@leverege/build-tools 2.96.8 → 2.97.0

package/.vscode/launch.json

@@ -2,9 +2,9 @@
   "version": "0.2.0",
   "configurations": [
     {
+      "name": "Units Tests",
       "type": "node",
       "request": "launch",
-      "name": "Test",
       "runtimeExecutable": "npm",
       "runtimeArgs": [
         "run",
@@ -18,6 +18,26 @@
       },
       "outputCapture": "std"
     },
+    {
+      "name": "init-my-chart pubsub-pulse",
+      "type": "node",
+      "request": "launch",
+      "program": "${workspaceFolder}/src/init-my-chart/init-my-chart.mjs",
+      "args": ["--dry-run"],
+      "cwd": "/Users/john/Work/leverege/cicd/@srv/pubsub-pulse",
+      "runtimeExecutable": "node",
+      "console": "integratedTerminal"
+    },
+    {
+      "name": "init-my-chart no helm dir",
+      "type": "node",
+      "request": "launch",
+      "program": "${workspaceFolder}/src/init-my-chart/init-my-chart.mjs",
+      "args": ["--dry-run"],
+      "cwd": "/Users/john/Work/leverege/cicd/@tst/iggy-pop",
+      "runtimeExecutable": "node",
+      "console": "integratedTerminal"
+    },
     {
       "name": "service-man (launch)",
       "type": "node",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.96.8",
+  "version": "2.97.0",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -84,27 +84,27 @@
     "chalk": "^5.6.2",
     "command-line-args": "^6.0.1",
     "command-line-usage": "^7.0.3",
-    "commander": "^14.0.2",
+    "commander": "^14.0.3",
     "deepmerge": "^4.3.1",
     "enquirer": "^2.4.1",
     "execa": "^9.6.1",
     "find-yarn-workspace-root": "^2.0.0",
-    "glob": "^13.0.0",
-    "googleapis": "^170.1.0",
+    "glob": "^13.0.6",
+    "googleapis": "^171.4.0",
     "handlebars": "^4.7.8",
     "ignore": "^7.0.5",
-    "inquirer": "^13.2.0",
+    "inquirer": "^13.2.5",
     "js-yaml": "^4.1.1",
     "jsdoc": "^4.0.5",
     "ms": "^2.1.3",
     "npm-registry-fetch": "^19.1.1",
-    "ora": "^9.0.0",
-    "p-limit": "^7.2.0",
+    "ora": "^9.3.0",
+    "p-limit": "^7.3.0",
     "package-up": "^5.0.0",
     "readline-sync": "^1.4.10",
-    "semver": "^7.7.3",
+    "semver": "^7.7.4",
     "shell-quote": "^1.8.3",
-    "simple-git": "^3.30.0",
+    "simple-git": "^3.31.1",
     "sloc": "^0.3.2",
     "superstruct": "^2.0.2",
     "tmp": "^0.2.5",
@@ -115,6 +115,6 @@
     "@leverege/eslint-config-leverege": "^5.1.2",
     "chai": "^6.2.2",
     "mocha": "^11.7.5",
-    "npm": "^11.7.0"
+    "npm": "^11.10.1"
   }
 }

package/src/Utils.mjs

@@ -570,7 +570,9 @@ export const parseHelmChart = async ( helmroot = './helm' ) => {
     registryProject : registryComponents[1],
     registryRepository : registryComponents[2],
     files : chartFiles,
-    yaml : {
+    Chart : chartYaml,
+    Values : valuesYaml,
+    yaml : { // DEPRECATED
       'Chart.yaml' : chartYaml,
       'values.yaml' : valuesYaml,
     }
@@ -612,6 +614,7 @@ export const analyzeRepository = async ( giveGuidance ) => {
     gitRoot,
     subPkgs,
     helmChart,
+    isGitRepo,
     isMonoRepo,
     isNodeJsProject,
     isPythonProject,
@@ -717,6 +720,7 @@ export const analyzeRepository = async ( giveGuidance ) => {
     gitRoot,
     gitRemote,
     helmChart,
+    isGitRepo,
     isMonoRepo,
     isNpmWorkspace,
     isNodeJsProject,
@@ -754,6 +758,7 @@ export function getSecretsDir() {
 }
 
