@leverege/build-tools 2.65.1 → 2.66.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.65.1",
+  "version": "2.66.0",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -83,10 +83,10 @@
     "semver": "^7.7.1",
     "simple-git": "^3.27.0",
     "toml": "^3.0.0",
-    "zx": "^8.5.0"
+    "zx": "^8.5.2"
   },
   "devDependencies": {
     "@leverege/eslint-config-leverege": "^5.0.1",
-    "npm": "^11.2.0"
+    "npm": "^11.3.0"
   }
 }

package/src/clone-cnpg-from-snapshot.mjs

@@ -83,7 +83,7 @@ const touchFile = async ( filename ) => {
 
 // generates an executable script to use for defining the volume on k8s
 const writeApplyScript = async ( dir ) => {
-  const applyScript = `#!/ust/bin/env bash
+  const applyScript = `#!/usr/bin/env bash
 #
 # Apply VolumeSnapshot resources prior to deploying the CNPG cluster
 #
@@ -387,7 +387,7 @@ const main = async () => {
   log( `
   ✅ Done. Snapshot: ${chalk.cyan( destSnapshot )}
            Recovery YAMLs written to: ${chalk.cyan( emitYamlDir )}
-           Run '${chalk.yellow( './apply-recovery-yaml.sh' )}' to prep the cluster for recovery.
+           Run '${chalk.yellow( './apply-volumesnapshots.sh' )}' to prep the cluster for recovery.
   ` )
 }
 
@@ -434,7 +434,7 @@ const cleanupResources = async () => {
     } ) )
   )
 
-  log( chalk.green( '  [✓] Parallel complete. Final GCE snapshot retained for CNPG bootstrapping.' ) )
+  log( chalk.green( '\n  [✓] Parallel cleanup complete - final GCE snapshot retained for CNPG bootstrapping\n' ) )
 }
 
 if ( cleanupOnly ) {
@@ -447,3 +447,5 @@ await main().catch( err => errorExit( err.message || err ) )
 if ( cleanup ) {
   await cleanupResources()
 }
+
+log( chalk.green( `  [✓] Cloning complete - recovery image name is => ${chalk.bold.yellow( k8sSnapshotName )}\n` ) )

package/src/helm-charts/cnpg-operator/cnpg-cleanup-cronjob.yaml.ovh

@@ -0,0 +1,67 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cnpg-cleanup-sa
+  namespace: cnpg-operands
+  annotations:
+    # wire up this KSA to the GSA to hook into IAM for workload identity
+    iam.gke.io/gcp-service-account: cnpg-cleanup-sa@${PROJECT_ID}.iam.gserviceaccount.com
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cnpg-cleanup-role
+  namespace: cnpg-operands
+rules:
+  - apiGroups: ["postgresql.cnpg.io"]
+    resources: ["backups"]
+    verbs: ["get", "list", "delete"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshots"]
+    verbs: ["get", "list", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cnpg-cleanup-rolebinding
+  namespace: cnpg-operands
+subjects:
+  - kind: ServiceAccount
+    name: cnpg-cleanup-sa
+    namespace: cnpg-operands
+roleRef:
+  kind: Role
+  name: cnpg-cleanup-role
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: cnpg-cleanup-snapshot
+  namespace: cnpg-operands
+spec:
+  schedule: "0 11 * * *" # 11 UTC is ~7AM EST
+# schedule: "*/5 * * * *" # every 5 minutes for testing
+  successfulJobsHistoryLimit: 1
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          serviceAccountName: cnpg-cleanup-sa
+          containers:
+            - name: cnpg-cleanup
+              image: gcr.io/google.com/cloudsdktool/cloud-sdk:latest
+              env:
+                - name: DRY_RUN
+                  value: "false"
+                - name: RETENTION_DAYS
+                  value: "21"
+              command:
+                - /bin/bash
+                - -c
+                - |
+                  echo "🚀 Fetching cleanup script from GCS..."
+                  apt-get update -qq
+                  apt-get install -y jq libjq1 libonig5 --no-install-recommends -o=Dpkg::Use-Pty=0 -o=APT::Get::Assume-Yes=1 -o=Debug::pkgProblemResolver=1
+                  gsutil cat gs://${PROJECT_ID}-k8s-cronjobs/cnpg-cleanup-script.sh | bash

