feat: Added patch for restoring database

apps/lldap/base/cluster-restore.yaml

@@ -0,0 +1,16 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: lldap-db
+spec:
+  bootstrap:
+    recovery:
+      source: source
+  externalClusters:
+    - name: source
+      plugin:
+        name: barman-cloud.cloudnative-pg.io
+        parameters:
+          barmanObjectName: garage-store
+          serverName: lldap-db
+  plugins: []

apps/lldap/base/cluster.yaml

@@ -8,3 +8,8 @@ spec:
   storage:
     size: 8Gi
     storageClass: local-path
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: garage-store

apps/lldap/base/kustomization.yaml

@@ -3,6 +3,15 @@ kind: Kustomization
 resources:
   - namespace.yaml
   - cluster.yaml
+  - schedule-backup.yaml
   - deployment.yaml
   - service.yaml
   - http-route.yaml
+  - secret-s3-garage.yaml
+  - object-store.yaml
+
+# Uncomment to restore database from backup
+# patches:
+#   - path: cluster-restore.yaml
+#     target:
+#       kind: Cluster

apps/lldap/base/object-store.yaml

@@ -2,11 +2,10 @@ apiVersion: barmancloud.cnpg.io/v1
 kind: ObjectStore
 metadata:
   name: garage-store
-  namespace: cnpg-system
+  namespace: lldap
 spec:
   configuration:
-    destinationPath: s3://cnpg-backup/
+    destinationPath: s3://cnpg-backup/lldap
-    endpointURL: http://192.178.1.1:3900
     s3Credentials:
       accessKeyId:
         name: s3-garage
@@ -14,5 +13,8 @@ spec:
       secretAccessKey:
         name: s3-garage
         key: ACCESS_SECRET_KEY
+      region:
+        name: s3-garage
+        key: REGION
     wal:
       compression: gzip

apps/lldap/base/schedule-backup.yaml

@@ -0,0 +1,13 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: daily-backup
+  namespace: lldap
+spec:
+  schedule: "0 0 0 * * *"
+  backupOwnerReference: self
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io
+  cluster:
+    name: db

apps/lldap/base/secret-s3-garage.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-garage
+  namespace: lldap
+  annotations:
+    reflector.v1.k8s.emberstack.com/reflects: "cnpg-system/s3-garage"
+type: Opaque
+data: {}

apps/lldap/production/cluster.yaml

@@ -1,6 +1,6 @@
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
-  name: postgres
+  name: db
 spec:
   instances: 2

