apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
  name: knoe-db-barman-objectstore
  # Applied to knoe-dev-cnpg-0 in namespace knoe-db-0.
  #
  # Auth: Workload Identity. Cluster pods run as cnpg-backup-sa, set via
  # cluster.spec.serviceAccountName (requires CNPG >= v1.29.0). The SA is
  # annotated with iam.gke.io/gcp-service-account=
  # cnpg-backup@<project>.iam.gserviceaccount.com. RoleBindings knoe-db and
  # knoe-db-barman-cloud include cnpg-backup-sa as a subject so the pod has
  # the RBAC needed to read the Cluster CR and the Backup CRs.
  #
  # The googleCredentials.gkeEnvironment: true block is REQUIRED by
  # plugin-barman-cloud v0.12.0 — without it the plugin rejects the
  # ObjectStore with "no credentials defined".
spec:
  retentionPolicy: 30d
  configuration:
    destinationPath: gs://knoe-0-backups/
    googleCredentials:
      gkeEnvironment: true
    wal:
      compression: gzip
    data:
      compression: gzip