#!/usr/bin/env bash
set -e
cd /Users/chrisfu/dev/prole

git add \
  conf/cnpg-placement/ecosystem-0-knoe-db.json \
  conf/cnpg-placement/knoe-system-knoe-db.json \
  conf/dev/prole.cfg \
  conf/port-mapping.cfg \
  conf/prod/prole.cfg \
  deploy/gcp/gke/knoe-db-backup-gcs.yaml \
  deploy/gcp/gke/knoe-db.yaml \
  deploy/gcp/gke/namespace.yaml \
  deploy/gcp/gke/workload-identity.yaml \
  knoe/core/ops/cloudnative_pg.py \
  modes/k3d/knoe-db/.version \
  modes/k8s/knoe-db/.version \
  scan/network_description.txt \
  tests/installer/test_cnpg_barman_webhook.py

git commit \
  --trailer "Co-authored-by: Junie <junie@jetbrains.com>" \
  -m "fix(cnpg): stabilize CNPG/Barman Cloud init on GKE (knoe-dev-0 / knoe-db-0)

- cloudnative_pg.py: add _wait_for_webhook_ca_bundle() to poll ValidatingWebhookConfiguration
  until cainjector has injected the CA bundle; fall back to _try_inject_ca_bundle_manually()
  on timeout (reads cert-manager-webhook-ca secret, patches webhook directly)
- cloudnative_pg.py: add _wait_for_barman_tls_secrets() to wait for barman-cloud-{client,server}-tls
  before declaring Barman Cloud ready; surfaces warning instead of silent FailedMount
- deploy/gcp/gke/namespace.yaml: ecosystem-0 -> knoe-db-0 (ekosystem = k8s cluster, not namespace)
- deploy/gcp/gke/knoe-db.yaml: fix namespace ecosystem-0 -> knoe-db-0; set
  podAntiAffinityType: required (one CNPG pod per node); add Spot node toleration so
  GKE autoscaler simulation succeeds and scale-up is unblocked; add resource
  requests/limits (500m/512Mi -> 2/2Gi); set googleCredentials.gkeEnvironment: true
  (use Workload Identity - no explicit credentials secret needed)
- deploy/gcp/gke/knoe-db-backup-gcs.yaml: fix namespaces ecosystem-0 -> knoe-db-0
- deploy/gcp/gke/workload-identity.yaml: update comments ecosystem-0 -> knoe-db-0
- tests/installer/test_cnpg_barman_webhook.py: new - 13 tests covering webhook CA bundle
  polling, manual CA injection, Barman TLS secret wait, and install_barman_plugin retry logic"