apps/lldap/production/secret-credentials.enc.yaml

@@ -8,8 +8,9 @@ metadata:
         app.kubernetes.io/instance: lldap
 type: Opaque
 data:
-    jwt-secret: ENC[AES256_GCM,data:cwKfSMzPPECNAba++x5ampK0pgCvOKRIEdPfLH5deDpnEASSlBjQZVo238YepBIAYu7Y0HCXCPppOtpX8zymD7Jxu1f5TrJoOJMwAlHYWT+IeBRVtpzgYA==,iv:bkNDqEriEnuSzvXxXAypGfwynPjYCVwN0NoAmcDftUc=,tag:DFkoIf92W8Ed60+azsfU+A==,type:str]
+    jwt-secret: ENC[AES256_GCM,data:yUAsoCIEXH491Ko4wEAAevSETdMFuhypNzuU2th5zlLd9hbVKqsjclvCTLDD8aW0Y9Lv70pzzAADPwFCKNH/rXx0DzaGOP139kLRYDHafz3RYeuoJjgBGw==,iv:x3EmPbbL/aj9CbwF8lleDL+nhlidPU8R3hwXygtj7D8=,tag:XD4C/pwFLFmDryBW7NqsWg==,type:str]
-    key-seed: ENC[AES256_GCM,data:bLpK9Tk5Eh2WBI5x94MssCyYEsMUMTJJymbdwsVeA6K/qBCxkPGkXf+kZZoaXkyLqW2lrPa8jIGv3LV6C4PqVJ+UOlgnvagQnCGnLylqX+3wkVhKLP5uYg==,iv:1RPLzof2Fwqm08Tfq7HR2esvPvkfBg0Uc+aM2SzpHhE=,tag:IsgLxUQriU9JUX2gEe/j8A==,type:str]
+    key-seed: ENC[AES256_GCM,data:3jWLtfny+ahtSkkmUdbg+wFbSGIcCxOv9BxVr0oNLTetXrAx+OcZ6dKp1ktj0J9aYEppqVuANUlfqyVzhIQXOT5GomQ+9jPC4uLmIz9tu1LAcfv9zuGl/w==,iv:e3aAI6JWq16YaUZqvKulkHyhLb8eWy9t2ni/jGeNFow=,tag:sZEEvxlq145klFkEMsUOuA==,type:str]
+    #ENC[AES256_GCM,data:AnCuvbVM6M62wuWmpUx3u/5WdaCo1T7eCvbY30okKbmWnvM0HQT2gGDTuhIaOlc=,iv:Ho+/CAvs69VJ+uwAIH8LVL344qlDaK5z3AvzWh/Jgm0=,tag:uNfN1P7lmWKBuCY7eiywDw==,type:comment]
     admin-pass: ENC[AES256_GCM,data:yWzQTjN8kuGroShan7NxAw==,iv:IHw237PAqNNZ7KXIy2D8XMCLWSi3kJpLEnILhGm/Xl4=,tag:N79GjKNZNh9qJO+dpa0InQ==,type:str]
 sops:
     age:
@@ -31,8 +32,8 @@ sops:
             OVNqZnhRUEN5dTBBVXVlSDlidEU4K3cKhv2jSc+lJu+s3hbH6j1xrkaQSzds82rk
             dlaisVQxQmxjKcyPHqudJZS6Qfq3kEn9cZOP4G8NYAh0zhzGvCKeqA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-17T00:53:29Z"
+    lastmodified: "2025-12-17T02:58:02Z"
-    mac: ENC[AES256_GCM,data:6/I2J7u9fGUdz2SbAF7dL2j5XQMICx+AgEaUQ3HUN/RvlhMzn9J3EdcLFQ+d9YwbSpCzuGTQBfqsky2oaD6fQWWefCOXAVdElCp2rxHAGK9u2pqhPbgcvbHKAWfvK2kml8qhjjam346xpj2yeP8UdWq6+KZq8B5OBsKYtx4KuKM=,iv:EeLpcggrglMvpUdjvH6rOyNRj2EkuToIwc+uEPUnlvI=,tag:juTwo5RbhGnddB3MF3WirQ==,type:str]
+    mac: ENC[AES256_GCM,data:yxmBIqS+KMr2Dp4eKslT1oNCcq2VEnGh4g3e7mkZzWjT6xPTdBEH8bT+c2XIFMWHJSUFoI7YyhvS1p5VgRBudaDyQCOk7tzyj0nkGiepZc1uYjSVO7VQ9CnfcdiD9AZ2srUjkcUoBaRfi2u6Qh2pPUUwMd4z8ms8v0CSk1qw0FE=,iv:V2rw624TN+pSGuq+JjVqM2bKozn7hGAykHV+638wo14=,tag:cdDascdYzzG33GztMd0Fdg==,type:str]
     pgp:
         - created_at: "2025-12-17T00:53:29Z"
           enc: |-

apps/lldap/staging/cluster.yaml

@@ -1,6 +1,6 @@
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
-  name: postgres
+  name: db
 spec:
   instances: 1

apps/lldap/staging/kustomization.yaml

@@ -10,6 +10,9 @@ patches:
   - path: cluster.yaml
     target:
       kind: Cluster
+  - path: object-store.yaml
+    target:
+      kind: ObjectStore
   - path: http-route.yaml
     target:
       kind: HTTPRoute

apps/lldap/staging/object-store.yaml

@@ -0,0 +1,8 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: garage-store
+  namespace: lldap
+spec:
+  configuration:
+    endpointURL: http://192.168.1.1:3900

clusters/testing/kustomization.yaml

@@ -9,6 +9,7 @@ resources:
   - ../../controllers/longhorn/longhorn.yaml
   - ../../controllers/local-path-provisioner/local-path-provisioner.yaml
   - ../../controllers/cnpg/cnpg.yaml
+  - ../../controllers/reflector/reflector.yaml
 
