // indirect
 	golang.org/x/term v0.32.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	golang.org/x/tools v0.33.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240314234333-6e1732d8331c // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	gotest.tools/v3 v3.5.0 // indirect
diff --git a/go.sum b/go.sum
index 467df6aba..2eb9dbdda 100644
--- a/go.sum
+++ b/go.sum
@@ -93,11 +93,13 @@ github.com/bhmj/xpression v0.9.1 h1:N7bX/nWx9oFi/zsiMTx2ehoRApTDAWdQadq/5o2wMGk=
 github.com/bhmj/xpression v0.9.1/go.mod h1:j9oYmEXJjeL9mrgW1+ZDBKJXnbupsCPGhlO9J5YhS1Q=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
+github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
 github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
-github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
@@ -173,8 +175,8 @@ github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2
 github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
 github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
@@ -315,6 +317,8 @@ github.com/imdario/mergo v0.3.14 h1:fOqeC1+nCuuk6PKQdg9YmosXX7Y7mHX6R/0ZldI9iHo=
 github.com/imdario/mergo v0.3.14/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jhump/protoreflect v1.17.0 h1:qOEr613fac2lOuTgWN4tPAtLL7fUSbuJL5X5XumQh94=
+github.com/jhump/protoreflect v1.17.0/go.mod h1:h9+vUUL38jiBzck8ck+6G/aeMX8Z4QUY/NiJPwPNi+8=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
@@ -441,8 +445,8 @@ github.com/protocolbuffers/txtpbfmt v0.0.0-20230328191034-3462fbc510c0/go.mod h1
 github.com/replicatedhq/troubleshoot v0.57.0 h1:m9B31Mhgiz4Lwz+W4RvFkqhfYZLCwAqRPUwiwmSAAps=
 github.com/replicatedhq/troubleshoot v0.57.0/go.mod h1:R5VdixzaBXfWLbP9mcLuZKs/bDCyGGS4+vFtKGWs9xE=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
-github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee h1:8Iv5m6xEo1NR1AvpV+7XmhI4r39LGNzwUL4YpMuL5vk=
 github.com/savsgio/gotils v0.0.0-20230208104028-c358bd845dee/go.mod h1:qwtSXrKuJh/zsFQ12yEE89xfCrGKK63Rr7ctU/uCo4g=
@@ -494,8 +498,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
 github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
 github.com/sykesm/zap-logfmt v0.0.4 h1:U2WzRvmIWG1wDLCFY3sz8UeEmsdHQjHFNlIdmroVFaI=
@@ -530,24 +534,28 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 h1:4Pp6oUg3+e/6M4C0A/3kJ2VYa++dsWVTtGgLVj5xtHg=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0/go.mod h1:Mjt1i1INqiaoZOMGR1RIUJN+i3ChKoFRqzrRQhlkbs0=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 h1:jq9TW8u3so/bN+JPT166wjOI6/vQPF6Xe7nMNIltagk=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0/go.mod h1:p8pYQP+m5XfbZm9fxtSKAbM6oIllS7s2AfxrChvc7iw=
-go.opentelemetry.io/otel v1.25.0 h1:gldB5FfhRl7OJQbUHt/8s0a7cE8fbsPAtdpRaApKy4k=
-go.opentelemetry.io/otel v1.25.0/go.mod h1:Wa2ds5NOXEMkCmUou1WA7ZBfLTHWIsp034OVD7AO+Vg=
+go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
+go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.24.0 h1:t6wl9SPayj+c7lEIFgm4ooDBZVb01IhLB4InpomhRw8=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.24.0/go.mod h1:iSDOcsnSA5INXzZtwaBPrKp/lWu/V14Dd+llD0oI2EA=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.24.0 h1:Mw5xcxMwlqoJd97vwPxA8isEaIoxsta9/Q51+TTJLGE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.24.0/go.mod h1:CQNu9bj7o7mC6U7+CA/schKEYakYXWr79ucDHTMGhCM=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 h1:IeMeyr1aBvBiPVYihXIaeIZba6b8E1bYp7lbdxK8CQg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0/go.mod h1:oVdCUtjq9MK9BlS7TtucsQwUcXcymNiEDjgDD2jMtZU=
-go.opentelemetry.io/otel/metric v1.25.0 h1:LUKbS7ArpFL/I2jJHdJcqMGxkRdxpPHE0VU/D4NuEwA=
-go.opentelemetry.io/otel/metric v1.25.0/go.mod h1:rkDLUSd2lC5lq2dFNrX9LGAbINP5B7WBkC78RXCpH5s=
-go.opentelemetry.io/otel/sdk v1.25.0 h1:PDryEJPC8YJZQSyLY5eqLeafHtG+X7FWnf3aXMtxbqo=
-go.opentelemetry.io/otel/sdk v1.25.0/go.mod h1:oFgzCM2zdsxKzz6zwpTZYLLQsFwc+K0daArPdIhuxkw=
-go.opentelemetry.io/otel/trace v1.25.0 h1:tqukZGLwQYRIFtSQM2u2+yfMVTgGVeqRLPUYx1Dq6RM=
-go.opentelemetry.io/otel/trace v1.25.0/go.mod h1:hCCs70XM/ljO+BeQkyFnbK28SBIJ/Emuha+ccrCRT7I=
+go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
+go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
+go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
+go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY=
+go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis=
+go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
+go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
+go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
 go.opentelemetry.io/proto/otlp v1.1.0 h1:2Di21piLrCqJ3U3eXGCTPHE9R8Nh+0uglSnOyxikMeI=
 go.opentelemetry.io/proto/otlp v1.1.0/go.mod h1:GpBHCBWiqvVLDqmHZsoMM3C5ySeKTC7ej/RNTae6MdY=
 go.starlark.net v0.0.0-20230525235612-a134d8f9ddca h1:VdD38733bfYv5tUZwEIskMM93VanwNIi5bIKnDrJdEY=
@@ -666,8 +674,8 @@ golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
-golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -886,10 +894,10 @@ google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto/googleapis/api v0.0.0-20240314234333-6e1732d8331c h1:kaI7oewGK5YnVwj+Y+EJBO/YN1ht8iTL9XkFHtVZLsc=
-google.golang.org/genproto/googleapis/api v0.0.0-20240314234333-6e1732d8331c/go.mod h1:VQW3tUculP/D4B+xVCo+VgSq8As6wA9ZjHl//pmk+6s=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda h1:LI5DOvAxUPMv/50agcLLoo+AdWc1irS9Rzz4vPuD1V4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a h1:SGktgSolFCo75dnHJF2yMvnns6jCmHFJ0vE4Vn2JKvQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a/go.mod h1:a77HrdMjoeKbnd2jmgcWdaS++ZLZAEq3orIOAEIKiVw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a h1:v2PbRU4K3llS09c7zodFpNePeamkAwG3mPrAery9VeE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
 google.golang.org/grpc v1.18.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
@@ -907,8 +915,8 @@ google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
 google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.63.2 h1:MUeiw1B2maTVZthpU5xvASfTh3LDbxHd6IJ6QQVU+xM=
-google.golang.org/grpc v1.63.2/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDomNkRA=
+google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
+google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -919,8 +927,8 @@ google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
-google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/hack/rbac-summary.sh b/hack/rbac-summary.sh
new file mode 100755
index 000000000..bef355e59
--- /dev/null
+++ b/hack/rbac-summary.sh
@@ -0,0 +1,367 @@
+#!/bin/bash
+
+# KubeBlocks RBAC Permissions Summary Generator
+# This script generates a comprehensive summary of all RBAC permissions required by KubeBlocks
+# under different configuration parameters
+
+set -e
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+# Script directory
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
+HELM_DIR="$PROJECT_ROOT/deploy/helm"
+
+# Output file and temp files
+OUTPUT_FILE="$PROJECT_ROOT/docs/rbac-summary.md"
+TEMP_YAML_BASE="$PROJECT_ROOT/temp-helm-base.yaml"
+TEMP_YAML_WEBHOOKS="$PROJECT_ROOT/temp-helm-webhooks.yaml"
+TEMP_YAML_RBAC="$PROJECT_ROOT/temp-helm-rbac.yaml"
+TEMP_YAML_BOTH="$PROJECT_ROOT/temp-helm-both.yaml"
+
+echo -e "${BLUE}KubeBlocks RBAC Permissions Summary Generator${NC}"
+echo "=============================================="
+
+# Check dependencies
+if ! command -v helm &> /dev/null; then
+    echo -e "${RED}Error: helm is not installed${NC}"
+    exit 1
+fi
+
+if ! command -v yq &> /dev/null; then
+    echo -e "${RED}Error: yq is not installed${NC}"
+    exit 1
+fi
+
+# Create output directory
+mkdir -p "$(dirname "$OUTPUT_FILE")"
+
+# Generate summary
+echo -e "${YELLOW}Generating RBAC permissions summary for different configurations...${NC}"
+
+# Render templates for different configurations
+echo -e "${YELLOW}Rendering Helm templates for base configuration...${NC}"
+cd "$HELM_DIR"
+helm template kubeblocks . --set webhooks.conversionEnabled=false --set rbac.enabled=false > "$TEMP_YAML_BASE"
+
+echo -e "${YELLOW}Rendering Helm templates with webhooks.conversionEnabled=true...${NC}"
+helm template kubeblocks . --set webhooks.conversionEnabled=true --set rbac.enabled=false > "$TEMP_YAML_WEBHOOKS"
+
+echo -e "${YELLOW}Rendering Helm templates with rbac.enabled=true...${NC}"
+helm template kubeblocks . --set webhooks.conversionEnabled=false --set rbac.enabled=true > "$TEMP_YAML_RBAC"
+
+echo -e "${YELLOW}Rendering Helm templates with both enabled...${NC}"
+helm template kubeblocks . --set webhooks.conversionEnabled=true --set rbac.enabled=true > "$TEMP_YAML_BOTH"
+
+cd "$PROJECT_ROOT"
+
+# Function to extract and format permissions for a specific API group
+extract_permissions() {
+    local api_group="$1"
+    local filter="$2"
+    local temp_file="$3"
+
+    local permissions=$(yq eval "$filter" "$temp_file" 2>/dev/null | grep -v "^null$" | grep -v "^---$" | sort | uniq)
+
+    if [[ -n "$permissions" ]]; then
+        echo "$permissions" | awk -F: '
+        {
+            if ($1 in resources) {
+                if (index(resources[$1], $2) == 0) {
+                    resources[$1] = resources[$1] ", " $2
+                }
+            } else {
+                resources[$1] = $2
+            }
+        }
+        END {
+            for (resource in resources) {
+                if (resource != "" && resource != "null") {
+                    print "* **" resource "**: " resources[resource]
+                }
+            }
+        }' | sort
+    fi
+}
+
+# Function to get all API groups from a template
+get_api_groups() {
+    local temp_file="$1"
+    local exclude_kubeblocks="$2"
+
+    if [[ "$exclude_kubeblocks" == "true" ]]; then
+        yq eval '
+          select(.kind == "ClusterRole" or .kind == "Role") |
+          .rules[]? |
+          .apiGroups[]? |
+          select(. == "" or (test("kubeblocks") | not))
+        ' "$temp_file" 2>/dev/null | grep -v "^null$" | sort | uniq
+    else
+        yq eval '
+          select(.kind == "ClusterRole" or .kind == "Role") |
+          .rules[]? |
+          .apiGroups[]? |
+          select(. != null and test("kubeblocks"))
+        ' "$temp_file" 2>/dev/null | grep -v "^null$" | sort | uniq
+    fi
+}
+
+# Function to generate permissions for a specific configuration
+generate_permissions_section() {
+    local temp_file="$1"
+    local section_title="$2"
+    local output_file="$3"
+
+    echo "### $section_title" >> "$output_file"
+    echo "" >> "$output_file"
+
+    # Get all unique API groups from Kubernetes (excluding KubeBlocks groups)
+    local all_k8s_api_groups=$(get_api_groups "$temp_file" "true")
+
+    # Process each API group
+    while IFS= read -r api_group; do
+        # Process all API groups including empty string (core API group)
+        if [[ -n "$api_group" ]] || [[ "$api_group" == "" ]]; then
+            # Check if this API group has any resources
+            resources_count=$(yq eval "
+              select(.kind == \"ClusterRole\" or .kind == \"Role\") |
+              .rules[]? |
+              select(.apiGroups[]? == \"$api_group\") |
+              .resources[]? |
+              select(. != null)
+            " "$temp_file" 2>/dev/null | grep -v "^null$" | wc -l | tr -d ' ')
+
+            if [[ "$resources_count" -gt 0 ]]; then
+                # Display API group name
+                if [[ "$api_group" == "" ]]; then
+                    echo "#### Core API Group" >> "$output_file"
+                else
+                    echo "#### $api_group" >> "$output_file"
+                fi
+                echo "" >> "$output_file"
+
+                # Extract permissions for this API group
+                api_permissions=$(extract_permissions "$api_group" "
+                  select(.kind == \"ClusterRole\" or .kind == \"Role\") |
+                  .rules[]? |
+                  select(.apiGroups[]? == \"$api_group\") |
+                  .resources[]? as \$resource |
+                  .verbs[]? as \$verb |
+                  select(\$resource != null and \$verb != null) |
+                  \$resource + \":\" + \$verb
+                " "$temp_file")
+
+                if [[ -n "$api_permissions" ]]; then
+                    echo "$api_permissions" >> "$output_file"
+                    echo "" >> "$output_file"
+                fi
+            fi
+        fi
+    done <<< "$all_k8s_api_groups"
+
+    # Non-Resource URLs (if any)
+    non_resource_count=$(yq eval '
+      select(.kind == "ClusterRole" or .kind == "Role") |
+      .rules[]? |
+      select(.nonResourceURLs) |
+      .nonResourceURLs[]?
+    ' "$temp_file" 2>/dev/null | grep -v "^null$" | wc -l | tr -d ' ')
+
+    if [[ "$non_resource_count" -gt 0 ]]; then
+        echo "#### Non-Resource URLs" >> "$output_file"
+        echo "" >> "$output_file"
+
+        non_resource_permissions=$(yq eval '
+          select(.kind == "ClusterRole" or .kind == "Role") |
+          .rules[]? |
+          select(.nonResourceURLs) |
+          .nonResourceURLs[]? as $url |
+          .verbs[]? as $verb |
+          select($url != null and $verb != null) |
+          $url + ":" + $verb
+        ' "$temp_file" 2>/dev/null | grep -v "^null$" | grep -v "^---$" | sort | uniq)
+
+        if [[ -n "$non_resource_permissions" ]]; then
+            echo "$non_resource_permissions" | awk -F: '
+            {
+                if ($1 in resources) {
+                    if (index(resources[$1], $2) == 0) {
+                        resources[$1] = resources[$1] ", " $2
+                    }
+                } else {
+                    resources[$1] = $2
+                }
+            }
+            END {
+                for (resource in resources) {
+                    if (resource != "" && resource != "null") {
+                        print "* **" resource "**: " resources[resource]
+                    }
+                }
+            }' | sort >> "$output_file"
+            echo "" >> "$output_file"
+        fi
+    fi
+
+    # KubeBlocks Custom Resources
+    local kb_api_groups_raw=$(get_api_groups "$temp_file" "false")
+
+    # Convert to array
+    local kb_api_groups=()
+    while IFS= read -r group; do
+        if [[ -n "$group" ]]; then
+            kb_api_groups+=("$group")
+        fi
+    done <<< "$kb_api_groups_raw"
+
+    if [[ ${#kb_api_groups[@]} -gt 0 ]]; then
+        echo "#### KubeBlocks Custom Resources" >> "$output_file"
+        echo "" >> "$output_file"
+
+        for api_group in "${kb_api_groups[@]}"; do
+            # Check if this API group has any resources
+            resources_count=$(yq eval "
+              select(.kind == \"ClusterRole\" or .kind == \"Role\") |
+              .rules[]? |
+              select(.apiGroups[]? == \"$api_group\") |
+              .resources[]? |
+              select(. != null)
+            " "$temp_file" 2>/dev/null | grep -v "^null$" | wc -l | tr -d ' ')
+
+            if [[ "$resources_count" -gt 0 ]]; then
+                echo "##### $api_group" >> "$output_file"
+                echo "" >> "$output_file"
+
+                # Extract permissions for this API group
+                kb_permissions=$(extract_permissions "$api_group" "
+                  select(.kind == \"ClusterRole\" or .kind == \"Role\") |
+                  .rules[]? |
+                  select(.apiGroups[]? == \"$api_group\") |
+                  .resources[]? as \$resource |
+                  .verbs[]? as \$verb |
+                  select(\$resource != null and \$verb != null) |
+                  \$resource + \":\" + \$verb
+                " "$temp_file")
+
+                if [[ -n "$kb_permissions" ]]; then
+                    echo "$kb_permissions" >> "$output_file"
+                    echo "" >> "$output_file"
+                fi
+            fi
+        done
+    fi
+}
+
+# Function to compare permissions and show differences
+compare_permissions() {
+    local base_file="$1"
+    local compare_file="$2"
+    local section_title="$3"
+    local output_file="$4"
+
+    echo "### $section_title" >> "$output_file"
+    echo "" >> "$output_file"
+
+    # Get all permissions from both files
+    base_permissions=$(yq eval '
+      select(.kind == "ClusterRole" or .kind == "Role") |
+      .rules[]? |
+      (.apiGroups[]? + ":" + .resources[]? + ":" + .verbs[]?) |
+      select(. != null)
+    ' "$base_file" 2>/dev/null | grep -v "^null$" | sort | uniq)
+
+    compare_permissions=$(yq eval '
+      select(.kind == "ClusterRole" or .kind == "Role") |
+      .rules[]? |
+      (.apiGroups[]? + ":" + .resources[]? + ":" + .verbs[]?) |
+      select(. != null)
+    ' "$compare_file" 2>/dev/null | grep -v "^null$" | sort | uniq)
+
+    # Find new permissions
+    new_permissions=$(comm -13 <(echo "$base_permissions" | sort) <(echo "$compare_permissions" | sort))
+
+    if [[ -n "$new_permissions" ]]; then
+        echo "**Additional permissions required:**" >> "$output_file"
+        echo "" >> "$output_file"
+
+        # Group by API group and sort properly
+        temp_output=$(mktemp)
+        echo "$new_permissions" | awk -F: '
+        {
+            api_group = $1
+            resource = $2
+            verb = $3
+            if (api_group == "") api_group = "Core API Group"
+            key = api_group ":" resource
+            if (key in perms) {
+                if (index(perms[key], verb) == 0) {
+                    perms[key] = perms[key] ", " verb
+                }
+            } else {
+                perms[key] = verb
+            }
+        }
+        END {
+            for (key in perms) {
+                split(key, parts, ":")
+                group = parts[1]
+                resource = parts[2]
+                print group "\t" resource "\t" perms[key]
+            }
+        }' | sort | awk -F'\t' '
+        {
+            group = $1
+            resource = $2
+            permissions = $3
+            if (group != current_group) {
+                if (current_group != "") print ""
+                print "#### " group
+                print ""
+                current_group = group
+            }
+            print "* **" resource "**: " permissions
+        }' >> "$output_file"
+        echo "" >> "$output_file"
+    else
+        echo "**No additional permissions required.**" >> "$output_file"
+        echo "" >> "$output_file"
+    fi
+}
+
+# Start generating the output file
+cat > "$OUTPUT_FILE" << 'EOF'
+# KubeBlocks Operator RBAC Permissions
+
+KubeBlocks operator requires different permissions based on configuration parameters.
+EOF
+
+echo "" >> "$OUTPUT_FILE"
+echo "**Generated:** $(date)" >> "$OUTPUT_FILE"
+echo "" >> "$OUTPUT_FILE"
+
+# Generate base configuration
+echo "## Base Configuration" >> "$OUTPUT_FILE"
+echo "" >> "$OUTPUT_FILE"
+echo "**Configuration:** \`webhooks.conversionEnabled=false\` and \`rbac.enabled=false\`" >> "$OUTPUT_FILE"
+echo "" >> "$OUTPUT_FILE"
+
+generate_permissions_section "$TEMP_YAML_BASE" "Kubernetes Resource Permissions" "$OUTPUT_FILE"
+
+# Generate comparison sections
+echo "## Additional Permissions for Different Configurations" >> "$OUTPUT_FILE"
+echo "" >> "$OUTPUT_FILE"
+
+compare_permissions "$TEMP_YAML_BASE" "$TEMP_YAML_WEBHOOKS" "webhooks.conversionEnabled=true" "$OUTPUT_FILE"
+compare_permissions "$TEMP_YAML_BASE" "$TEMP_YAML_RBAC" "rbac.enabled=true" "$OUTPUT_FILE"
+
+# Cleanup temp files
+rm -f "$TEMP_YAML_BASE" "$TEMP_YAML_WEBHOOKS" "$TEMP_YAML_RBAC" "$TEMP_YAML_BOTH"
+
+echo -e "${GREEN}RBAC permissions summary generated successfully!${NC}"
+echo -e "Output file: $OUTPUT_FILE"
\ No newline at end of file
diff --git a/pkg/controller/component/kbagent.go b/pkg/controller/component/kbagent.go
index 3ddbd8e88..ad8ba87cf 100644
--- a/pkg/controller/component/kbagent.go
+++ b/pkg/controller/component/kbagent.go
@@ -332,16 +332,45 @@ func probeReportPeriodSeconds(periodSeconds int32) int32 {
 }
 