 export function getIsYarnProject( gitRoot ) {
+  if ( !gitRoot ) { return false }
   // eslint-disable-next-line security/detect-non-literal-fs-filename
   return fs.existsSync( path.join( gitRoot, 'yarn.lock' ) ) || isDir( path.join( gitRoot, '.yarn' ) )
 }

package/src/artifacts/Utils.mjs

@@ -160,7 +160,7 @@ const parseGenericArtifactSchemaToArtifactName = ( genericArtifactSchema ) => {
 const calculateHash = async ( path ) => {
   try {
     const hash = crypto.createHash( 'sha256' )
-    hash.update( await fs.promises.readFile( path ) )
+    hash.update( await fs.promises.readFile( path ) ) // eslint-disable-line security/detect-non-literal-fs-filename
     return `${hash.digest( 'base64url' )}=`
   } catch ( error ) {
     throw new Error( `Failed to calculate hash for artifact ${path}: ${error.message}` )
@@ -200,6 +200,7 @@ const getMissingRemoteFiles = async ( genericArtifactFiles, genericArtifactSchem
     actualFiles.add( { remoteFilePath : actualRemoteFilePath, remoteFileHash : actualRemoteFileHash } )
   }
 
+  /* eslint-disable security/detect-non-literal-fs-filename */
   if ( ( await fs.promises.stat( expectedLocalRelativePath ) ).isDirectory() ) {
     const localFiles = await fs.promises.readdir( expectedLocalRelativePath, { withFileTypes : true, recursive : true } )
     for ( const localFile of localFiles ) {
@@ -209,6 +210,7 @@ const getMissingRemoteFiles = async ( genericArtifactFiles, genericArtifactSchem
 
       const expectedRemoteFilePath = path.join( expectedRemoteRelativePath, localFile.path.replace( expectedLocalRelativePath, '' ), localFile.name )
       const expectedLocalFilePath = path.join( localFile.path, localFile.name )
+      // eslint-disable-next-line no-await-in-loop
       expectedFiles.add( { remoteFilePath : expectedRemoteFilePath, remoteFileHash : await calculateHash( expectedLocalFilePath ) } )
     }
   } else {
@@ -216,6 +218,7 @@ const getMissingRemoteFiles = async ( genericArtifactFiles, genericArtifactSchem
     const expectedLocalFilePath = expectedLocalRelativePath
     expectedFiles.add( { remoteFilePath : expectedRemoteFilePath, remoteFileHash : await calculateHash( expectedLocalFilePath ) } )
   }
+  /* eslint-enable security/detect-non-literal-fs-filename */
 
   const actualArray = Array.from( actualFiles )
   const expectedArray = Array.from( expectedFiles )
@@ -243,7 +246,7 @@ const shouldUseIgnoreConfiguration = async () => {
 const findIgnoreFilePath = async ( relativePath ) => {
   if ( relativePath ) {
     const ignoreFilePath = path.join( relativePath, '.gcloudignore' )
-    if ( fs.existsSync( ignoreFilePath ) ) {
+    if ( fs.existsSync( ignoreFilePath ) ) { // eslint-disable-line security/detect-non-literal-fs-filename
       return ignoreFilePath
     }
   }

package/src/build-cnpg-image.mjs

@@ -102,7 +102,6 @@ RUN set -xe; \\
     apt-get update; \\
     apt-get install -y --no-install-recommends \\
         "postgresql-\${PG_MAJOR}-jsquery" \\
-        "postgresql-\${PG_MAJOR}-repack" \\
         "postgresql-\${PG_MAJOR}-squeeze"; \\
         ln -s /usr/lib/postgresql/\${PG_MAJOR}/bin/pg_repack /usr/local/bin/pg_repack || true; \\
     rm -fr /tmp/*; \\

package/src/chart-compass.yaml

@@ -11,7 +11,7 @@
       messenger: {}
       reason: {}
       resource-server: {}
-      rule-enginer: {}
+      rule-engine: {}
       scheduler: {}
 
       transponder:

package/src/chart-to-registry.mjs

@@ -41,6 +41,11 @@ const commandLineOptions = [ // Use commandLineOptions to tie into the Usage sta
     type : String,
     description : '{green the target repository to receive the pushed chart}',
   },
+  {
+    name : 'auth-only',
+    type : Boolean,
+    description : '{green update artifact registry auth token and exit}',
+  },
   {
     name : 'dry-run',
     type : Boolean,
@@ -100,7 +105,11 @@ const registryProject = args.project || helmChart.registryProject
 const registryRepository = args.repository || helmChart.registryRepository
 