package/src/helm-charts/cnpg-operator/cnpg-cleanup-script.sh

@@ -0,0 +1,73 @@
+#!/bin/bash
+set -euo pipefail
+
+KUBECTL_DELETE_ARGS=""
+[[ "$DRY_RUN" == "true" ]] && KUBECTL_DELETE_ARGS="--dry-run=server"
+
+# volumesnapshots namespace can be set here but if we need more than just the
+# cnpg-operands then we'll need to the Role with a ClusterRole and bind it
+# differently as well.
+VSNAPS_NS="-n cnpg-operands"
+
+# Default retention period (can override with env)
+RETENTION_DAYS="${RETENTION_DAYS:-21}"
+CURRENT_DATE=$(date +%s)
+
+log() {
+  echo "[$(date -u '+%Y-%m-%dT%H:%M:%SZ')] $*"
+}
+
+should_delete() {
+  local creation_ts="$1"
+  local age_days
+  local created_secs
+  created_secs=$(date -d "$creation_ts" +%s)
+  age_days=$(( (CURRENT_DATE - created_secs) / 86400 ))
+  if (( age_days > RETENTION_DAYS )); then
+    echo "$age_days"
+    return 0
+  fi
+  return 1
+}
+
+cleanup_cnpg_backups() {
+  log "🔍 Cleaning CNPG backups older than $RETENTION_DAYS days"
+  kubectl get backups.postgresql.cnpg.io -n cnpg-operands -o json | jq -c '.items[]' | while read -r item; do
+    name=$(echo "$item" | jq -r '.metadata.name')
+    created=$(echo "$item" | jq -r '.metadata.creationTimestamp')
+    [[ "$name" != *"-backup-"* ]] && log "Skipping manual backup: $name" && continue
+
+    if age=$(should_delete "$created"); then
+      log "🗑 Deleting CNPG backup: $name (Age: $age days)"
+      kubectl delete backups.postgresql.cnpg.io "$name" -n cnpg-operands --ignore-not-found --wait=false $KUBECTL_DELETE_ARGS
+    fi
+  done
+  log "✅ CNPG backup cleanup complete"
+}
+
+cleanup_volume_snapshots() {
+  log "🔍 Cleaning VolumeSnapshots older than $RETENTION_DAYS days"
+  kubectl get volumesnapshots $VSNAPS_NS -o json | jq -c '.items[]' | while read -r item; do
+    ns=$(echo "$item" | jq -r '.metadata.namespace')
+    name=$(echo "$item" | jq -r '.metadata.name')
+    created=$(echo "$item" | jq -r '.metadata.creationTimestamp')
+    ready=$(echo "$item" | jq -r '.status.readyToUse // false')
+
+    [[ "$ready" != "true" ]] && continue
+
+    if age=$(should_delete "$created"); then
+      log "🗑 Deleting VolumeSnapshot: $ns/$name (Age: $age days)"
+      kubectl delete volumesnapshot -n "$ns" "$name" --ignore-not-found --wait=false $KUBECTL_DELETE_ARGS
+    fi
+  done
+  log "✅ VolumeSnapshot cleanup complete"
+}
+
+main() {
+  log "🚀 Starting cleanup job (retention: $RETENTION_DAYS days)"
+  cleanup_cnpg_backups
+  cleanup_volume_snapshots
+  log "🏁 All cleanup tasks complete"
+}
+
+main