 func buildAction4KBAgent(action *appsv1.Action, name string) *proto.Action {
-	if action == nil || action.Exec == nil {
+	if !action.Defined() {
 		return nil
 	}
 	a := &proto.Action{
-		Name: name,
-		Exec: &proto.ExecAction{
+		Name:           name,
+		TimeoutSeconds: action.TimeoutSeconds,
+	}
+	if action.Exec != nil {
+		a.Exec = &proto.ExecAction{
 			Commands: action.Exec.Command,
 			Args:     action.Exec.Args,
-		},
-		TimeoutSeconds: action.TimeoutSeconds,
+		}
+	}
+	if action.HTTP != nil {
+		a.HTTP = &proto.HTTPAction{
+			Port:    action.HTTP.Port,
+			Host:    action.HTTP.Host,
+			Scheme:  action.HTTP.Scheme,
+			Path:    action.HTTP.Path,
+			Method:  action.HTTP.Method,
+			Body:    action.HTTP.Body,
+			Headers: make([]proto.HTTPHeader, 0),
+		}
+		for _, h := range action.HTTP.Headers {
+			a.HTTP.Headers = append(a.HTTP.Headers, proto.HTTPHeader{Name: h.Name, Value: h.Value})
+		}
+	}
+	if action.GRPC != nil {
+		a.GRPC = &proto.GRPCAction{
+			Port:    action.GRPC.Port,
+			Host:    action.GRPC.Host,
+			Service: action.GRPC.Service,
+			Method:  action.GRPC.Method,
+			Request: action.GRPC.Request,
+			Response: proto.GRPCResponse{
+				Status:  action.GRPC.Response.Status,
+				Message: action.GRPC.Response.Message,
+			},
+		}
 	}
 	if action.RetryPolicy != nil {
 		a.RetryPolicy = &proto.RetryPolicy{
@@ -353,7 +382,7 @@ func buildAction4KBAgent(action *appsv1.Action, name string) *proto.Action {
 }
 
 func buildProbe4KBAgent(probe *appsv1.Probe, name, instance string) (*proto.Action, *proto.Probe) {
-	if probe == nil || probe.Exec == nil {
+	if probe == nil || !probe.Defined() {
 		return nil, nil
 	}
 	a := buildAction4KBAgent(&probe.Action, name)
@@ -421,7 +450,7 @@ func customExecActionImageNContainer(synthesizedComp *SynthesizedComponent) (str
 			synthesizedComp.LifecycleActions.Reconfigure,
 			synthesizedComp.LifecycleActions.AccountProvision,
 		}...)
-		if synthesizedComp.LifecycleActions.RoleProbe != nil && synthesizedComp.LifecycleActions.RoleProbe.Exec != nil {
+		if synthesizedComp.LifecycleActions.RoleProbe != nil && synthesizedComp.LifecycleActions.RoleProbe.Defined() {
 			actions = append(actions, &synthesizedComp.LifecycleActions.RoleProbe.Action)
 		}
 	}
diff --git a/pkg/controller/lifecycle/kbagent.go b/pkg/controller/lifecycle/kbagent.go
index d82b3d264..bad05b3b9 100644
--- a/pkg/controller/lifecycle/kbagent.go
+++ b/pkg/controller/lifecycle/kbagent.go
@@ -142,7 +142,7 @@ func (a *kbagent) ignoreOutput(_ []byte, err error) error {
 }
 
