---
# Second Ceph RGW (S3) bucket owned by the existing fafflix backup user
# (cnpg-fafflix-backup, defined in cnpg_backup.yaml) — one user, two buckets:
# the CNPG barman bucket plus this one, which k8up uses to hold restic backups
# of the fafflix-config PVC. The BucketAccess emits read-write S3 creds into a
# Secret the k8up Schedule consumes.
apiVersion: ceph.unkin.net/v1alpha1
kind: Bucket
metadata:
  name: fafflix-config-backup
  namespace: fafflix
spec:
  placementTarget: ec
  bucketName: fafflix-config-backup
  ownerRef: cnpg-fafflix-backup
  versioning: false
  tags:
    app: fafflix
    purpose: config-backup
  retainOnDelete: true
---
apiVersion: ceph.unkin.net/v1alpha1
kind: BucketAccess
metadata:
  name: fafflix-config-backup
  namespace: fafflix
spec:
  bucketRef: fafflix-config-backup
  level: read-write
  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ S3_ENDPOINT,
  # BUCKET_NAME) into this Secret; the k8up Schedule reads the access keys.
  secretName: fafflix-config-backup-s3