package/src/helm-charts/cnpg-operator/gitignore

@@ -0,0 +1 @@
+cnpg-cleanup-cronjob.yaml

package/src/helm-charts/cnpg-operator/helmup-1.26.0-rc1.plugin

@@ -0,0 +1,28 @@
+#!/bin/bash
+#
+# See => https://cloudnative-pg.io/documentation/current/installation_upgrade/
+#
+# OPVER="1.25.1"
+OPVER="1.26.0-rc1" # 03/28/2025
+
+createNamespaceIfNeeded cnpg-system
+
+kubectl apply --server-side -f \
+    https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-${OPVER}.yaml $K8S_WHAT
+
+# Legacy terraformed clusters (like sandbox) may need a special firewall rule
+# added to the network layer on k8s. It should look like this:
+#
+# Name   : cnpg-operator
+# Ports  : 8000,9443     <= kubectl cnpg status and webhooks
+# Filters: 172.16.0.0/28 <= k8s control plane
+#
+# Old approach used the helm chart.
+#
+#addHelmRepo cnpg https://cloudnative-pg.github.io/charts
+#
+#helm upgrade --install cnpg cnpg/cloudnative-pg \
+#  --namespace cnpg-system --create-namespace \
+#  --set webhook.port="10250" $HELM_WHAT
+#
+#removeHelmRepo cnpg

package/src/helm-charts/cnpg-operator/helmup.plugin

@@ -2,13 +2,12 @@
 #
 # See => https://cloudnative-pg.io/documentation/current/installation_upgrade/
 #
-# OPVER="1.25.1"
-OPVER="1.26.0-rc1" # 03/28/2025
+OPVER="1.25.1"
 
 createNamespaceIfNeeded cnpg-system
 
 kubectl apply --server-side -f \
-    https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/releases/cnpg-${OPVER}.yaml $K8S_WHAT
+    https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-${OPVER%.*}/releases/cnpg-${OPVER}.yaml $K8S_WHAT
 
 # Legacy terraformed clusters (like sandbox) may need a special firewall rule
 # added to the network layer on k8s. It should look like this:

package/src/helm-charts/elasticsearch8/helmup.plugin

@@ -2,7 +2,7 @@
 #
 showInstalling "Elastic Search 8"
 
-[ -z "$ELASTIC_CHART_VERSION" ] && ELASTIC_CHART_VERSION="21.4.8"
+[ -z "$ELASTIC_CHART_VERSION" ] && ELASTIC_CHART_VERSION="21.5.0"
 
 OCI_CHART="oci://registry-1.docker.io/bitnamicharts/elasticsearch"
 

package/src/helm-charts/prom-operator/helmup.plugin

@@ -4,7 +4,7 @@ showInstalling "The Prometheus Operator and Components"
 addHelmRepo prometheus-community https://prometheus-community.github.io/helm-charts
 
 showInstalling "The Prometheus Operator (kube-prometheus-stack)"
-[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="69"
+[ -z "$PROMETHEUS_STACK_CHART_VERSION" ] && PROMETHEUS_STACK_CHART_VERSION="70"
 
 NS="--namespace prometheus"
 

package/src/helm-charts/prom-operator/stackdriver-exporter.yaml.ovh

@@ -7,7 +7,25 @@ fullnameOverride: "prometheus-stack-stackdriver-metrics"
 stackdriver:
   projectId: "${PROJECT_NAME}"
   metrics:
-    typePrefixes: "pubsub.googleapis.com/subscription/oldest_unacked_message_age,pubsub.googleapis.com/subscription/num_undelivered_messages,pubsub.googleapis.com/subscription/pull_ack_request_count,pubsub.googleapis.com/subscription/streaming_pull_ack_request_count,pubsub.googleapis.com/topic/message_sizes,pubsub.googleapis.com/topic/send_request_count,firebasedatabase.googleapis.com/io/database_load,firebasedatabase.googleapis.com/network/sent_bytes_count,firebasedatabase.googleapis.com/network/active_connections"
+    typePrefixes:  >
+      pubsub.googleapis.com/subscription/oldest_unacked_message_age,
+      pubsub.googleapis.com/subscription/num_undelivered_messages,
+      pubsub.googleapis.com/subscription/pull_ack_request_count,
+      pubsub.googleapis.com/subscription/streaming_pull_ack_request_count,
+      pubsub.googleapis.com/topic/message_sizes,
+      pubsub.googleapis.com/topic/send_request_count,
+      firebasedatabase.googleapis.com/io/database_load,
+      firebasedatabase.googleapis.com/network/sent_bytes_count,
+      firebasedatabase.googleapis.com/network/active_connections,
+      container.googleapis.com/accelerator/duty_cycle,
+      container.googleapis.com/accelerator/memory_usage,
+      container.googleapis.com/accelerator/request_count,
+      agent.googleapis.com/memory/bytes_used,
+      agent.googleapis.com/cpu/utilization,
+      storage.googleapis.com/network/received_bytes_count,
+      storage.googleapis.com/network/sent_bytes_count,
+      monitoring.googleapis.com/uptime_check/check_passed,
+      quota.googleapis.com/allocation/usage
 