 func (a *kbagent) checkedCallAction(ctx context.Context, cli client.Reader, spec *appsv1.Action, lfa lifecycleAction, opts *Options) ([]byte, error) {
-	if spec == nil || spec.Exec == nil {
+	if !spec.Defined() {
 		return nil, errors.Wrap(ErrActionNotDefined, lfa.name())
 	}
 	if err := a.precondition(ctx, cli, spec); err != nil {
@@ -153,7 +153,7 @@ func (a *kbagent) checkedCallAction(ctx context.Context, cli client.Reader, spec
 }
 
 func (a *kbagent) checkedCallProbe(ctx context.Context, cli client.Reader, spec *appsv1.Probe, lfa lifecycleAction, opts *Options) ([]byte, error) {
-	if spec == nil || spec.Exec == nil {
+	if !spec.Action.Defined() {
 		return nil, errors.Wrap(ErrActionNotDefined, lfa.name())
 	}
 	return a.checkedCallAction(ctx, cli, &spec.Action, lfa, opts)
@@ -381,7 +381,14 @@ func (a *kbagent) formatError(lfa lifecycleAction, rsp proto.ActionResponse) err
 }
 
 func SelectTargetPods(pods []*corev1.Pod, pod *corev1.Pod, spec *appsv1.Action) ([]*corev1.Pod, error) {
-	if spec.Exec == nil || len(spec.Exec.TargetPodSelector) == 0 {
+	selector := spec.TargetPodSelector
+	matchingKey := spec.MatchingKey
+	if len(selector) == 0 && spec.Exec != nil && len(spec.Exec.TargetPodSelector) > 0 {
+		// back-off to use spec.Exec
+		selector = spec.Exec.TargetPodSelector
+		matchingKey = spec.Exec.MatchingKey
+	}
+	if len(selector) == 0 {
 		return []*corev1.Pod{pod}, nil
 	}
 
@@ -395,7 +402,7 @@ func SelectTargetPods(pods []*corev1.Pod, pod *corev1.Pod, spec *appsv1.Action)
 	}
 
 	podsWithRole := func() []*corev1.Pod {
-		roleName := spec.Exec.MatchingKey
+		roleName := matchingKey
 		var rolePods []*corev1.Pod
 		for i, pod := range pods {
 			if len(pod.Labels) != 0 {
@@ -407,7 +414,7 @@ func SelectTargetPods(pods []*corev1.Pod, pod *corev1.Pod, spec *appsv1.Action)
 		return rolePods
 	}
 
-	switch spec.Exec.TargetPodSelector {
+	switch selector {
 	case appsv1.AnyReplica:
 		return anyPod(), nil
 	case appsv1.AllReplicas:
@@ -417,6 +424,6 @@ func SelectTargetPods(pods []*corev1.Pod, pod *corev1.Pod, spec *appsv1.Action)
 	case appsv1.OrdinalSelector:
 		return nil, fmt.Errorf("ordinal selector is not supported")
 	default:
-		return nil, fmt.Errorf("unknown pod selector: %s", spec.Exec.TargetPodSelector)
+		return nil, fmt.Errorf("unknown pod selector: %s", selector)
 	}
 }
diff --git a/pkg/kbagent/proto/proto.go b/pkg/kbagent/proto/proto.go
index c07783529..0a3f16e91 100644
--- a/pkg/kbagent/proto/proto.go
+++ b/pkg/kbagent/proto/proto.go
@@ -26,6 +26,8 @@ import (
 type Action struct {
 	Name           string       `json:"name"`
 	Exec           *ExecAction  `json:"exec,omitempty"`
+	HTTP           *HTTPAction  `json:"http,omitempty"`
+	GRPC           *GRPCAction  `json:"grpc,omitempty"`
 	TimeoutSeconds int32        `json:"timeoutSeconds,omitempty"`
 	RetryPolicy    *RetryPolicy `json:"retryPolicy,omitempty"`
 }
@@ -35,6 +37,34 @@ type ExecAction struct {
 	Args     []string `json:"args,omitempty"`
 }
 
+type HTTPAction struct {
+	Port    string       `json:"port"`
+	Host    string       `json:"host,omitempty"`
+	Scheme  string       `json:"scheme,omitempty"`
+	Path    string       `json:"path,omitempty"`
+	Method  string       `json:"method,omitempty"`
+	Body    string       `json:"body,omitempty"`
+	Headers []HTTPHeader `json:"headers,omitempty"`
+}
+
+type HTTPHeader struct {
+	Name  string `json:"name"`
+	Value string `json:"value"`
+}
+
+type GRPCAction struct {
+	Port     string            `json:"port"`
+	Host     string            `json:"host,omitempty"`
+	Service  string            `json:"service"`
+	Method   string            `json:"method"`
+	Request  map[string]string `json:"request,omitempty"`
+	Response GRPCResponse      `json:"response,omitempty"`
+}
+type GRPCResponse struct {
+	Status  string `json:"status,omitempty"`
+	Message string `json:"message,omitempty"`
+}
+
 type RetryPolicy struct {
 	MaxRetries    int           `json:"maxRetries,omitempty"`
 	RetryInterval time.Duration `json:"retryInterval,omitempty"`
diff --git a/pkg/kbagent/service/action.go b/pkg/kbagent/service/action.go
index db5a5d81e..e87aff748 100644
--- a/pkg/kbagent/service/action.go
+++ b/pkg/kbagent/service/action.go
@@ -57,7 +57,7 @@ type actionService struct {
 }
 
 type runningAction struct {
-	resultChan chan *commandResult
+	resultChan chan *asyncResult
 }
 
 var _ Service = &actionService{}
@@ -113,34 +113,30 @@ func (s *actionService) encode(out []byte, err error) []byte {
 }
 
 func (s *actionService) handleRequest(ctx context.Context, req *proto.ActionRequest) ([]byte, error) {
-	if _, ok := s.actions[req.Action]; !ok {
+	action, ok := s.actions[req.Action]
+	if !ok {
 		return nil, errors.Wrapf(proto.ErrNotDefined, "%s is not defined", req.Action)
 	}
-	action := s.actions[req.Action]
-	if action.Exec == nil {
-		return nil, errors.Wrap(proto.ErrNotImplemented, "only exec action is supported")
+	if action.Exec == nil && action.HTTP == nil && action.GRPC == nil {
+		return nil, errors.Wrapf(proto.ErrBadRequest, "%s is invalid", req.Action)
 	}
 	// HACK: pre-check for the reconfigure action
 	if err := checkReconfigure(ctx, req); err != nil {
 		return nil, err
 	}
-	return s.handleExecAction(ctx, req, action)
-}
-
-func (s *actionService) handleExecAction(ctx context.Context, req *proto.ActionRequest, action *proto.Action) ([]byte, error) {
 	if req.NonBlocking == nil || !*req.NonBlocking {
-		return runCommand(ctx, action.Exec, req.Parameters, req.TimeoutSeconds)
+		return blockingCallAction(ctx, action, req.Parameters, req.TimeoutSeconds)
 	}
-	return s.handleExecActionNonBlocking(ctx, req, action)
+	return s.handleRequestNonBlocking(ctx, req, action)
 }
 
