apiVersion: pgv2.percona.com/v2
kind: PerconaPGCluster
metadata:
  name: cluster1
#  annotations:
#    test-annotation: value
#  finalizers:
#  - percona.com/delete-pvc
#  - percona.com/delete-ssl
#  - percona.com/delete-backups
spec:
  crVersion: 3.1.0
#  clusterServiceDNSSuffix: cluster.local
#  initContainer:
#    image: docker.io/percona/percona-postgresql-operator:3.1.0
#    resources:
#      limits:
#        cpu: 2.0
#        memory: 4Gi
#      requests:
#        cpu: 1.0
#        memory: 3Gi
#    containerSecurityContext:
#      runAsUser: 1001
#      runAsGroup: 1001
#      runAsNonRoot: true
#      privileged: false
#      allowPrivilegeEscalation: false
#      readOnlyRootFilesystem: true
#      capabilities:
#        add:
#          - NET_ADMIN
#          - SYS_TIME
#        drop:
#          - ALL
#      seccompProfile:
#        type: Localhost
#        localhostProfile: localhost/profile.json
#      procMount: Default
#      seLinuxOptions:
#        type: spc_t
#        level: s0:c123,c456
#  metadata:
#    annotations:
#      example-annotation: value
#    labels:
#      example-label: value
#  secrets:
#    customRootCATLSSecret:
#      name: cluster1-ca-cert
#      items:
#        - key: "tls.crt"
#          path: "root.crt"
#        - key: "tls.key"
#          path: "root.key"
#    customTLSSecret:
#      name: cluster1-cert
#    customReplicationTLSSecret:
#      name: replication1-cert
#  tlsOnly: false
#  tls:
#    certManagementPolicy: auto
#    certValidityDuration: 2160h
#    caValidityDuration: 26280h
#    pgBackRestCertValidityDuration: 2160h
#    issuerConf:
#      name: some-selfsigned-issuer
#      kind: ClusterIssuer
#      group: cert-manager.io
#  standby:
#    enabled: true
#    host: "<primary-ip>"
#    port: "<primary-port>"
#    repoName: repo1
#    maxAcceptableLag: 1Gi

#  openshift: true

#  autoCreateUserSchema: true

#  config:
#    files:
#      - secret:
#          name: my-ldap-ca-cert
#          items:
#            - key: ca.crt
#              path: ldap-ca.crt

#  authentication:
#    rules:
#      - connection: host
#        method: ldap
#        databases: []
#        users: []
#        options:
#          ldapserver: ldap.example.com
#          ldapport: "636"
#          ldaptls: "1"
#          ldapbasedn: dc=example,dc=com
#          ldapbinddn: cn=admin,dc=example,dc=com
#          ldapbindpasswd: secret
#          ldapsearchattribute: uid
#      - hba: "host all all 10.0.0.0/8 md5"

#  users:
#    - name: rhino
#      databases:
#        - zoo
#      options: "SUPERUSER"
#      password:
#        type: ASCII
#      secretName: "rhino-credentials"
#      grantPublicSchemaAccess: false

#  databaseInitSQL:
#    key: init.sql
#    name: cluster1-init-sql

#  pause: true
#  unmanaged: true
#  dataSource:
#    postgresCluster:
#      clusterName: cluster1
#      clusterNamespace: cluster1-namespace
#      repoName: repo1
#      options:
#      - --type=time
#      - --target="2021-06-09 14:15:11-04"
#      tolerations:
#      - effect: NoSchedule
#        key: role
#        operator: Equal
#        value: connection-poolers
#    pgbackrest:
#      stanza: db
#      configuration:
#      - secret:
#          name: pgo-s3-creds
#      global:
#        repo1-path: /pgbackrest/postgres-operator/hippo/repo1
#      repo:
#        name: repo1
#        s3:
#          bucket: "my-bucket"
#          endpoint: "s3.ca-central-1.amazonaws.com"
#          region: "ca-central-1"
#      tolerations:
#      - effect: NoSchedule
#        key: role
#        operator: Equal
#        value: connection-poolers
#    volumes:
#      pgDataVolume:
#        pvcName: cluster1
#        directory: cluster1
#        tolerations:
#        - effect: NoSchedule
#          key: role
#          operator: Equal
#          value: connection-poolers
#        annotations:
#          test-annotation: value
#        labels:
#          test-label: value
#      pgWALVolume:
#        pvcName: cluster1-pvc-name
#        directory: some-dir
#        tolerations:
#        - effect: NoSchedule
#          key: role
#          operator: Equal
#          value: connection-poolers
#        annotations:
#          test-annotation: value
#        labels:
#          test-label: value
#      pgBackRestVolume:
#        pvcName: cluster1-pgbr-repo
#        directory: cluster1-backrest-shared-repo
#        tolerations:
#        - effect: NoSchedule
#          key: role
#          operator: Equal
#          value: connection-poolers
#        annotations:
#          test-annotation: value
#        labels:
#          test-label: value


