apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
  name: knoe-db-barman-objectstore
  # Applied to knoe-cnpg-0 in namespace knoe-db-0.
  # Auth: Workload Identity — cnpg-backup-sa (in knoe-db-0) is annotated with
  # iam.gke.io/gcp-service-account: cnpg-backup@<project>.iam.gserviceaccount.com
  # No static credentials secret required.
spec:
  retentionPolicy: 30d
  configuration:
    destinationPath: gs://knoe-0-backups/
    # No googleCredentials block — barman-cloud uses the pod's Workload Identity
    # token automatically when the ServiceAccount (cnpg-backup-sa in knoe-db-0)
    # carries the iam.gke.io/gcp-service-account annotation set by init_cnpg_gke.sh.
    wal:
      compression: gzip
    data:
      compression: gzip