-func (s *actionService) handleExecActionNonBlocking(ctx context.Context, req *proto.ActionRequest, action *proto.Action) ([]byte, error) {
+func (s *actionService) handleRequestNonBlocking(ctx context.Context, req *proto.ActionRequest, action *proto.Action) ([]byte, error) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
 	running, ok := s.runningActions[req.Action]
 	if !ok {
-		resultChan, err := runCommandNonBlocking(ctx, action.Exec, req.Parameters, req.TimeoutSeconds)
+		resultChan, err := nonBlockingCallAction(ctx, action, req.Parameters, req.TimeoutSeconds)
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/kbagent/service/action_utils.go b/pkg/kbagent/service/action_utils.go
new file mode 100644
index 000000000..dcac94c9a
--- /dev/null
+++ b/pkg/kbagent/service/action_utils.go
@@ -0,0 +1,614 @@
+/*
+Copyright (C) 2022-2025 ApeCloud Co., Ltd
+
+This file is part of KubeBlocks project
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+package service
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"maps"
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+	"sync"
+	"text/template"
+	"time"
+
+	"github.com/Masterminds/sprig/v3"
+	"github.com/pkg/errors"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/reflection/grpc_reflection_v1"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/reflect/protodesc"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/types/descriptorpb"
+	"google.golang.org/protobuf/types/dynamicpb"
+
+	kbaproto "github.com/apecloud/kubeblocks/pkg/kbagent/proto"
+	"github.com/apecloud/kubeblocks/pkg/kbagent/util"
+)
+
+const (
+	defaultBufferSize = 4096
+
+	defaultConnectTimeout            = 5 * time.Second
+	defaultKeepAliveTimeout          = 30 * time.Second
+	defaultIdleConnTimeout           = 90 * time.Second
+	defaultMaxIdleConnections        = 100
+	defaultMaxIdleConnectionsPerHost = 20
+
+	defaultActionCallTimeout = 30 * time.Second
+	maxActionCallTimeout     = 60 * time.Second
+
+	defaultHTTPHost   = "127.0.0.1"
+	defaultHTTPScheme = "HTTP"
+	defaultHTTPMethod = "GET"
+	defaultHTTPPath   = "/"
+)
+
+var (
+	clientCache sync.Map // map[string]<*http.Client|*grpc.ClientConn>
+
+	defaultHTTPTransport = &http.Transport{
+		DialContext: (&net.Dialer{
+			Timeout:   defaultConnectTimeout,
+			KeepAlive: defaultKeepAliveTimeout,
+		}).DialContext,
+		TLSHandshakeTimeout: defaultConnectTimeout,
+		IdleConnTimeout:     defaultIdleConnTimeout,
+		MaxIdleConns:        defaultMaxIdleConnections,
+		MaxIdleConnsPerHost: defaultMaxIdleConnectionsPerHost,
+	}
+)
+
+func gather[T interface{}](ch chan T) *T {
+	select {
+	case v, ok := <-ch:
+		if !ok {
+			return nil
+		}
+		return &v
+	default:
+		return nil
+	}
+}
+
+type asyncResult struct {
+	err    error
+	stdout *bytes.Buffer
+	stderr *bytes.Buffer
+}
+
+func blockingCallAction(ctx context.Context, action *kbaproto.Action, parameters map[string]string, timeout *int32) ([]byte, error) {
+	resultChan, err := nonBlockingCallAction(ctx, action, parameters, timeout)
+	if err != nil {
+		return nil, err
+	}
+	result := <-resultChan
+	err = result.err
+	if err != nil {
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
+			errMsg := fmt.Sprintf("exit code: %d", exitErr.ExitCode())
+			if stderrMsg := result.stderr.String(); len(stderrMsg) > 0 {
+				errMsg += fmt.Sprintf(", stderr: %s", stderrMsg)
+			}
+			return nil, errors.Wrapf(kbaproto.ErrFailed, errMsg)
+		}
+		if errMsg := result.stderr.String(); len(errMsg) > 0 {
+			return nil, errors.Wrapf(err, errMsg)
+		}
+		return nil, err
+	}
+	return result.stdout.Bytes(), nil
+}
+
+func nonBlockingCallAction(ctx context.Context, action *kbaproto.Action, parameters map[string]string, timeout *int32) (chan *asyncResult, error) {
+	stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+	stderrBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+	execErrorChan, err := nonBlockingCallActionX(ctx, action, parameters, timeout, nil, stdoutBuf, stderrBuf)
+	if err != nil {
+		return nil, err
+	}
+	resultChan := make(chan *asyncResult, 1)
+	go func() {
+		// wait for the call to finish
+		execErr, ok := <-execErrorChan
+		if !ok {
+			execErr = errors.New("runtime error: error chan closed unexpectedly")
+		}
+		resultChan <- &asyncResult{
+			err:    execErr,
+			stdout: stdoutBuf,
+			stderr: stderrBuf,
+		}
+	}()
+	return resultChan, nil
+}
+
+func nonBlockingCallActionX(ctx context.Context, action *kbaproto.Action, parameters map[string]string, timeout *int32,
+	stdinReader io.Reader, stdoutWriter, stderrWriter io.Writer) (chan error, error) {
+	var cancel context.CancelFunc
+	if timeout == nil {
+		ctx, cancel = context.WithTimeout(ctx, defaultActionCallTimeout)
+	} else if *timeout > 0 {
+		ctx, cancel = context.WithTimeout(ctx, min(time.Duration(*timeout)*time.Second, maxActionCallTimeout))
+	}
+
+	var err error
+	errChan := make(chan error, 1)
+	switch {
+	case action.Exec != nil:
+		err = execActionCallX(ctx, cancel, action.Exec, parameters, errChan, stdinReader, stdoutWriter, stderrWriter)
+	case action.HTTP != nil:
+		err = httpActionCallX(ctx, cancel, action.HTTP, parameters, errChan, stdinReader, stdoutWriter, stderrWriter)
+	case action.GRPC != nil:
+		err = grpcActionCallX(ctx, cancel, action.GRPC, parameters, errChan, stdinReader, stdoutWriter, stderrWriter)
+	default:
+		cancel() // cancel the context to release the resources
+		err = errors.Wrapf(kbaproto.ErrBadRequest, "invalid action type")
+	}
+	if err != nil {
+		return nil, err
+	}
+	return errChan, nil
+}
+
+func execActionCallX(ctx context.Context, cancel context.CancelFunc,
+	action *kbaproto.ExecAction, parameters map[string]string, errChan chan error, stdinReader io.Reader, stdoutWriter, stderrWriter io.Writer) error {
+	mergedArgs := func() []string {
+		args := make([]string, 0)
+		if len(action.Commands) > 1 {
+			args = append(args, action.Commands[1:]...)
+		}
+		args = append(args, action.Args...)
+		return args
+	}()
+
+	mergedEnv := func() []string {
+		// order: parameters (action specific variables) | var | action env
+		filterDuplicates := func(osEnv []string, filter func(string) bool) []string {
+			unionEnv := make([]string, 0, len(osEnv))
+			for _, e := range osEnv {
+				if filter(e) {
+					unionEnv = append(unionEnv, e)
+				}
+			}
+			return unionEnv
+		}
+		env := append(util.EnvM2L(parameters), filterDuplicates(os.Environ(), func(env string) bool {
+			kv := strings.Split(env, "=")
+			_, ok := parameters[kv[0]]
+			return !ok
+		})...)
+		return env
+	}()
+
+	cmd := exec.CommandContext(ctx, action.Commands[0], mergedArgs...)
+	if len(mergedEnv) > 0 {
+		cmd.Env = mergedEnv
+	}
+
+	cmd.Stdin = stdinReader
+	cmd.Stdout = stdoutWriter
+	cmd.Stderr = stderrWriter
+
+	go func() {
+		defer cancel()
+		defer close(errChan)
+
+		if err := cmd.Start(); err != nil {
+			if errors.Is(ctx.Err(), context.DeadlineExceeded) {
+				errChan <- kbaproto.ErrTimedOut
+			} else {
+				errChan <- errors.Wrapf(kbaproto.ErrFailed, "failed to start command: %v", err)
+			}
+			return
+		}
+
+		execErr := cmd.Wait()
+		if execErr != nil {
+			if errors.Is(ctx.Err(), context.DeadlineExceeded) {
+				execErr = kbaproto.ErrTimedOut
+			}
+		}
+		errChan <- execErr
+	}()
+
+	return nil
+}
+
+func httpActionCallX(ctx context.Context, cancel context.CancelFunc,
+	action *kbaproto.HTTPAction, parameters map[string]string, errChan chan error, _ io.Reader, stdoutWriter, stderrWriter io.Writer) error {
+	var (
+		// TODO: resolve the port
+		cli         = httpClient()
+		method, url = httpActionMethodNURL(action)
+	)
+	body, err1 := renderTemplateData("http body", parameters, action.Body)
+	if err1 != nil {
+		return err1
+	}
+	req, err2 := http.NewRequestWithContext(ctx, method, url, strings.NewReader(body))
+	if err2 != nil {
+		return err2
+	}
+
+	for _, h := range action.Headers {
+		val, err3 := renderTemplateData("http header", parameters, h.Value)
+		if err3 != nil {
+			return err3
+		}
+		req.Header.Add(h.Name, val)
+	}
+
+	go func() {
+		defer cancel()
+		defer close(errChan)
+
+		handleError := func(err error, msg string) {
+			if errors.Is(ctx.Err(), context.DeadlineExceeded) {
+				errChan <- kbaproto.ErrTimedOut
+			} else {
+				errChan <- errors.Wrapf(kbaproto.ErrFailed, "%s: %v", msg, err)
+			}
+		}
+
+		rsp, err4 := cli.Do(req)
+		if err4 != nil {
+			handleError(err4, "failed to issue http request")
+			return
+		}
+		defer safeClose(rsp.Body)
+
+		output, err5 := io.ReadAll(rsp.Body)
+		if err5 != nil {
+			handleError(err5, "failed to read http response")
+			return
+		}
+
+		succeed := rsp.StatusCode >= 200 && rsp.StatusCode < 300
+		if succeed {
+			if len(output) > 0 && stdoutWriter != nil {
+				_, err6 := stdoutWriter.Write(output)
+				if err6 != nil {
+					handleError(err6, "failed to write http response")
+					return
+				}
+			}
+			errChan <- nil
+		} else {
+			if len(output) > 0 && stderrWriter != nil {
+				_, err7 := stderrWriter.Write(output)
+				if err7 != nil {
+					handleError(err7, "failed to write http response")
+					return
+				}
+			}
+			errChan <- errors.Wrapf(kbaproto.ErrFailed, "http request failed, status: %s", rsp.Status)
+		}
+	}()
+
+	return nil
+}
+
+func httpClient() *http.Client {
+	key := "http"
+	if v, ok := clientCache.Load(key); ok {
+		return v.(*http.Client)
+	}
+	cli, _ := clientCache.LoadOrStore(key, &http.Client{
+		Transport: defaultHTTPTransport,
+	})
+	return cli.(*http.Client)
+}
+
+func httpActionMethodNURL(action *kbaproto.HTTPAction) (string, string) {
+	host, scheme, method, path := defaultHTTPHost, defaultHTTPScheme, defaultHTTPMethod, defaultHTTPPath
+	if len(action.Host) > 0 {
+		host = action.Host
+	}
+	if len(action.Scheme) > 0 {
+		scheme = action.Scheme
+	}
+	if len(action.Method) > 0 {
+		method = action.Method
+	}
+	if len(action.Path) > 0 {
+		path = action.Path
+	}
+	return method, fmt.Sprintf("%s://%s:%s%s", scheme, host, action.Port, path)
+}
+
+func grpcActionCallX(ctx context.Context, cancel context.CancelFunc,
+	action *kbaproto.GRPCAction, parameters map[string]string, errChan chan error, _ io.Reader, stdoutWriter, stderrWriter io.Writer) error {
+	host := defaultHTTPHost
+	if len(action.Host) > 0 {
+		host = action.Host
+	}
+	// TODO: resolve the port
+	conn, err := grpcClientConnection(ctx, host, action.Port)
+	if err != nil {
+		return err
+	}
+
+	methodDesc, err := getGRPCMethodDescriptor(ctx, conn, action.Service, action.Method)
+	if err != nil {
+		return fmt.Errorf("failed to get grpc method descriptor: %v", err)
+	}
+
+	reqMsg := dynamicpb.NewMessage(methodDesc.Input())
+	for k, v := range action.Request {
+		vv, err1 := renderTemplateData("grpc", parameters, v)
+		if err1 != nil {
+			return err1
+		}
+		if err = setGRPCMessageField(reqMsg, k, vv); err != nil {
+			return err
+		}
+	}
+
+	go func() {
+		defer cancel()
+		defer close(errChan)
+
+		handleError := func(err error, msg string) {
+			if errors.Is(ctx.Err(), context.DeadlineExceeded) {
+				errChan <- kbaproto.ErrTimedOut
+			} else {
+				errChan <- errors.Wrapf(kbaproto.ErrFailed, "%s: %v", msg, err)
+			}
+		}
+
+		method := fmt.Sprintf("/%s/%s", action.Service, action.Method)
+		rspMsg := dynamicpb.NewMessage(methodDesc.Output())
+		err1 := conn.Invoke(ctx, method, reqMsg, rspMsg)
+		if err1 != nil {