 # https://artifacthub.io/packages/helm/prometheus-community/prometheus-stackdriver-exporter?modal=values&path=serviceMonitor
 serviceMonitor:
@@ -15,6 +33,8 @@ serviceMonitor:
   namespace: prometheus
   interval: "30s"
   relabelings:
+    # Legacy labelmap used to preserve compatibility with pre-operator Grafana dashboards
+    # Can be removed once legacy Prometheus stack is deprecated
     - action: labelmap
       regex: __meta_kubernetes_pod_label_(.+)
     - action: labelmap

package/src/helm-charts/redis/helmup.plugin

@@ -4,7 +4,7 @@ showInstalling "Redis"
 
 OCI_CHART="oci://registry-1.docker.io/bitnamicharts/redis"
 
-[ -z "$REDIS_CHART_VERSION" ] && REDIS_CHART_VERSION="20.11.3"
+[ -z "$REDIS_CHART_VERSION" ] && REDIS_CHART_VERSION="20.11.5"
 
 helm upgrade --install redis $OCI_CHART       \
              --values  redis/values.yaml \

package/src/helm-charts/traefik/helmup.plugin

@@ -17,7 +17,7 @@ TRAEFIK_NAMESPACE="traefik"
 
 addHelmRepo traefik https://helm.traefik.io/traefik
 
-[ -z "$TRAEFIK_CHART_VERSION" ] && TRAEFIK_CHART_VERSION="34"
+[ -z "$TRAEFIK_CHART_VERSION" ] && TRAEFIK_CHART_VERSION="35"
 helm upgrade --install traefik traefik/traefik \
              --namespace $TRAEFIK_NAMESPACE --create-namespace \
              --values  traefik/values.yaml \

package/src/helm-charts/velero/helmup.plugin

@@ -25,7 +25,7 @@ velero schedule delete --all --confirm &> /dev/null
 helm upgrade \
      --install velero vmware-tanzu/velero \
      --namespace velero --create-namespace \
-     --values velero/velero-local.yaml \
+     --values velero/values-local.yaml \
      --version $VELERO_CHART_VERSION $HELM_WHAT \
      --set configuration.backupStorageLocation[0].bucket="$GCE_BUCKET" \
      --set configuration.backupStorageLocation[0].config.serviceAccount="$GCE_SA_EMAIL" \

package/src/helm-charts/velero/{velero-local.yaml → values-local.yaml}

@@ -71,7 +71,7 @@ resources:
     cpu: 250m
     memory: 128Mi
   limits:
-    cpu: 300m
+    cpu: 500m
     memory: 256Mi
 
 # Annotations to add to the Velero deployment's. Optional.

package/src/helmup.sh

@@ -702,7 +702,11 @@ EOSNAPSC
   sleep 2 # hold up processing for a moment to allow IAM mods to propagate
 }
 
-function installCronCnpgCleanupSnapshot() {
+# this function is a little convoluted in the way it attempts to install the
+# scripts and yaml necessary for the CNPG cleanup activities - the idea is to
+# be able to update the scripts without touching anything else since the target
+# directory is the cnpg-operator setup
+function installCnpgCleanupCronjob() {
   CNPG_OPERATOR_DIR="cnpg-operator"
   if [ ! -d "$CNPG_OPERATOR_DIR" ];
   then
@@ -713,23 +717,52 @@ CNPG_OPERATOR_MISSING
     exit 1
   fi
 
