---
# Second Ceph RGW (S3) bucket owned by the existing cheeztv backup user
# (cnpg-cheeztv-backup, defined in cnpg_backup.yaml) — one user, two buckets:
# the CNPG barman bucket plus this one, which k8up uses to hold restic backups
# of the cheeztv-config PVC. The BucketAccess emits read-write S3 creds into a
# Secret the k8up Schedule consumes.
apiVersion: ceph.unkin.net/v1alpha1
kind: Bucket
metadata:
  name: cheeztv-config-backup
  namespace: cheeztv
spec:
  placementTarget: ec
  bucketName: cheeztv-config-backup
  ownerRef: cnpg-cheeztv-backup
  versioning: false
  tags:
    app: cheeztv
    purpose: config-backup
  retainOnDelete: true
---
apiVersion: ceph.unkin.net/v1alpha1
kind: BucketAccess
metadata:
  name: cheeztv-config-backup
  namespace: cheeztv
spec:
  bucketRef: cheeztv-config-backup
  level: read-write
  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ S3_ENDPOINT,
  # BUCKET_NAME) into this Secret; the k8up Schedule reads the access keys.
  secretName: cheeztv-config-backup-s3