+			handleError(err1, "failed to issue grpc request")
+			return
+		}
+
+		var (
+			status, output string
+			err2, err3     error
+		)
+		if len(action.Response.Status) > 0 {
+			status, err2 = getGRPCMessageField(rspMsg, action.Response.Status)
+			if err2 != nil {
+				handleError(err2, "failed to decode `Status` from grpc response")
+				return
+			}
+		}
+		if len(action.Response.Message) > 0 {
+			output, err3 = getGRPCMessageField(rspMsg, action.Response.Message)
+			if err3 != nil {
+				handleError(err3, "failed to decode `Message` from grpc response")
+				return
+			}
+		}
+
+		if len(status) > 0 {
+			if len(output) > 0 && stderrWriter != nil {
+				_, _ = stderrWriter.Write([]byte(output))
+			}
+			errChan <- errors.Wrapf(kbaproto.ErrFailed, "grpc call failed: %s", status)
+		} else {
+			if len(output) > 0 && stdoutWriter != nil {
+				_, _ = stdoutWriter.Write([]byte(output))
+			}
+			errChan <- nil
+		}
+	}()
+
+	return nil
+}
+
+func grpcClientConnection(ctx context.Context, host, port string) (*grpc.ClientConn, error) {
+	remote := fmt.Sprintf("%s:%s", host, port)
+	key := fmt.Sprintf("grpc://%s", remote)
+	if v, ok := clientCache.Load(key); ok {
+		return v.(*grpc.ClientConn), nil
+	}
+
+	conn, err := grpc.DialContext(ctx, remote,
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		grpc.WithBlock(),
+		grpc.WithDefaultCallOptions(
+			grpc.MaxCallRecvMsgSize(16*1024*1024),
+		),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	actual, loaded := clientCache.LoadOrStore(key, conn)
+	if loaded {
+		_ = conn.Close()
+		return actual.(*grpc.ClientConn), nil
+	}
+	return conn, nil
+}
+
+func getGRPCMethodDescriptor(ctx context.Context, conn *grpc.ClientConn, serviceName, methodName string) (protoreflect.MethodDescriptor, error) {
+	cli := grpc_reflection_v1.NewServerReflectionClient(conn)
+	stream, err := cli.ServerReflectionInfo(ctx, grpc.WaitForReady(true))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create reflection stream: %w", err)
+	}
+	defer safeCloseF(stream.CloseSend)
+
+	if err = stream.Send(&grpc_reflection_v1.ServerReflectionRequest{
+		MessageRequest: &grpc_reflection_v1.ServerReflectionRequest_ListServices{},
+	}); err != nil {
+		return nil, fmt.Errorf("failed to send list services request: %w", err)
+	}
+
+	if err = stream.Send(&grpc_reflection_v1.ServerReflectionRequest{
+		MessageRequest: &grpc_reflection_v1.ServerReflectionRequest_FileContainingSymbol{
+			FileContainingSymbol: fmt.Sprintf("%s.%s", serviceName, methodName),
+		},
+	}); err != nil {
+		return nil, fmt.Errorf("failed to send file request: %w", err)
+	}
+
+	for {
+		rsp, err := stream.Recv()
+		if err != nil {
+			return nil, fmt.Errorf("reflection recv error: %w", err)
+		}
+		switch m := rsp.MessageResponse.(type) {
+		case *grpc_reflection_v1.ServerReflectionResponse_FileDescriptorResponse:
+			files, err := decodeGRPCFileDescriptors(m.FileDescriptorResponse.GetFileDescriptorProto())
+			if err != nil {
+				return nil, err
+			}
+			for _, fd := range files {
+				for i := 0; i < fd.Services().Len(); i++ {
+					svc := fd.Services().Get(i)
+					if string(svc.FullName()) == serviceName {
+						for j := 0; j < svc.Methods().Len(); j++ {
+							method := svc.Methods().Get(j)
+							if string(method.Name()) == methodName {
+								return method, nil
+							}
+						}
+					}
+				}
+			}
+			return nil, fmt.Errorf("grpc method %s not found in service %s", methodName, serviceName)
+		default:
+			// suppress the singleCaseSwitch warning
+		}
+	}
+}
+
+func decodeGRPCFileDescriptors(descBytes [][]byte) ([]protoreflect.FileDescriptor, error) {
+	var result []protoreflect.FileDescriptor
+	for _, b := range descBytes {
+		fdProto := &descriptorpb.FileDescriptorProto{}
+		if err := proto.Unmarshal(b, fdProto); err != nil {
+			return nil, err
+		}
+		fd, err := protodesc.NewFile(fdProto, nil)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, fd)
+	}
+	return result, nil
+}
+
+func setGRPCMessageField(msg *dynamicpb.Message, fieldName, value string) error {
+	field := msg.Descriptor().Fields().ByTextName(fieldName)
+	if field == nil {
+		return fmt.Errorf("field %s not found", fieldName)
+	}
+
+	var val protoreflect.Value
+	switch field.Kind() {
+	case protoreflect.StringKind:
+		val = protoreflect.ValueOfString(value)
+	case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind:
+		i, err := strconv.ParseInt(value, 10, 32)
+		if err != nil {
+			return err
+		}
+		val = protoreflect.ValueOfInt32(int32(i))
+	case protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind:
+		i, err := strconv.ParseInt(value, 10, 64)
+		if err != nil {
+			return err
+		}
+		val = protoreflect.ValueOfInt64(i)
+	case protoreflect.BoolKind:
+		b, err := strconv.ParseBool(value)
+		if err != nil {
+			return err
+		}
+		val = protoreflect.ValueOfBool(b)
+	default:
+		return fmt.Errorf("unsupported field type: %s", field.Kind())
+	}
+
+	msg.Set(field, val)
+	return nil
+}
+
+func getGRPCMessageField(msg *dynamicpb.Message, fieldName string) (string, error) {
+	field := msg.Descriptor().Fields().ByTextName(fieldName)
+	if field == nil {
+		return "", fmt.Errorf("field %s not found", fieldName)
+	}
+
+	val := msg.Get(field)
+	if !val.IsValid() {
+		return "", fmt.Errorf("invalid value for field %s", fieldName)
+	}
+
+	switch field.Kind() {
+	case protoreflect.StringKind:
+		return val.String(), nil
+	case protoreflect.Int32Kind, protoreflect.Sint32Kind, protoreflect.Sfixed32Kind:
+		return fmt.Sprintf("%d", val.Int()), nil
+	case protoreflect.Int64Kind, protoreflect.Sint64Kind, protoreflect.Sfixed64Kind:
+		return fmt.Sprintf("%d", val.Int()), nil
+	case protoreflect.BoolKind:
+		return fmt.Sprintf("%v", val.Bool()), nil
+	default:
+		return "", fmt.Errorf("unsupported field type: %s", field.Kind())
+	}
+}
+
+func safeClose(c io.Closer) { _ = c.Close() }
+
+func safeCloseF(c func() error) { _ = c() }
+
+func renderTemplateData(action string, parameters map[string]string, data string) (string, error) {
+	if len(data) == 0 {
+		return "", nil
+	}
+	tpl := template.New(action).Option("missingkey=error").Funcs(sprig.TxtFuncMap())
+	ptpl, err := tpl.Parse(data)
+	if err != nil {
+		return "", err
+	}
+	var buf strings.Builder
+	if err = ptpl.Execute(&buf, mergeEnvWith(parameters)); err != nil {
+		return "", err
+	}
+	return buf.String(), nil
+}
+
+func mergeEnvWith(parameters map[string]string) map[string]string {
+	result := make(map[string]string)
+	maps.Copy(result, parameters)
+	for _, e := range os.Environ() {
+		kv := strings.Split(e, "=")
+		if _, ok := result[kv[0]]; !ok {
+			result[kv[0]] = kv[1]
+		}
+	}
+	return result
+}
diff --git a/pkg/kbagent/service/command.go b/pkg/kbagent/service/command.go
deleted file mode 100644
index 216cf525b..000000000
--- a/pkg/kbagent/service/command.go
+++ /dev/null
@@ -1,176 +0,0 @@
-/*
-Copyright (C) 2022-2025 ApeCloud Co., Ltd
-
-This file is part of KubeBlocks project
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-package service
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"os"
-	"os/exec"
-	"strings"
-	"time"
-
-	"github.com/pkg/errors"
-
-	"github.com/apecloud/kubeblocks/pkg/kbagent/proto"
-	"github.com/apecloud/kubeblocks/pkg/kbagent/util"
-)
-
-const (
-	defaultBufferSize = 4096
-)
-
-type commandResult struct {
-	err    error
-	stdout *bytes.Buffer
-	stderr *bytes.Buffer
-}
-
-func gather[T interface{}](ch chan T) *T {
-	select {
-	case v, ok := <-ch:
-		if !ok {
-			return nil
-		}
-		return &v
-	default:
-		return nil
-	}
-}
-
-func runCommand(ctx context.Context, action *proto.ExecAction, parameters map[string]string, timeout *int32) ([]byte, error) {
-	resultChan, err := runCommandNonBlocking(ctx, action, parameters, timeout)
-	if err != nil {
-		return nil, err
-	}
-	result := <-resultChan
-	err = result.err
-	if err != nil {
-		var exitErr *exec.ExitError
-		if errors.As(err, &exitErr) {
-			errMsg := fmt.Sprintf("exit code: %d", exitErr.ExitCode())
-			if stderrMsg := result.stderr.String(); len(stderrMsg) > 0 {
-				errMsg += fmt.Sprintf(", stderr: %s", stderrMsg)
-			}
-			return nil, errors.Wrapf(proto.ErrFailed, errMsg)
-		}
-		return nil, err
-	}
-	return result.stdout.Bytes(), nil
-}
-
-func runCommandNonBlocking(ctx context.Context, action *proto.ExecAction, parameters map[string]string, timeout *int32) (chan *commandResult, error) {
-	stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
-	stderrBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
-	execErrorChan, err := runCommandX(ctx, action, parameters, timeout, nil, stdoutBuf, stderrBuf)
-	if err != nil {
-		return nil, err
-	}
-	resultChan := make(chan *commandResult, 1)
-	go func() {
-		// wait for the command to finish
-		execErr, ok := <-execErrorChan
-		if !ok {
-			execErr = errors.New("runtime error: error chan closed unexpectedly")
-		}
-		resultChan <- &commandResult{
-			err:    execErr,
-			stdout: stdoutBuf,
-			stderr: stderrBuf,
-		}
-	}()
-	return resultChan, nil
-}
-
-func runCommandX(ctx context.Context, action *proto.ExecAction, parameters map[string]string, timeout *int32,
-	stdinReader io.Reader, stdoutWriter, stderrWriter io.Writer) (chan error, error) {
-	var timeoutCancel context.CancelFunc
-	if timeout != nil && *timeout > 0 {
-		ctx, timeoutCancel = context.WithTimeout(ctx, time.Duration(*timeout)*time.Second)
-	}
-	cancelTimeout := func() {
-		if timeoutCancel != nil {
-			timeoutCancel()
-		}
-	}
-
-	mergedArgs := func() []string {
-		args := make([]string, 0)
-		if len(action.Commands) > 1 {
-			args = append(args, action.Commands[1:]...)
-		}
-		args = append(args, action.Args...)
-		return args
-	}()
-
-	mergedEnv := func() []string {
-		// order: parameters (action specific variables) | var | action env
-		filterDuplicates := func(osEnv []string, filter func(string) bool) []string {
-			unionEnv := make([]string, 0, len(osEnv))
-			for _, e := range osEnv {
-				if filter(e) {
-					unionEnv = append(unionEnv, e)
-				}
-			}
-			return unionEnv
-		}
-		env := append(util.EnvM2L(parameters), filterDuplicates(os.Environ(), func(env string) bool {
-			kv := strings.Split(env, "=")
-			_, ok := parameters[kv[0]]
-			return !ok
-		})...)
-		return env
-	}()
-
-	cmd := exec.CommandContext(ctx, action.Commands[0], mergedArgs...)
-	if len(mergedEnv) > 0 {
-		cmd.Env = mergedEnv
-	}
-
-	cmd.Stdin = stdinReader
-	cmd.Stdout = stdoutWriter
-	cmd.Stderr = stderrWriter
-
-	errChan := make(chan error, 1)
-	go func() {
-		defer cancelTimeout()
-		defer close(errChan)
-
-		if err := cmd.Start(); err != nil {
-			if errors.Is(ctx.Err(), context.DeadlineExceeded) {
-				errChan <- proto.ErrTimedOut
-			} else {
-				errChan <- errors.Wrapf(proto.ErrFailed, "failed to start command: %v", err)
-			}
-			return
-		}
-
-		execErr := cmd.Wait()
-		if execErr != nil {
-			if errors.Is(ctx.Err(), context.DeadlineExceeded) {
-				execErr = proto.ErrTimedOut
-			}
-		}
-		errChan <- execErr
-	}()
-	return errChan, nil
-}
diff --git a/pkg/kbagent/service/streaming.go b/pkg/kbagent/service/streaming.go
index a1245cd9c..77b7e7133 100644
--- a/pkg/kbagent/service/streaming.go
+++ b/pkg/kbagent/service/streaming.go
@@ -101,7 +101,7 @@ func (s *streamingService) handshake(ctx context.Context, conn net.Conn) (*proto
 }
 