-  CNPG_CLEANUP_CRONJOB_YAML="cnpg-cleanup-snapshot-cronjob.yaml"
-  CNPG_CLEANUP_CRONJOB="$CNPG_OPERATOR_DIR/$CNPG_CLEANUP_CRONJOB_YAML"
-  if [ ! -f "$CNPG_CLEANUP_CRONJOB" ];
+  # create the destination bucket for k8s cronjob scripts
+  BUCKET_SUFFIX="k8s-cronjobs"
+  makeUniformBucketWithCors $BUCKET_SUFFIX
+
+  CNPG_CLEANUP_CRONJOB_OVH="cnpg-cleanup-cronjob.yaml.ovh"
+  CNPG_CLEANUP_CRONJOB="$CNPG_OPERATOR_DIR/$CNPG_CLEANUP_CRONJOB_OVH"
+  CNPG_CLEANUP_SCRIPT_BASH="cnpg-cleanup-script.sh"
+  CNPG_CLEANUP_SCRIPT="$CNPG_OPERATOR_DIR/$CNPG_CLEANUP_SCRIPT_BASH"
+  if [ ! -f "$CNPG_CLEANUP_SCRIPT" ];
   then
     cat<<CNPG_FETCH_CLEANUP_CRONJOB_YAML
-  `color y "Missing $CNPG_CLEANUP_CRONJOB_YAML - grabbing a copy from build-tools"`
+  `color y "Missing $CNPG_CLEANUP_SCRIPT_BASH - updating local cron setup scripts"`
 
 CNPG_FETCH_CLEANUP_CRONJOB_YAML
     CNPG_OP_ROOT="$(build-tools --reporoot)/src/helm-charts/cnpg-operator"
-    cp $CNPG_OP_ROOT/$CNPG_CLEANUP_CRONJOB_YAML $CNPG_CLEANUP_CRONJOB
+    cp $CNPG_OP_ROOT/$CNPG_CLEANUP_CRONJOB_OVH $CNPG_CLEANUP_CRONJOB
+    cp $CNPG_OP_ROOT/$CNPG_CLEANUP_SCRIPT_BASH $CNPG_CLEANUP_SCRIPT
   fi
 
+  # copy / update the script in the bucket referenced in the cronjob
+  printf "\ngsutil cp $CNPG_CLEANUP_SCRIPT gs://$GCP_PROJECT_ID-$BUCKET_SUFFIX\n"
+  gsutil cp $CNPG_CLEANUP_SCRIPT gs://$GCP_PROJECT_ID-$BUCKET_SUFFIX
+
+  local CNPG_NAMESPACE="cnpg-operands"
+  local CNPG_CLEANUP_SA="cnpg-cleanup-sa"
+
+  gcloud iam service-accounts create "$CNPG_CLEANUP_SA" \
+    --project="$GCP_PROJECT_ID" \
+    --description="Used for cronjob cleanup with Workload Identity" \
+    --display-name="CNPG Cleanup SA" &> $DEVNULL
+    warnOnError $? "the GCP SA $CNPG_CLEANUP_SA may already exist"
+
+  gcloud projects add-iam-policy-binding "$GCP_PROJECT_ID" \
+    --project="$GCP_PROJECT_ID" \
+    --member="serviceAccount:$CNPG_CLEANUP_SA@$GCP_PROJECT_ID.iam.gserviceaccount.com" \
+    --role="roles/storage.objectViewer"
+
+  bindWorkloadIdentity "$CNPG_CLEANUP_SA" "$CNPG_NAMESPACE"
+
+  CNPG_CLEANUP_CRONJOB_YAML="$CNPG_OPERATOR_DIR/$(basename $CNPG_CLEANUP_CRONJOB_OVH .ovh)"
+  overwhelm -g # allow ovh -> yaml to occur
   cat<<CNPG_CLEANUP_CRONJOB_APPLY
-  `color g "Creating cronjob =>"``color y " kubectl apply -f $CNPG_CLEANUP_CRONJOB"`
+  `color g "Creating cronjob =>"``color y " kubectl apply -f $CNPG_CLEANUP_CRONJOB_YAML"`
 
