cloudnative-pg:
  crds:
    create: true
  # Image tag intentionally left to the chart's appVersion (1.28.1). Do NOT pin
  # image.tag to a version the vendored chart's CRDs don't match: an operator
  # newer than its CRDs writes status fields the CRD prunes (e.g.
  # status.instanceID.sessionID, added in CNPG 1.27.3), which makes the operator
  # believe the instance manager restarted and fail EVERY backup cluster-wide
  # ("instance manager was restarted during backup"). Bump the chart version in
  # the Makefile to move the operator + CRDs together.

# CloudNativePG Barman Cloud Plugin (github.com/cloudnative-pg/plugin-barman-cloud).
# Native spec.backup.barmanObjectStore is deprecated in CNPG 1.27 and removed in 1.29,
# and the `standard` postgresql image variant this platform pins no longer ships the
# barman-cloud-* binaries. The plugin runs the barman tooling in a sidecar instead, so
# it must be co-located with the CNPG operator: CNPG discovers plugins by listing
# Services carrying the cnpg.io/pluginName label *in the operator's own namespace*
# (cozy-postgres-operator). The subchart renders every object into .Release.Namespace,
# which cozyhr/Flux set to cozy-postgres-operator, so no namespaceOverride is needed.
#
# Requires cert-manager: the subchart mints a self-signed Issuer plus the
# barman-cloud-server-tls / barman-cloud-client-tls Secrets that carry the mTLS between
# the operator and the plugin.
plugin-barman-cloud:
  crds:
    create: true
# Image used by the post-install webhook-readiness Job (see templates/webhook-ready-hook.yaml).
# Any image with kubectl on PATH works; the Job calls the apiserver service proxy with the
# hook ServiceAccount's token to confirm the mcluster.cnpg.io webhook is reachable end-to-end
# before the HelmRelease reports Ready, closing the "connection refused" bootstrap race.
#
# The tag is digest-pinned so an upstream retag does not change what runs on every install
# and upgrade across the fleet. Refresh by resolving the current manifest-list digest
# (`docker manifest inspect docker.io/clastix/kubectl:v1.32`) and updating `digest` below.
# renovate: datasource=docker depName=docker.io/clastix/kubectl
webhookReady:
  image:
    repository: docker.io/clastix/kubectl
    tag: v1.32
    digest: sha256:b9ef7d8dbe65bcc81a46c09b8dc7543103055021c4f43287bf59e92a8f4fe05c
  # Retry loop bounds for the readiness probe. Defaults total ~120s wall clock.
  # Both are `default`-coerced in the template so an override that blanks them still
  # produces a working Job.
  maxAttempts: 60
  sleepSeconds: 2
  # Pod-level retry budget for transient node/registry failures (image pull rate limit,
  # OOM, CNI hiccup). The shell loop inside the container only covers reachability retries.
  # Pod retries and activeDeadlineSeconds (wall-clock bound on the whole Job across all
  # pod retries) are ANDed, so activeDeadlineSeconds is the shorter of the two gates with
  # the defaults above: the 60*2+60 = 180s deadline cuts the Job before backoffLimit=2
  # ever matters if pod-level failures eat more than ~60s of the budget. Raise
  # maxAttempts/sleepSeconds alongside backoffLimit when tuning for slow image pulls.
  backoffLimit: 2