 func (s *streamingService) streaming(ctx context.Context, conn net.Conn, action *proto.Action, req *proto.ActionRequest) error {
-	errChan, err1 := runCommandX(ctx, action.Exec, req.Parameters, req.TimeoutSeconds, nil, conn, nil)
+	errChan, err1 := nonBlockingCallActionX(ctx, action, req.Parameters, req.TimeoutSeconds, nil, conn, nil)
 	if err1 != nil {
 		return err1
 	}
diff --git a/pkg/kbagent/service/task_new_replica.go b/pkg/kbagent/service/task_new_replica.go
index 6786b25f6..2ab2cac59 100644
--- a/pkg/kbagent/service/task_new_replica.go
+++ b/pkg/kbagent/service/task_new_replica.go
@@ -59,7 +59,7 @@ func (s *newReplicaTask) run(ctx context.Context) (chan error, error) {
 		return nil, err
 	}
 
-	return runCommandX(ctx, action.Exec, s.task.Parameters, s.task.TimeoutSeconds, conn, nil, nil)
+	return nonBlockingCallActionX(ctx, action, s.task.Parameters, s.task.TimeoutSeconds, conn, nil, nil)
 }
 
 func (s *newReplicaTask) status(ctx context.Context, event *proto.TaskEvent) {



Test patch:
diff --git a/pkg/kbagent/service/action_utils_test.go b/pkg/kbagent/service/action_utils_test.go
new file mode 100644
index 000000000..752af062e
--- /dev/null
+++ b/pkg/kbagent/service/action_utils_test.go
@@ -0,0 +1,954 @@
+/*
+Copyright (C) 2022-2025 ApeCloud Co., Ltd
+
+This file is part of KubeBlocks project
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+package service
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+
+	"github.com/jhump/protoreflect/desc/protoparse"
+	"github.com/pkg/errors"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/reflection"
+	"google.golang.org/protobuf/reflect/protodesc"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/reflect/protoregistry"
+	"google.golang.org/protobuf/types/descriptorpb"
+	"google.golang.org/protobuf/types/dynamicpb"
+
+	"github.com/apecloud/kubeblocks/pkg/kbagent/proto"
+)
+
+var _ = Describe("action utils", func() {
+	wait := func(errChan chan error) {
+		Expect(errChan).ShouldNot(BeNil())
+		err, ok := <-errChan
+		Expect(ok).Should(BeTrue())
+		Expect(err).Should(BeNil())
+	}
+
+	waitError := func(errChan chan error) error {
+		Expect(errChan).ShouldNot(BeNil())
+		err, ok := <-errChan
+		Expect(ok).Should(BeTrue())
+		return err
+	}
+
+	Context("exec", func() {
+		It("x - ok", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "echo -n simple"},
+				},
+			}
+			execErrorChan, err := nonBlockingCallActionX(ctx, action, nil, nil, nil, nil, nil)
+			Expect(err).Should(BeNil())
+
+			wait(execErrorChan)
+		})
+
+		It("x - stdout", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "echo -n stdout"},
+				},
+			}
+			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			execErrorChan, err := nonBlockingCallActionX(ctx, action, nil, nil, nil, stdoutBuf, nil)
+			Expect(err).Should(BeNil())
+
+			wait(execErrorChan)
+			Expect(stdoutBuf.String()).Should(Equal("stdout"))
+		})
+
+		It("x - stderr", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "echo -n stderr >&2"},
+				},
+			}
+			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			stderrBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			execErrorChan, err := nonBlockingCallActionX(ctx, action, nil, nil, nil, stdoutBuf, stderrBuf)
+			Expect(err).Should(BeNil())
+
+			wait(execErrorChan)
+			Expect(stdoutBuf.String()).Should(HaveLen(0))
+			Expect(stderrBuf.String()).Should(Equal("stderr"))
+		})
+
+		It("x - stdin", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "xargs echo -n"},
+				},
+			}
+			stdinBuf := bytes.NewBuffer([]byte{'s', 't', 'd', 'i', 'n'})
+			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			execErrorChan, err := nonBlockingCallActionX(ctx, action, nil, nil, stdinBuf, stdoutBuf, nil)
+			Expect(err).Should(BeNil())
+
+			wait(execErrorChan)
+			Expect(stdoutBuf.String()).Should(Equal("stdin"))
+		})
+
+		It("x - parameters", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "echo -n $PARAM"},
+				},
+			}
+			parameters := map[string]string{
+				"PARAM":   "parameters",
+				"useless": "useless",
+			}
+			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			execErrorChan, err := nonBlockingCallActionX(ctx, action, parameters, nil, nil, stdoutBuf, nil)
+			Expect(err).Should(BeNil())
+
+			wait(execErrorChan)
+			Expect(stdoutBuf.String()).Should(Equal("parameters"))
+		})
+
+		It("x - timeout", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "sleep 3"},
+				},
+			}
+			timeout := int32(1)
+			execErrorChan, err := nonBlockingCallActionX(ctx, action, nil, &timeout, nil, nil, nil)
+			Expect(err).Should(BeNil())
+
+			err = waitError(execErrorChan)
+			Expect(err).ShouldNot(BeNil())
+			Expect(errors.Is(err, proto.ErrTimedOut)).Should(BeTrue())
+		})
+
+		It("x - timeout and stdout", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "sleep 3 && echo -n timeout"},
+				},
+			}
+			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			timeout := int32(1)
+			execErrorChan, err := nonBlockingCallActionX(ctx, action, nil, &timeout, nil, stdoutBuf, nil)
+			Expect(err).Should(BeNil())
+
+			err = waitError(execErrorChan)
+			Expect(err).ShouldNot(BeNil())
+			Expect(errors.Is(err, proto.ErrTimedOut)).Should(BeTrue())
+			Expect(stdoutBuf.String()).Should(HaveLen(0))
+		})
+
+		It("x - stdout and timeout", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "echo -n timeout && sleep 3"},
+				},
+			}
+			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			timeout := int32(1)
+			execErrorChan, err := nonBlockingCallActionX(ctx, action, nil, &timeout, nil, stdoutBuf, nil)
+			Expect(err).Should(BeNil())
+
+			err = waitError(execErrorChan)
+			Expect(err).ShouldNot(BeNil())
+			Expect(errors.Is(err, proto.ErrTimedOut)).Should(BeTrue())
+			Expect(stdoutBuf.String()).Should(Equal("timeout"))
+		})
+
+		It("x - fail", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "command-not-exist"},
+				},
+			}
+			execErrorChan, err := nonBlockingCallActionX(ctx, action, nil, nil, nil, nil, nil)
+			Expect(err).Should(BeNil())
+
+			err = waitError(execErrorChan)
+			Expect(err).ShouldNot(BeNil())
+			var exitErr *exec.ExitError
+			Expect(errors.As(err, &exitErr)).Should(BeTrue())
+		})
+
+		It("x - fail with stderr writer", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "command-not-found"},
+				},
+			}
+			stderrBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			execErrorChan, err := nonBlockingCallActionX(ctx, action, nil, nil, nil, nil, stderrBuf)
+			Expect(err).Should(BeNil())
+
+			err = waitError(execErrorChan)
+			Expect(err).ShouldNot(BeNil())
+			var exitErr *exec.ExitError
+			Expect(errors.As(err, &exitErr)).Should(BeTrue())
+			Expect(stderrBuf.String()).Should(ContainSubstring("command not found"))
+		})
+
+		It("non-blocking - ok", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "echo -n ok"},
+				},
+			}
+			resultChan, err := nonBlockingCallAction(ctx, action, nil, nil)
+			Expect(err).Should(BeNil())
+
+			result := <-resultChan
+			Expect(result.err).Should(BeNil())
+			Expect(result.stdout.Bytes()).Should(Equal([]byte("ok")))
+			Expect(result.stderr.Bytes()).Should(HaveLen(0))
+		})
+
+		It("non-blocking - parameters", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "echo -n $PARAM"},
+				},
+			}
+			parameters := map[string]string{
+				"PARAM": "parameters",
+			}
+			resultChan, err := nonBlockingCallAction(ctx, action, parameters, nil)
+			Expect(err).Should(BeNil())
+
+			result := <-resultChan
+			Expect(result.err).Should(BeNil())
+			Expect(result.stdout.Bytes()).Should(Equal([]byte("parameters")))
+			Expect(result.stderr.Bytes()).Should(HaveLen(0))
+		})
+
+		It("non-blocking - fail", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "command-not-found"},
+				},
+			}
+			resultChan, err := nonBlockingCallAction(ctx, action, nil, nil)
+			Expect(err).Should(BeNil())
+
+			result := <-resultChan
+			Expect(result.err).ShouldNot(BeNil())
+			var exitErr *exec.ExitError
+			Expect(errors.As(result.err, &exitErr)).Should(BeTrue())
+			Expect(result.stdout.Bytes()).Should(HaveLen(0))
+			Expect(result.stderr.Bytes()).Should(ContainSubstring("command not found"))
+		})
+
+		It("non-blocking - timeout", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "sleep 3"},
+				},
+			}
+			timeout := int32(1)
+			resultChan, err := nonBlockingCallAction(ctx, action, nil, &timeout)
+			Expect(err).Should(BeNil())
+
+			result := <-resultChan
+			Expect(result.err).ShouldNot(BeNil())
+			Expect(errors.Is(result.err, proto.ErrTimedOut)).Should(BeTrue())
+			Expect(result.stdout.Bytes()).Should(HaveLen(0))
+			Expect(result.stderr.Bytes()).Should(HaveLen(0))
+		})
+
+		It("blocking - ok", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "echo -n ok"},
+				},
+			}
+			output, err := blockingCallAction(ctx, action, nil, nil)
+			Expect(err).Should(BeNil())
+			Expect(output).Should(Equal([]byte("ok")))
+		})
+
+		It("blocking - parameters", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "echo -n $PARAM"},
+				},
+			}
+			parameters := map[string]string{
+				"PARAM": "parameters",
+			}
+			output, err := blockingCallAction(ctx, action, parameters, nil)
+			Expect(err).Should(BeNil())
+			Expect(output).Should(Equal([]byte("parameters")))
+		})
+
+		It("blocking - fail", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "command-not-found"},
+				},
+			}
+			output, err := blockingCallAction(ctx, action, nil, nil)
+			Expect(err).ShouldNot(BeNil())
+			Expect(errors.Is(err, proto.ErrFailed)).Should(BeTrue())
+			Expect(err.Error()).Should(ContainSubstring("command not found"))
+			Expect(output).Should(BeNil())
+		})
+
+		It("blocking - timeout", func() {
+			action := &proto.Action{
+				Exec: &proto.ExecAction{
+					Commands: []string{"/bin/bash", "-c", "sleep 3"},
+				},
+			}
+			timeout := int32(1)
+			output, err := blockingCallAction(ctx, action, nil, &timeout)
+			Expect(err).ShouldNot(BeNil())
+			Expect(errors.Is(err, proto.ErrTimedOut)).Should(BeTrue())
+			Expect(output).Should(BeNil())
+		})
+	})
+
+	Context("http", func() {
+		var (
+			server *httptest.Server
+			port   string
+		)
+
+		BeforeEach(func() {
+			server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.Header.Get("statusCode") != "" {
+					statusCode, _ := strconv.Atoi(r.Header.Get("statusCode"))
+					w.WriteHeader(statusCode)
+				}
+				body, _ := io.ReadAll(r.Body)
+				if len(body) > 0 {
+					_, _ = w.Write(body)
+				}
+			}))
+			url, _ := url.Parse(server.URL)
+			_, port, _ = net.SplitHostPort(url.Host)
+		})
+
+		AfterEach(func() {
+			server.Close()
+		})
+
+		It("x - ok", func() {
+			action := &proto.Action{
+				HTTP: &proto.HTTPAction{
+					Port: port,
+					Path: "/echo",
+				},
+			}
+			errChan, err := nonBlockingCallActionX(ctx, action, nil, nil, nil, nil, nil)
+			Expect(err).Should(BeNil())
+
+			wait(errChan)
+		})
+
+		It("x - stdout", func() {
+			action := &proto.Action{
+				HTTP: &proto.HTTPAction{
+					Port: port,
+					Path: "/echo",
+					Body: "stdout",
+				},
+			}
+			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			errChan, err := nonBlockingCallActionX(ctx, action, nil, nil, nil, stdoutBuf, nil)
+			Expect(err).Should(BeNil())
+
+			wait(errChan)
+			Expect(stdoutBuf.String()).Should(Equal("stdout"))
+		})
+
+		It("x - stderr", func() {
+			action := &proto.Action{
+				HTTP: &proto.HTTPAction{
+					Port: port,
+					Path: "/echo",
+					Body: "stderr",
+					Headers: []proto.HTTPHeader{
+						{
+							Name:  "statusCode",
+							Value: strconv.Itoa(http.StatusInternalServerError),
+						},
+					},
+				},
+			}
+			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			stderrBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			errChan, err := nonBlockingCallActionX(ctx, action, nil, nil, nil, stdoutBuf, stderrBuf)