 // deal with oauth token shenanigans
-await establishOauthAccess( registryLocation )
+const oauthResults = await establishOauthAccess( registryLocation )
+debug( { oauthResults, registryLocation }, '<===OAuth Login' )
+if ( args.authOnly ) {
+  process.exit( 0 )
+}
 
 let ociPushEndpoint = `oci://${registryLocation}/${registryProject}/${registryRepository}`
 // charts that are type "library" are base charts used via chart dependencies, however if

package/src/helm-charts/api-server/values-local.yaml

@@ -16,6 +16,9 @@ config:
   PG_MODELS_HOST: "cnpg-db-psql-stack-rw.cnpg-operands"
   # timescale
   PG_HOST: "cnpg-db-tsdb-basic-r.cnpg-operands"
+  # imagine db is legacy - newer setups use timescale as the db name
+  PG_DATABASE: "timescale"
+  PG_DENSE_HISTORY_DATABASE: "timescale"
 
 # The settings on the left are for the "standard" legacy chart settings which
 # specifiy the old k8s secrets setups and are the defaults values from the

package/src/helm-charts/cnpg-db-psql-stack/cluster.yaml.ovh

@@ -4,22 +4,21 @@ metadata:
   name: cnpg-db-psql-stack
   namespace: cnpg-operands
 spec:
-  # https://cloudnative-pg.io/documentation/current/cloudnative-pg.v1/#postgresql-cnpg-io-v1-ClusterSpec
   instances: 1
   logLevel: info # warning debug
 
   monitoring:
-    enablePodMonitor: false # set true once monitoring is setup
+    enablePodMonitor: true # set true once monitoring is setup
 
-  # https://console.cloud.google.com/artifacts/docker/leverege-registry/us/system/images%2Fleverege-pgsql?project=leverege-registry
-  imageName: us-docker.pkg.dev/leverege-registry/system/images/leverege-pgsql:17.5-cnpg-lvrg-rel.1
   description: "Leverege Stack PostgreSQL DB"
+  imageName: us-docker.pkg.dev/leverege-registry/system/images/leverege-pgsql:17.6-cnpg-lvrg-final
   bootstrap:
     initdb:
-#     database: models # do not set - let it default to cnpg app db
-      postInitSQL:
-        # create the extensions
+      postInitTemplateSQL:
+        # load necessary extensions for stack psql
         - CREATE EXTENSION pg_stat_statements;
+        - CREATE EXTENSION pg_squeeze;
+
         # create the stack databases
         - CREATE DATABASE authz;
         - CREATE DATABASE fota;
@@ -27,23 +26,18 @@ spec:
         - CREATE DATABASE models;
         - CREATE DATABASE scheduler;
 
-  # we use superuser access for backwards compatibility with legacy (aka lazy)
+  # TODO: move away from superuser access
   enableSuperuserAccess: true
   superuserSecret:
     name: cnpg-db-psql-stack-postgres-pw # postgres db pw created by helmup
 
-  # Require 50Gi of space per instance using ssd storage class
-  storage:
-    storageClass: premium-rwo
-    size: 50Gi
-# walStorage:
-#   storageClass: premium-rwo
-#   size: 1Gi
-
-  # customize psql settings - be careful - should be tuned
+  # Parameters will be merged with defaults
   postgresql:
+    shared_preload_libraries:
+      - pg_stat_statements
+      - pg_squeeze
     parameters:
-#     max_connections: "100"
+      max_connections: "64" # def: 100
 #     max_worker_processes: "60"
 #     max_worker_processes: "8"
 #     max_parallel_workers: "8"
@@ -52,12 +46,32 @@ spec:
 #     maintenance_work_mem: 1GB
 #     work_mem: 20MB
 
-  postgresql:
-    shared_preload_libraries:
-      - pg_stat_statements
+  # define main PVC storage class and size, plus WAL storage
+  storage:
+    storageClass: premium-rwo
+    size: 64Gi
+  walStorage:
+    storageClass: premium-rwo
+    size: 16Gi
+
+  resources:
+#   limit:
+#     cpu: 1000m
+#     memory: 8Gi
+    requests:
+      cpu: 500m
+      memory: 1Gi
+
+  # See Rolling Update section in docs https://cloudnative-pg.io/docs/1.27/rolling_update
+  primaryUpdateStrategy: unsupervised
+  primaryUpdateMethod: switchover
+
+  serviceAccountTemplate:
+    metadata:
+      annotations:
+        iam.gke.io/gcp-service-account: cnpg-operands-sa@${PROJECT_ID}.iam.gserviceaccount.com
 
   backup:
-    retentionPolicy: 7d # don't think this does anything?
     volumeSnapshot:
       labels:
         snapshotOf: cnpg-db-psql-stack
@@ -72,16 +86,7 @@ spec:
         compression: gzip
         maxParallel: 4
 