 CNPG_CLEANUP_CRONJOB_APPLY
-  kubectl apply -f $CNPG_CLEANUP_CRONJOB
+  kubectl apply -f $CNPG_CLEANUP_CRONJOB_YAML
 }
 
 function ensureCnpgSecret() {
@@ -1001,7 +1034,7 @@ CATBACKUP
         ;;
 
       "cnpg-cronjob")
-        installCronCnpgCleanupSnapshot
+        installCnpgCleanupCronjob
         ;;
 
       "cronZombieKiller"|"zombie-killer")

package/src/templates/cloudBuildSteps.hbs

@@ -1,4 +1,8 @@
 steps:
+  - name: 'gcr.io/cloud-builders/docker'
+    entrypoint: 'bash'
+    args: ['-c', 'docker pull {{imageName}}:latest || exit 0']
+
   - name: 'gcr.io/cloud-builders/docker'
     args:
       - 'build' 
@@ -6,8 +10,8 @@ steps:
       - '-t'
       - '{{imageName}}:{{imageVersion}}'
       - '--cache-from'
-      - '{{imageName}}:{{imageVersion}}'
+      - '{{imageName}}:latest'
       - '.'
     
 images:
-  - '{{imageName}}:{{imageVersion}}'
+  - '{{imageName}}:{{imageVersion}}'

package/src/helm-charts/cnpg-operator/cnpg-cleanup-snapshot-cronjob.yaml

@@ -1,73 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: cnpg-cleanup-sa
-  namespace: cnpg-operands
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: cnpg-cleanup-role
-  namespace: cnpg-operands
-rules:
-  - apiGroups: ["postgresql.cnpg.io"]
-    resources: ["backups"]
-    verbs: ["get", "list", "delete"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: cnpg-cleanup-rolebinding
-  namespace: cnpg-operands
-subjects:
-  - kind: ServiceAccount
-    name: cnpg-cleanup-sa
-    namespace: cnpg-operands
-roleRef:
-  kind: Role
-  name: cnpg-cleanup-role
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: cnpg-cleanup-snapshot
-  namespace: cnpg-operands
-spec:
-  schedule: "0 13 * * *" # 13 UTC is ~8AM EST
-  successfulJobsHistoryLimit: 2
-  jobTemplate:
-    spec:
-      template:
-        spec:
-          serviceAccountName: cnpg-cleanup-sa
-          restartPolicy: Never
-          containers:
-            - name: cnpg-cleanup-snapshots
-              image: bitnami/kubectl:latest
-              command:
-                - "/bin/bash"
-                - "-c"
-                - |
-                  echo "Starting CNPG Cleanup"
-                  CURRENT_DATE=$(date +%s)
-                  RETENTION_DAYS=21
-                  SNAPSHOTS_JSON=$(kubectl get backups.postgresql.cnpg.io -n cnpg-operands -o json)
-                  echo "$SNAPSHOTS_JSON" | jq -c '.items[]' | while read -r snapshot
-                  do
-                    NAME=$(echo "$snapshot" | jq -r '.metadata.name')
-                    CREATION_TIMESTAMP=$(echo "$snapshot" | jq -r '.metadata.creationTimestamp')
-                    if [[ "$NAME" != *"-backup-"* ]];
-                    then
-                      echo "Skipping manual snapshot: $NAME"
-                      continue
-                    fi
-                    SNAPSHOT_DATE=$(date -d "$CREATION_TIMESTAMP" +%s)
-                    AGE=$(( (CURRENT_DATE - SNAPSHOT_DATE) / 86400 ))
-                    if [ "$AGE" -gt "$RETENTION_DAYS" ];
-                    then
-                      echo "Deleting snapshot: $NAME (Age: $AGE days)"
-                      kubectl delete backups.postgresql.cnpg.io "$NAME" -n cnpg-operands 2> /dev/null
-                    fi
-                  done
-                  echo "Cleanup complete."