   - ../../configs/artifacts.yaml
   - ../../configs/cilium-config/cilium-config.yaml

controllers/artifacts.yaml

@@ -39,3 +39,8 @@ spec:
       copy:
         - from: "@foundation/controllers/cnpg/**"
           to: "@artifact/"
+    - name: reflector
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/reflector/**"
+          to: "@artifact/"

controllers/cnpg/staging/kustomization.yaml

@@ -3,7 +3,6 @@ kind: Kustomization
 resources:
   - ../base
   - secret-s3-garage.enc.yaml
-  - object-store.yaml
 
 configMapGenerator:
   - name: values-overlay

controllers/cnpg/staging/secret-s3-garage.enc.yaml

@@ -3,10 +3,13 @@ kind: Secret
 metadata:
     name: s3-garage
     namespace: cnpg-system
+    annotations:
+        reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
 type: Opaque
 stringData:
     ACCESS_KEY_ID: ENC[AES256_GCM,data:TOEQMG/kHs5XUk77ijyV089ZTq1dKsoZUas=,iv:mVDOkl5qOxGdvCvdcXUuUjX85oKqbd+n5maHsKwCiFg=,tag:pho0oWPTwtM6lGQ2vA1d5A==,type:str]
-    SECRET_ACCESS_KEY: ENC[AES256_GCM,data:mc42T/AQ8NRi32SzvwGJA6LEq1x0Yz3Tu+CPDYPf+E2+C00zQcGRk6tACPvRoMxRzU4ZZpK346e2K/8ajU77hg==,iv:Isxe81aQEbI5xd1dRjXDKj/2Jp9eTHdv0/XVBBHoRyE=,tag:gtcmKmfUIfIy977Df11P4g==,type:str]
+    ACCESS_SECRET_KEY: ENC[AES256_GCM,data:INipEOcpPSij6TDu+bCuMOdsGm58nEBC4UJfEGRqeMmXZ9A+EBrMiRL6z3s29uz4qdqwZ3C8E4PVz01/41bMEA==,iv:x+gku8q7efHaaMpD/dc19IrwmK2gDp04bjH8WN/xhkc=,tag:QiSF6B8IqMrCsOUCe8c0bw==,type:str]
+    REGION: ENC[AES256_GCM,data:WIGPWwii,iv:ZdP5uNYqa8CZxa/xyrYXxGvE9fzt95slzwpzSzRy9DY=,tag:yANYtLzJCL/1pcvBXY7X7g==,type:str]
 sops:
     age:
         - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
@@ -27,8 +30,8 @@ sops:
             K09tZGI0Z2w0eXh5eHcvcEttMy82aU0K2fnCDfYIShzw2Zipof+C8zf9pcOmiDg9
             2SCiIfAJs9MB3n078P068z77KpvdlJYOi9pUTKSBhNw+mBI24y6X6A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-15T03:46:42Z"
+    lastmodified: "2025-12-18T02:50:50Z"
-    mac: ENC[AES256_GCM,data:UG9rSQ4ep7Ln4g5QCtvD6U90Oc8iWpni+kypMpJ+AQM8LC0TTs9zFQgcxmo2wjZn38Fp+br/5KC172SqBNG4Q1yXhlRiqiIeyx9ynrZeceRSqHaaruB1hj83/0FwahqjB/t6yutWIfnp00UC92mMKGlef48UNZ8IW17e5uHE0m4=,iv:LvR4BEkgAr6PJ8fYATFois4j8/rgztn/Jggj/mFgCIk=,tag:W38qDd1RkCdK3bVMqOVnjA==,type:str]
+    mac: ENC[AES256_GCM,data:+kfs0EDnnZNnHMf91P6rAN52lugHFO4XcNJiKLpXt7bfTSMbiwgVbvRElXGTbLXLVSz70uZyzV/mt0ZcfEfPbwE/Pdh6SmFiWwQwLT1M50MdrxAWWYvSCS9r4h1Cow3N3K2/dXH7N/4AVHTg3ohXlP92fxVh1wL0cVnke/lcQgY=,iv:M5n9+lgq0fBx5Yg1e0N6v0obbnmarvVwIHAjCr5XmM4=,tag:NBA01MtG40T3nST7b00tiw==,type:str]
     pgp:
         - created_at: "2025-12-11T23:56:15Z"
           enc: |-

controllers/reflector/helm-release.yaml

@@ -0,0 +1,23 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: reflector
+  namespace: reflector
+spec:
+  interval: 12h
+  install:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 2m
+  upgrade:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 3m
+  chart:
+    spec:
+      chart: reflector
+      version: "9.1.x"
+      sourceRef:
+        kind: HelmRepository
+        name: reflector
+      interval: 24h

controllers/reflector/helm-repository.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: reflector
+  namespace: reflector
+spec:
+  type: "oci"
+  interval: 24h
+  url: oci://ghcr.io/emberstack/helm-charts

controllers/reflector/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-repository.yaml
+  - helm-release.yaml

controllers/reflector/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: reflector

controllers/reflector/reflector.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: reflector
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: ExternalArtifact
+    name: reflector
+  path: ./
+  prune: true
+  wait: true