-  # Method to follow to upgrade the primary server during a rolling update procedure,
-  # after all replicas have been successfully updated - default is restart
-  primaryUpdateMethod: switchover
-
-  serviceAccountTemplate:
-    metadata:
-      annotations:
-        iam.gke.io/gcp-service-account: cnpg-operands-sa@${PROJECT_ID}.iam.gserviceaccount.com
-
-  # affinity and toleration to control node pool placement, typically on database pool
+  # affinity and toleration to control pod placement
   affinity:
     enablePodAntiAffinity: true
     topologyKey: kubernetes.io/hostname # default value

package/src/helm-charts/cnpg-db-psql-stack/pooler.yaml

@@ -18,3 +18,5 @@ spec:
       # https://www.pgbouncer.org/config.html#log-settings
       log_connections: "0"
       log_disconnections: "0"
+  monitoring:
+    enablePodMonitor: true

package/src/helm-charts/cnpg-db-recovery/cluster.yaml.ovh

@@ -8,7 +8,7 @@ spec:
   logLevel: info # warning debug
 
   monitoring:
-    enablePodMonitor: false # set true once monitoring is setup
+    enablePodMonitor: true # set true once monitoring is setup
 
   description: "Leverege CNPG DB (recovered)"
   imageName: us-docker.pkg.dev/leverege-registry/system/images/leverege-pgsql:17.2-cnpg-lvrg-rel.2

package/src/helm-charts/cnpg-db-tsdb-basic/cluster.yaml.ovh

@@ -8,54 +8,36 @@ spec:
   logLevel: info # warning debug
 
   monitoring:
-    enablePodMonitor: false # set true once monitoring is setup
+    enablePodMonitor: true # set true once monitoring is setup
 
   description: "Leverege Plain Timescale DB"
-  imageName: us-docker.pkg.dev/leverege-registry/system/images/leverege-pgsql:17.5-cnpg-lvrg-rel.1
+  imageName: us-docker.pkg.dev/leverege-registry/system/images/leverege-pgsql:17.6-cnpg-lvrg-final
   bootstrap:
     initdb:
-#     database: imagine # let it default to cnpg app db
       postInitTemplateSQL:
+        # load necessary extensions for timescale
+        - CREATE EXTENSION pg_stat_statements;
+        - CREATE EXTENSION pg_squeeze;
         - CREATE EXTENSION timescaledb;
         - CREATE EXTENSION jsquery;
-        - CREATE EXTENSION pg_stat_statements;
-        - CREATE DATABASE imagine;
-#       - CREATE DATABASE app; # for the operator restores
-#       - CREATE ROLE app;     # same
-#     owner: imagine
-#     secret:
-#       name: cnpg-db-tsdb-basic-imagine-pw # imagine db pw
 
+        # we only need the timescale database
+        - CREATE DATABASE timescale;
+
+  # TODO: move away from superuser access
   enableSuperuserAccess: true
   superuserSecret:
     name: cnpg-db-tsdb-basic-postgres-pw # postgres db pw
 
-  affinity:
-    enablePodAntiAffinity: true
-    topologyKey: kubernetes.io/hostname # default value
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: target-env
-            operator: In
-            values:
-            - database
-    tolerations:
-      - key: "database"
-        operator: "Equal"
-        value: "true"
-        effect: "NoSchedule"
-
-  # Parameters and pg_hba configuration will be append
-  # to the default ones to make the cluster work
+  # Parameters will be merged with defaults
   postgresql:
     shared_preload_libraries:
+      - pg_stat_statements
+      - pg_squeeze
       - timescaledb
       - jsquery
-      - pg_stat_statements
     parameters:
-#     max_connections: "100"
+      max_connections: "64" # def: 100
 #     max_worker_processes: "60"
 #     max_worker_processes: "8"
 #     max_parallel_workers: "8"
@@ -63,27 +45,31 @@ spec:
 #     effective_cache_size: 6GB
 #     maintenance_work_mem: 1GB
 #     work_mem: 20MB
-    pg_hba:
-      # To access through TCP/IP you will need to get username
-      # and password from the secret cluster-example-custom-app
-      - host all all all md5
 
