---
# Kubernetes ServiceAccount bound to the GCP service account via Workload Identity.
# The CNPG operator uses this SA to authenticate against GCS without a static key.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cnpg-backup-sa
  namespace: knoe-db-0
  annotations:
    # Set by etc/init_cnpg_gke.sh — substituted at deploy time
    iam.gke.io/gcp-service-account: "cnpg-backup@${GCP_PROJECT_ID}.iam.gserviceaccount.com"

---
# Daily scheduled backup at 02:00 UTC.
# Backup data lands in gs://knoe-0-backups/ (WAL is streamed continuously by CNPG).
apiVersion: postgresql.cnpg.io/v1
kind: ScheduledBackup
metadata:
  name: knoe-db-daily
  namespace: knoe-db-0
spec:
  schedule: "0 0 2 * * *"   # 6-field CNPG cron: sec min hour dom mon dow
  backupOwnerReference: self
  cluster:
    name: knoe-db
  method: barmanObjectStore
  immediate: false