+			Expect(err).Should(BeNil())
+
+			err = waitError(errChan)
+			Expect(err).ShouldNot(BeNil())
+			Expect(errors.Is(err, proto.ErrFailed)).Should(BeTrue())
+			Expect(stdoutBuf.String()).Should(HaveLen(0))
+			Expect(stderrBuf.String()).Should(Equal("stderr"))
+		})
+
+		It("x - parameters", func() {
+			action := &proto.Action{
+				HTTP: &proto.HTTPAction{
+					Port: port,
+					Path: "/echo",
+					Body: "{{ .PARAM }}",
+				},
+			}
+			parameters := map[string]string{
+				"PARAM":   "parameters",
+				"useless": "useless",
+			}
+			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			errChan, err := nonBlockingCallActionX(ctx, action, parameters, nil, nil, stdoutBuf, nil)
+			Expect(err).Should(BeNil())
+
+			wait(errChan)
+			Expect(stdoutBuf.String()).Should(Equal("parameters"))
+		})
+
+		It("non-blocking - ok", func() {
+			action := &proto.Action{
+				HTTP: &proto.HTTPAction{
+					Port: port,
+					Path: "/echo",
+					Body: "ok",
+				},
+			}
+			resultChan, err := nonBlockingCallAction(ctx, action, nil, nil)
+			Expect(err).Should(BeNil())
+
+			result := <-resultChan
+			Expect(result.err).Should(BeNil())
+			Expect(result.stdout.Bytes()).Should(Equal([]byte("ok")))
+			Expect(result.stderr.Bytes()).Should(HaveLen(0))
+		})
+
+		It("non-blocking - parameters", func() {
+			action := &proto.Action{
+				HTTP: &proto.HTTPAction{
+					Port: port,
+					Path: "/echo",
+					Body: "{{ .PARAM }}",
+				},
+			}
+			parameters := map[string]string{
+				"PARAM": "parameters",
+			}
+			resultChan, err := nonBlockingCallAction(ctx, action, parameters, nil)
+			Expect(err).Should(BeNil())
+
+			result := <-resultChan
+			Expect(result.err).Should(BeNil())
+			Expect(result.stdout.Bytes()).Should(Equal([]byte("parameters")))
+			Expect(result.stderr.Bytes()).Should(HaveLen(0))
+		})
+
+		It("non-blocking - fail", func() {
+			action := &proto.Action{
+				HTTP: &proto.HTTPAction{
+					Port: port,
+					Path: "/echo",
+					Body: "internal server error",
+					Headers: []proto.HTTPHeader{
+						{
+							Name:  "statusCode",
+							Value: strconv.Itoa(http.StatusInternalServerError),
+						},
+					},
+				},
+			}
+			resultChan, err := nonBlockingCallAction(ctx, action, nil, nil)
+			Expect(err).Should(BeNil())
+
+			result := <-resultChan
+			Expect(result.err).ShouldNot(BeNil())
+			Expect(errors.Is(result.err, proto.ErrFailed)).Should(BeTrue())
+			Expect(result.stdout.Bytes()).Should(HaveLen(0))
+			Expect(result.stderr.Bytes()).Should(ContainSubstring("internal server error"))
+		})
+
+		It("blocking - ok", func() {
+			action := &proto.Action{
+				HTTP: &proto.HTTPAction{
+					Port: port,
+					Path: "/echo",
+					Body: "ok",
+				},
+			}
+			output, err := blockingCallAction(ctx, action, nil, nil)
+			Expect(err).Should(BeNil())
+			Expect(output).Should(Equal([]byte("ok")))
+		})
+
+		It("blocking - parameters", func() {
+			action := &proto.Action{
+				HTTP: &proto.HTTPAction{
+					Port: port,
+					Path: "/echo",
+					Body: "{{ .PARAM }}",
+				},
+			}
+			parameters := map[string]string{
+				"PARAM": "parameters",
+			}
+			output, err := blockingCallAction(ctx, action, parameters, nil)
+			Expect(err).Should(BeNil())
+			Expect(output).Should(Equal([]byte("parameters")))
+		})
+
+		It("blocking - fail", func() {
+			action := &proto.Action{
+				HTTP: &proto.HTTPAction{
+					Port: port,
+					Path: "/echo",
+					Body: "internal server error",
+					Headers: []proto.HTTPHeader{
+						{
+							Name:  "statusCode",
+							Value: strconv.Itoa(http.StatusInternalServerError),
+						},
+					},
+				},
+			}
+			output, err := blockingCallAction(ctx, action, nil, nil)
+			Expect(err).ShouldNot(BeNil())
+			Expect(errors.Is(err, proto.ErrFailed)).Should(BeTrue())
+			Expect(err.Error()).Should(ContainSubstring("internal server error"))
+			Expect(output).Should(BeNil())
+		})
+	})
+
+	Context("grpc", func() {
+		const (
+			protoFilename = "echo.proto"
+			protoData     = `
+package test;
+
+service EchoService {
+  rpc Echo (EchoRequest) returns (EchoResponse);
+}
+
+message EchoRequest {
+  optional bool success = 1;
+  optional string message = 2;
+}
+
+message EchoResponse {
+  optional string status  = 1;
+  optional string message = 2;
+}
+`
+		)
+		var (
+			host, port string
+			cleanup    func()
+		)
+
+		startDynamicGRPCServer := func(filename, src string) (host, port string, cleanup func()) {
+			// parse the proto
+			parser := &protoparse.Parser{
+				Accessor: func(name string) (io.ReadCloser, error) {
+					if name == filename {
+						return io.NopCloser(strings.NewReader(src)), nil
+					}
+					return nil, fmt.Errorf("unexpected proto import: %s", name)
+				},
+			}
+			files, err := parser.ParseFiles(filename)
+			Expect(err).NotTo(HaveOccurred(), "failed to parse proto")
+			Expect(files).To(HaveLen(1), fmt.Sprintf("expect 1 file descriptor, got %d", len(files)))
+
+			fd := files[0]
+			fdp := fd.AsFileDescriptorProto()
+			fileset := &descriptorpb.FileDescriptorSet{
+				File: []*descriptorpb.FileDescriptorProto{fdp},
+			}
+			gfiles, err := protodesc.NewFiles(fileset)
+			Expect(err).NotTo(HaveOccurred(), "protodesc.NewFiles failed")
+			// ignore registration conflict
+			_ = os.Setenv("GOLANG_PROTOBUF_REGISTRATION_CONFLICT", "ignore")
+			gfiles.RangeFiles(func(fd protoreflect.FileDescriptor) bool {
+				_ = protoregistry.GlobalFiles.RegisterFile(fd)
+				return true
+			})
+
+			services := fd.GetServices()
+			Expect(services).To(HaveLen(1), "no service found in proto")
+
+			svc := services[0]
+			Expect(svc.GetFile().GetPackage()).Should(Equal("test"))
+			Expect(svc.GetName()).Should(Equal("EchoService"))
+
+			method := svc.FindMethodByName("Echo")
+			Expect(method).ShouldNot(BeNil(), "method Echo not found")
+
+			fullName := protoreflect.FullName(fmt.Sprintf("%s.%s", svc.GetFile().GetPackage(), svc.GetName()))
+			d, err := protoregistry.GlobalFiles.FindDescriptorByName(fullName)
+			Expect(err).ShouldNot(HaveOccurred(), fmt.Sprintf("FindDescriptorByName(%s) failed", fullName))
+
+			svcDesc := d.(protoreflect.ServiceDescriptor)
+			mDesc := svcDesc.Methods().ByName("Echo")
+			Expect(mDesc).ShouldNot(BeNil(), "method Echo not found via protoregistry")
+
+			inDesc := mDesc.Input()
+			outDesc := mDesc.Output()
+			unaryHandler := func(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+				in := dynamicpb.NewMessage(inDesc)
+				if err := dec(in); err != nil {
+					return nil, err
+				}
+				successField := inDesc.Fields().ByName("success")
+				reqSuccess := in.Get(successField).Bool()
+				msgField := inDesc.Fields().ByName("message")
+				reqMsg := in.Get(msgField).String()
+
+				out := dynamicpb.NewMessage(outDesc)
+				statusField := outDesc.Fields().ByName("status")
+				messageField := outDesc.Fields().ByName("message")
+
+				if reqSuccess {
+					out.Set(statusField, protoreflect.ValueOfString(""))
+					out.Set(messageField, protoreflect.ValueOfString(reqMsg))
+				} else {
+					out.Set(statusField, protoreflect.ValueOfString("error"))
+					out.Set(messageField, protoreflect.ValueOfString(reqMsg))
+				}
+				return out, nil
+			}
+
+			gsd := &grpc.ServiceDesc{
+				ServiceName: string(fullName), // "test.EchoService"
+				HandlerType: (*interface{})(nil),
+				Methods: []grpc.MethodDesc{
+					{
+						MethodName: "Echo",
+						Handler:    unaryHandler,
+					},
+				},
+				Streams:  []grpc.StreamDesc{},
+				Metadata: fd.GetName(), // "echo.proto"
+			}
+
+			l, err := net.Listen("tcp", "127.0.0.1:0")
+			Expect(err).Should(BeNil(), "failed to listen")
+
+			s := grpc.NewServer()
+			s.RegisterService(gsd, nil)
+			reflection.Register(s)
+
+			go func() {
+				if err := s.Serve(l); err != nil {
+					panic(err)
+				}
+			}()
+
+			h, p, _ := net.SplitHostPort(l.Addr().String())
+			return h, p, func() {
+				s.Stop()
+				_ = l.Close()
+				_ = fdp
+			}
+		}
+
+		BeforeEach(func() {
+			host, port, cleanup = startDynamicGRPCServer(protoFilename, protoData)
+		})
+
+		AfterEach(func() {
+			cleanup()
+		})
+
+		It("x - ok", func() {
+			action := &proto.Action{
+				GRPC: &proto.GRPCAction{
+					Port:    port,
+					Host:    host,
+					Service: "test.EchoService",
+					Method:  "Echo",
+					Request: map[string]string{
+						"success": "true",
+						"message": "ok",
+					},
+					Response: proto.GRPCResponse{
+						Status:  "status",
+						Message: "message",
+					},
+				},
+			}
+			errChan, err := nonBlockingCallActionX(ctx, action, nil, nil, nil, nil, nil)
+			Expect(err).Should(BeNil())
+
+			wait(errChan)
+		})
+
+		It("x - stdout", func() {
+			action := &proto.Action{
+				GRPC: &proto.GRPCAction{
+					Port:    port,
+					Host:    host,
+					Service: "test.EchoService",
+					Method:  "Echo",
+					Request: map[string]string{
+						"success": "true",
+						"message": "stdout",
+					},
+					Response: proto.GRPCResponse{
+						Status:  "status",
+						Message: "message",
+					},
+				},
+			}
+			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			errChan, err := nonBlockingCallActionX(ctx, action, nil, nil, nil, stdoutBuf, nil)
+			Expect(err).Should(BeNil())
+
+			wait(errChan)
+			Expect(stdoutBuf.String()).Should(Equal("stdout"))
+		})
+
+		It("x - stderr", func() {
+			action := &proto.Action{
+				GRPC: &proto.GRPCAction{
+					Port:    port,
+					Host:    host,
+					Service: "test.EchoService",
+					Method:  "Echo",
+					Request: map[string]string{
+						"success": "false",
+						"message": "stderr",
+					},
+					Response: proto.GRPCResponse{
+						Status:  "status",
+						Message: "message",
+					},
+				},
+			}
+			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			stderrBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			errChan, err := nonBlockingCallActionX(ctx, action, nil, nil, nil, stdoutBuf, stderrBuf)
+			Expect(err).Should(BeNil())
+
+			err = waitError(errChan)
+			Expect(err).ShouldNot(BeNil())
+			Expect(errors.Is(err, proto.ErrFailed)).Should(BeTrue())
+			Expect(stdoutBuf.String()).Should(HaveLen(0))
+			Expect(stderrBuf.String()).Should(Equal("stderr"))
+		})
+
+		It("x - parameters", func() {
+			action := &proto.Action{
+				GRPC: &proto.GRPCAction{
+					Port:    port,
+					Host:    host,
+					Service: "test.EchoService",
+					Method:  "Echo",
+					Request: map[string]string{
+						"success": "true",
+						"message": "{{ .PARAM }}",
+					},
+					Response: proto.GRPCResponse{
+						Status:  "status",
+						Message: "message",
+					},
+				},
+			}
+			parameters := map[string]string{
+				"PARAM":   "parameters",
+				"useless": "useless",
+			}
+			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
+			errChan, err := nonBlockingCallActionX(ctx, action, parameters, nil, nil, stdoutBuf, nil)
+			Expect(err).Should(BeNil())
+
+			wait(errChan)
+			Expect(stdoutBuf.String()).Should(Equal("parameters"))
+		})
+
+		It("non-blocking - ok", func() {
+			action := &proto.Action{
+				GRPC: &proto.GRPCAction{
+					Port:    port,
+					Host:    host,
+					Service: "test.EchoService",
+					Method:  "Echo",
+					Request: map[string]string{
+						"success": "true",
+						"message": "ok",
+					},
+					Response: proto.GRPCResponse{
+						Status:  "status",
+						Message: "message",
+					},
+				},
+			}
+			resultChan, err := nonBlockingCallAction(ctx, action, nil, nil)
+			Expect(err).Should(BeNil())
+
+			result := <-resultChan
+			Expect(result.err).Should(BeNil())
+			Expect(result.stdout.Bytes()).Should(Equal([]byte("ok")))
+			Expect(result.stderr.Bytes()).Should(HaveLen(0))
+		})
+
+		It("non-blocking - parameters", func() {
+			action := &proto.Action{