-  # Example of rolling update strategy:
-  # - unsupervised: automated update of the primary once all
-  #                 replicas have been upgraded (default)
-  # - supervised: requires manual supervision to perform
-  #               the switchover of the primary
+  # define main PVC storage class and size, plus WAL storage
+  storage:
+    storageClass: premium-rwo
+    size: 64Gi
+  walStorage:
+    storageClass: premium-rwo
+    size: 16Gi
+
+  resources:
+#   limit:
+#     cpu: 1000m
+#     memory: 8Gi
+    requests:
+      cpu: 500m
+      memory: 1Gi
+
+  # See Rolling Update section in docs https://cloudnative-pg.io/docs/1.27/rolling_update
   primaryUpdateStrategy: unsupervised
   primaryUpdateMethod: switchover
 
   serviceAccountTemplate:
     metadata:
       annotations:
-        iam.gke.io/gcp-service-account: cnpg-operands-sa@OVH:<PROJECT_ID>.iam.gserviceaccount.com
-
-  storage:
-    storageClass: premium-rwo
-    size: 76Gi
+        iam.gke.io/gcp-service-account: cnpg-operands-sa@${PROJECT_ID}.iam.gserviceaccount.com
 
   backup:
     volumeSnapshot:
@@ -91,7 +77,7 @@ spec:
         snapshotOf: cnpg-db-tsdb-basic
       className: cnpg-snapshotclass
     barmanObjectStore:
-      destinationPath: gs://OVH:<PROJECT_ID>-barman
+      destinationPath: gs://${PROJECT_ID}-barman
       googleCredentials:
         gkeEnvironment: true
       tags:
@@ -99,6 +85,24 @@ spec:
       wal:
         compression: gzip
         maxParallel: 4
+
+  # affinitiy and toleration to control pod placement
+  affinity:
+    enablePodAntiAffinity: true
+    topologyKey: kubernetes.io/hostname # default value
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: target-env
+            operator: In
+            values:
+            - database
+    tolerations:
+      - key: "database"
+        operator: "Equal"
+        value: "true"
+        effect: "NoSchedule"
 ---
 apiVersion: postgresql.cnpg.io/v1
 kind: ScheduledBackup

package/src/helm-charts/cnpg-db-tsdb-basic/pooler.yaml

@@ -18,3 +18,5 @@ spec:
       # https://www.pgbouncer.org/config.html#log-settings
       log_connections: "0"
       log_disconnections: "0"
+  monitoring:
+    enablePodMonitor: true

package/src/helm-charts/cnpg-db-tsdb-dense/cluster.yaml.ovh

@@ -8,77 +8,67 @@ spec:
   logLevel: info # warning debug
 
   monitoring:
-    enablePodMonitor: false # set true once monitoring is setup
+    enablePodMonitor: true # set true once monitoring is setup
 
   description: "Leverege Dense Timescale DB"
-  imageName: us-docker.pkg.dev/leverege-registry/system/images/leverege-pgsql:17.5-cnpg-lvrg-rel.1
+  imageName: us-docker.pkg.dev/leverege-registry/system/images/leverege-pgsql:17.6-cnpg-lvrg-final
   bootstrap:
     initdb:
       postInitTemplateSQL:
+        - CREATE EXTENSION pg_stat_statements;
+        - CREATE EXTENSION pg_squeeze;
         - CREATE EXTENSION timescaledb;
         - CREATE EXTENSION jsquery;
-        - CREATE EXTENSION pg_stat_statements;
-        - CREATE DATABASE imagine; # leverege tsdb db
-#     secret:
-#       name: cnpg-db-tsdb-dense-imagine-pw # imagine db pw
 
+        # we only need the timescale database
+        - CREATE DATABASE timescale;
+
+  # TODO: move away from superuser access
   enableSuperuserAccess: true
   superuserSecret:
     name: cnpg-db-tsdb-dense-postgres-pw # postgres db pw
 
