{{- if and .Values.bootstrap.enabled .Values.users }}
WARNING: this PostgreSQL was provisioned as a restore (bootstrap.enabled=true).

The roles recovered from the backup keep their original password hashes, but the
{{ .Release.Name }}-credentials Secret now holds freshly generated passwords that
are NOT yet applied to the database — the init-job that runs ALTER ROLE is skipped
while bootstrap is on. While bootstrap is on the credentials Secret carries the
annotation postgres.cozystack.io/credentials-pending: "true". That flag tracks only
the bootstrap phase, not the whole convergence: the restore driver REMOVES it when
it clears bootstrap.enabled, and that same reconcile is what triggers the init-job
— so the flag is already gone for the short window before the init-job has finished
applying the passwords. Do not read a missing flag as "converged".

The restore driver clears bootstrap.enabled automatically once recovery is healthy,
and the next reconcile runs the init-job to apply the Secret's passwords onto the
recovered roles — no action is required. Confirm convergence by logging in as an
application user rather than by the flag; until a login with the Secret's password
succeeds, do not treat the advertised application passwords as usable — the database
is reachable as the CloudNativePG superuser in the meantime.
{{- end }}