+				GRPC: &proto.GRPCAction{
+					Port:    port,
+					Host:    host,
+					Service: "test.EchoService",
+					Method:  "Echo",
+					Request: map[string]string{
+						"success": "true",
+						"message": "{{ .PARAM }}",
+					},
+					Response: proto.GRPCResponse{
+						Status:  "status",
+						Message: "message",
+					},
+				},
+			}
+			parameters := map[string]string{
+				"PARAM": "parameters",
+			}
+			resultChan, err := nonBlockingCallAction(ctx, action, parameters, nil)
+			Expect(err).Should(BeNil())
+
+			result := <-resultChan
+			Expect(result.err).Should(BeNil())
+			Expect(result.stdout.Bytes()).Should(Equal([]byte("parameters")))
+			Expect(result.stderr.Bytes()).Should(HaveLen(0))
+		})
+
+		It("non-blocking - fail", func() {
+			action := &proto.Action{
+				GRPC: &proto.GRPCAction{
+					Port:    port,
+					Host:    host,
+					Service: "test.EchoService",
+					Method:  "Echo",
+					Request: map[string]string{
+						"success": "false",
+						"message": "error",
+					},
+					Response: proto.GRPCResponse{
+						Status:  "status",
+						Message: "message",
+					},
+				},
+			}
+			resultChan, err := nonBlockingCallAction(ctx, action, nil, nil)
+			Expect(err).Should(BeNil())
+
+			result := <-resultChan
+			Expect(result.err).ShouldNot(BeNil())
+			Expect(errors.Is(result.err, proto.ErrFailed)).Should(BeTrue())
+			Expect(result.stdout.Bytes()).Should(HaveLen(0))
+			Expect(result.stderr.Bytes()).Should(ContainSubstring("error"))
+		})
+
+		It("blocking - ok", func() {
+			action := &proto.Action{
+				GRPC: &proto.GRPCAction{
+					Port:    port,
+					Host:    host,
+					Service: "test.EchoService",
+					Method:  "Echo",
+					Request: map[string]string{
+						"success": "true",
+						"message": "ok",
+					},
+					Response: proto.GRPCResponse{
+						Status:  "status",
+						Message: "message",
+					},
+				},
+			}
+			output, err := blockingCallAction(ctx, action, nil, nil)
+			Expect(err).Should(BeNil())
+			Expect(output).Should(Equal([]byte("ok")))
+		})
+
+		It("blocking - parameters", func() {
+			action := &proto.Action{
+				GRPC: &proto.GRPCAction{
+					Port:    port,
+					Host:    host,
+					Service: "test.EchoService",
+					Method:  "Echo",
+					Request: map[string]string{
+						"success": "true",
+						"message": "{{ .PARAM }}",
+					},
+					Response: proto.GRPCResponse{
+						Status:  "status",
+						Message: "message",
+					},
+				},
+			}
+			parameters := map[string]string{
+				"PARAM": "parameters",
+			}
+			output, err := blockingCallAction(ctx, action, parameters, nil)
+			Expect(err).Should(BeNil())
+			Expect(output).Should(Equal([]byte("parameters")))
+		})
+
+		It("blocking - fail", func() {
+			action := &proto.Action{
+				GRPC: &proto.GRPCAction{
+					Port:    port,
+					Host:    host,
+					Service: "test.EchoService",
+					Method:  "Echo",
+					Request: map[string]string{
+						"success": "false",
+						"message": "error",
+					},
+					Response: proto.GRPCResponse{
+						Status:  "status",
+						Message: "message",
+					},
+				},
+			}
+			output, err := blockingCallAction(ctx, action, nil, nil)
+			Expect(err).ShouldNot(BeNil())
+			Expect(errors.Is(err, proto.ErrFailed)).Should(BeTrue())
+			Expect(err.Error()).Should(ContainSubstring("error"))
+			Expect(output).Should(BeNil())
+		})
+	})
+})
diff --git a/pkg/kbagent/service/command_test.go b/pkg/kbagent/service/command_test.go
deleted file mode 100644
index 2307a2cec..000000000
--- a/pkg/kbagent/service/command_test.go
+++ /dev/null
@@ -1,292 +0,0 @@
-/*
-Copyright (C) 2022-2025 ApeCloud Co., Ltd
-
-This file is part of KubeBlocks project
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
-
-package service
-
-import (
-	"bytes"
-	"os/exec"
-
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-
-	"github.com/pkg/errors"
-
-	"github.com/apecloud/kubeblocks/pkg/kbagent/proto"
-)
-
-var _ = Describe("command", func() {
-	wait := func(errChan chan error) {
-		Expect(errChan).ShouldNot(BeNil())
-		err, ok := <-errChan
-		Expect(ok).Should(BeTrue())
-		Expect(err).Should(BeNil())
-	}
-
-	waitError := func(errChan chan error) error {
-		Expect(errChan).ShouldNot(BeNil())
-		err, ok := <-errChan
-		Expect(ok).Should(BeTrue())
-		return err
-	}
-
-	Context("runCommandX", func() {
-		It("simple", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "echo -n simple"},
-			}
-			execErrorChan, err := runCommandX(ctx, action, nil, nil, nil, nil, nil)
-			Expect(err).Should(BeNil())
-
-			wait(execErrorChan)
-		})
-
-		It("stdout", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "echo -n stdout"},
-			}
-			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
-			execErrorChan, err := runCommandX(ctx, action, nil, nil, nil, stdoutBuf, nil)
-			Expect(err).Should(BeNil())
-
-			wait(execErrorChan)
-			Expect(stdoutBuf.String()).Should(Equal("stdout"))
-		})
-
-		It("stderr", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "echo -n stderr >&2"},
-			}
-			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
-			stderrBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
-			execErrorChan, err := runCommandX(ctx, action, nil, nil, nil, stdoutBuf, stderrBuf)
-			Expect(err).Should(BeNil())
-
-			wait(execErrorChan)
-			Expect(stdoutBuf.String()).Should(HaveLen(0))
-			Expect(stderrBuf.String()).Should(Equal("stderr"))
-		})
-
-		It("stdin", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "xargs echo -n"},
-			}
-			stdinBuf := bytes.NewBuffer([]byte{'s', 't', 'd', 'i', 'n'})
-			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
-			execErrorChan, err := runCommandX(ctx, action, nil, nil, stdinBuf, stdoutBuf, nil)
-			Expect(err).Should(BeNil())
-
-			wait(execErrorChan)
-			Expect(stdoutBuf.String()).Should(Equal("stdin"))
-		})
-
-		It("parameters", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "echo -n $PARAM"},
-			}
-			parameters := map[string]string{
-				"PARAM":   "parameters",
-				"useless": "useless",
-			}
-			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
-			execErrorChan, err := runCommandX(ctx, action, parameters, nil, nil, stdoutBuf, nil)
-			Expect(err).Should(BeNil())
-
-			wait(execErrorChan)
-			Expect(stdoutBuf.String()).Should(Equal("parameters"))
-		})
-
-		It("timeout", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "sleep 60"},
-			}
-			timeout := int32(1)
-			execErrorChan, err := runCommandX(ctx, action, nil, &timeout, nil, nil, nil)
-			Expect(err).Should(BeNil())
-
-			err = waitError(execErrorChan)
-			Expect(err).ShouldNot(BeNil())
-			Expect(errors.Is(err, proto.ErrTimedOut)).Should(BeTrue())
-		})
-
-		It("timeout and stdout", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "sleep 60 && echo -n timeout"},
-			}
-			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
-			timeout := int32(1)
-			execErrorChan, err := runCommandX(ctx, action, nil, &timeout, nil, stdoutBuf, nil)
-			Expect(err).Should(BeNil())
-
-			err = waitError(execErrorChan)
-			Expect(err).ShouldNot(BeNil())
-			Expect(errors.Is(err, proto.ErrTimedOut)).Should(BeTrue())
-			Expect(stdoutBuf.String()).Should(HaveLen(0))
-		})
-
-		It("stdout and timeout", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "echo -n timeout && sleep 60"},
-			}
-			stdoutBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
-			timeout := int32(1)
-			execErrorChan, err := runCommandX(ctx, action, nil, &timeout, nil, stdoutBuf, nil)
-			Expect(err).Should(BeNil())
-
-			err = waitError(execErrorChan)
-			Expect(err).ShouldNot(BeNil())
-			Expect(errors.Is(err, proto.ErrTimedOut)).Should(BeTrue())
-			Expect(stdoutBuf.String()).Should(Equal("timeout"))
-		})
-
-		It("fail", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "command-not-exist"},
-			}
-			execErrorChan, err := runCommandX(ctx, action, nil, nil, nil, nil, nil)
-			Expect(err).Should(BeNil())
-
-			err = waitError(execErrorChan)
-			Expect(err).ShouldNot(BeNil())
-			var exitErr *exec.ExitError
-			Expect(errors.As(err, &exitErr)).Should(BeTrue())
-		})
-
-		It("fail with stderr writer", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "command-not-found"},
-			}
-			stderrBuf := bytes.NewBuffer(make([]byte, 0, defaultBufferSize))
-			execErrorChan, err := runCommandX(ctx, action, nil, nil, nil, nil, stderrBuf)
-			Expect(err).Should(BeNil())
-
-			err = waitError(execErrorChan)
-			Expect(err).ShouldNot(BeNil())
-			var exitErr *exec.ExitError
-			Expect(errors.As(err, &exitErr)).Should(BeTrue())
-			Expect(stderrBuf.String()).Should(ContainSubstring("command not found"))
-		})
-	})
-
-	Context("runCommandNonBlocking", func() {
-		It("ok", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "echo -n ok"},
-			}
-			resultChan, err := runCommandNonBlocking(ctx, action, nil, nil)
-			Expect(err).Should(BeNil())
-
-			result := <-resultChan
-			Expect(result.err).Should(BeNil())
-			Expect(result.stdout.Bytes()).Should(Equal([]byte("ok")))
-			Expect(result.stderr.Bytes()).Should(HaveLen(0))
-		})
-
-		It("parameters", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "echo -n $PARAM"},
-			}
-			parameters := map[string]string{
-				"PARAM": "parameters",
-			}
-			resultChan, err := runCommandNonBlocking(ctx, action, parameters, nil)
-			Expect(err).Should(BeNil())
-
-			result := <-resultChan
-			Expect(result.err).Should(BeNil())
-			Expect(result.stdout.Bytes()).Should(Equal([]byte("parameters")))
-			Expect(result.stderr.Bytes()).Should(HaveLen(0))
-		})
-
-		It("fail", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "command-not-found"},
-			}
-			resultChan, err := runCommandNonBlocking(ctx, action, nil, nil)
-			Expect(err).Should(BeNil())
-
-			result := <-resultChan
-			Expect(result.err).ShouldNot(BeNil())
-			var exitErr *exec.ExitError
-			Expect(errors.As(result.err, &exitErr)).Should(BeTrue())
-			Expect(result.stdout.Bytes()).Should(HaveLen(0))
-			Expect(result.stderr.Bytes()).Should(ContainSubstring("command not found"))
-		})
-
-		It("timeout", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "sleep 60"},
-			}
-			timeout := int32(1)
-			resultChan, err := runCommandNonBlocking(ctx, action, nil, &timeout)
-			Expect(err).Should(BeNil())
-
-			result := <-resultChan
-			Expect(result.err).ShouldNot(BeNil())
-			Expect(errors.Is(result.err, proto.ErrTimedOut)).Should(BeTrue())
-			Expect(result.stdout.Bytes()).Should(HaveLen(0))
-			Expect(result.stderr.Bytes()).Should(HaveLen(0))
-		})
-	})
-
-	Context("runCommand", func() {
-		It("ok", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "echo -n ok"},
-			}
-			output, err := runCommand(ctx, action, nil, nil)
-			Expect(err).Should(BeNil())
-			Expect(output).Should(Equal([]byte("ok")))
-		})
-
-		It("parameters", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "echo -n $PARAM"},
-			}
-			parameters := map[string]string{
-				"PARAM": "parameters",
-			}
-			output, err := runCommand(ctx, action, parameters, nil)
-			Expect(err).Should(BeNil())
-			Expect(output).Should(Equal([]byte("parameters")))
-		})
-
-		It("fail", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "command-not-found"},
-			}
-			output, err := runCommand(ctx, action, nil, nil)
-			Expect(err).ShouldNot(BeNil())
-			Expect(errors.Is(err, proto.ErrFailed)).Should(BeTrue())
-			Expect(err.Error()).Should(ContainSubstring("command not found"))
-			Expect(output).Should(BeNil())
-		})
-
-		It("timeout", func() {
-			action := &proto.ExecAction{
-				Commands: []string{"/bin/bash", "-c", "sleep 60"},
-			}
-			timeout := int32(1)
-			output, err := runCommand(ctx, action, nil, &timeout)
-			Expect(err).ShouldNot(BeNil())
-			Expect(errors.Is(err, proto.ErrTimedOut)).Should(BeTrue())
-			Expect(output).Should(BeNil())
-		})
-	})
-})