-  affinity:
-    enablePodAntiAffinity: true
-    topologyKey: kubernetes.io/hostname # default value
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: target-env
-            operator: In
-            values:
-            - database
-    tolerations:
-      - key: "database"
-        operator: "Equal"
-        value: "true"
-        effect: "NoSchedule"
-
-  # Parameters and pg_hba configuration will be append
-  # to the default ones to make the cluster work
+  # Parameters will be merged with defaults
   postgresql:
     shared_preload_libraries:
+      - pg_stat_statements
+      - pg_squeeze
       - timescaledb
       - jsquery
-      - pg_stat_statements
     parameters:
+      max_connections: "64" # def: 100
 #     max_worker_processes: "60"
-      max_worker_processes: "8"
-      max_parallel_workers: "8"
-      shared_buffers: 2GB
-      effective_cache_size: 6GB
-      maintenance_work_mem: 1GB
-      work_mem: 20MB
-    pg_hba:
-      # To access through TCP/IP you will need to get username
-      # and password from the secret cluster-example-custom-app
-      - host all all all md5
+#     max_worker_processes: "8"
+#     max_parallel_workers: "8"
+#     shared_buffers: 2GB
+#     effective_cache_size: 6GB
+#     maintenance_work_mem: 1GB
+#     work_mem: 20MB
 
-  # Example of rolling update strategy:
-  # - unsupervised: automated update of the primary once all
-  #                 replicas have been upgraded (default)
-  # - supervised: requires manual supervision to perform
-  #               the switchover of the primary
+  # define main PVC storage class and size, plus WAL storage
+  storage:
+    storageClass: premium-rwo
+    size: 96Gi
+  walStorage:
+    storageClass: premium-rwo
+    size: 16Gi
+
+  resources:
+#   limit:
+#     cpu: 1000m
+#     memory: 8Gi
+    requests:
+      cpu: 500m
+      memory: 1Gi
+
+  # See Rolling Update section in docs https://cloudnative-pg.io/docs/1.27/rolling_update
   primaryUpdateStrategy: unsupervised
   primaryUpdateMethod: switchover
 
   serviceAccountTemplate:
     metadata:
       annotations:
-        iam.gke.io/gcp-service-account: cnpg-operands-sa@OVH:<PROJECT_ID>.iam.gserviceaccount.com
-
-  storage:
-    storageClass: premium-rwo
-    size: 77Gi
+        iam.gke.io/gcp-service-account: cnpg-operands-sa@${PROJECT_ID}.iam.gserviceaccount.com
 
   backup:
     volumeSnapshot:
@@ -86,7 +76,7 @@ spec:
         snapshotOf: cnpg-db-tsdb-dense
       className: cnpg-snapshotclass
     barmanObjectStore:
-      destinationPath: gs://OVH:<PROJECT_ID>-barman
+      destinationPath: gs://${PROJECT_ID}-barman
       googleCredentials:
         gkeEnvironment: true
       tags:
@@ -94,6 +84,24 @@ spec:
       wal:
         compression: gzip
         maxParallel: 4
+
+  # affinity and tolerations to control pod placement
+  affinity:
+    enablePodAntiAffinity: true
+    topologyKey: kubernetes.io/hostname # default value
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: target-env
+            operator: In
+            values:
+            - database
+    tolerations:
+      - key: "database"
+        operator: "Equal"
+        value: "true"
+        effect: "NoSchedule"
 ---
 apiVersion: postgresql.cnpg.io/v1
 kind: ScheduledBackup

package/src/helm-charts/cnpg-db-tsdb-dense/pooler.yaml

@@ -18,3 +18,5 @@ spec:
       # https://www.pgbouncer.org/config.html#log-settings
       log_connections: "0"
       log_disconnections: "0"
+  monitoring:
+    enablePodMonitor: true

package/src/helm-charts/cnpg-operator/helmup.bootstrap

@@ -207,3 +207,11 @@ CNPG_CLEANUP_CRONJOB_APPLY
 # Run it!
 installCnpgOperatorEnvironment
 installCnpgCleanupCronjob
+
+# --- cert-manager (cluster-wide dependency for barman plugin) ---
+CM_VER="1.14.5"
+kubectl apply -f "https://github.com/cert-manager/cert-manager/releases/download/v${CM_VER}/cert-manager.yaml"
+
+kubectl rollout status deployment -n cert-manager cert-manager
+kubectl rollout status deployment -n cert-manager cert-manager-webhook
+kubectl rollout status deployment -n cert-manager cert-manager-cainjector