  image: docker.io/percona/percona-distribution-postgresql:18.6.1-1
  imagePullPolicy: Always
  postgresVersion: 18
#  port: 5432

#  expose:
#    annotations:
#      my-annotation: value1
#    labels:
#      my-label: value2
#    type: LoadBalancer
#    loadBalancerClass: "eks.amazonaws.com/nlb"
#    loadBalancerSourceRanges:
#      - 10.0.0.0/8
#  exposeReplicas:
#    annotations:
#      my-annotation: value1
#    labels:
#      my-label: value2
#    type: LoadBalancer
#    loadBalancerClass: "eks.amazonaws.com/nlb"
#    loadBalancerSourceRanges:
#      - 10.0.0.0/8

  instances:
  - name: instance1
    replicas: 3
#    env:
#    - name: MY_ENV
#      value: "1000"
#    envFrom:
#    - secretRef:
#        name: instance-env-secret
#    initContainer:
#      image: docker.io/percona/percona-postgresql-operator:3.1.0
#      resources:
#        limits:
#          cpu: 2.0
#          memory: 4Gi
#      containerSecurityContext:
#        runAsUser: 1001
#        runAsGroup: 1001
#        runAsNonRoot: true
#        privileged: false
#        allowPrivilegeEscalation: false
#        readOnlyRootFilesystem: true
#        capabilities:
#          add:
#            - NET_ADMIN
#            - SYS_TIME
#          drop:
#            - ALL
#        seccompProfile:
#          type: Localhost
#          localhostProfile: localhost/profile.json
#        procMount: Default
#        seLinuxOptions:
#          type: spc_t
#          level: s0:c123,c456

    affinity:
      podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 1
          podAffinityTerm:
            labelSelector:
              matchLabels:
                postgres-operator.crunchydata.com/data: postgres
            topologyKey: kubernetes.io/hostname
#    resources:
#      limits:
#        cpu: 2.0
#        memory: 4Gi
#      requests:
#        cpu: 1.0
#        memory: 3Gi
#    containers:
#      replicaCertCopy:
#        resources:
#          limits:
#            cpu: 200m
#            memory: 128Mi
#          requests:
#            cpu: 100m
#            memory: 120Mi
#    sidecars:
#    - name: testcontainer
#      image: busybox:latest
#      command: ["sleep", "30d"]
#      securityContext: {}
#      volumeMounts:
#        - name: sidecar-secret
#          mountPath: /tmp/secret/path
#        - name: sidecar-config
#          mountPath: /tmp/config/path
#    - name: testcontainer2
#      image: mycontainer1:latest
#    sidecarVolumes:
#    - name: sidecar-secret
#      secret:
#        secretName: mysecret
#    - name: sidecar-config
#      configMap:
#        name: myconfigmap
#    - name: backup-nfs
#      nfs:
#        server: "nfs-service.storage.svc.cluster.local"
#        path: "/pg-some-name"
#    sidecarPVCs:
#    - name: sidecar-volume-claim
#      spec:
#        resources:
#          requests:
#            storage: 1Gi
#        volumeMode: Filesystem
#        accessModes:
#          - ReadWriteOnce
#
#    topologySpreadConstraints:
#      - maxSkew: 1
#        topologyKey: my-node-label
#        whenUnsatisfiable: DoNotSchedule
#        labelSelector:
#          matchLabels:
#            postgres-operator.crunchydata.com/instance-set: instance1
#
#    tolerations:
#    - effect: NoSchedule
#      key: role
#      operator: Equal
#      value: connection-poolers
#
#    priorityClassName: high-priority
#
#    securityContext:
#      fsGroup: 1001
#      runAsUser: 1001
#      runAsNonRoot: true
#      fsGroupChangePolicy: "OnRootMismatch"
#      runAsGroup: 1001
#      seLinuxOptions:
#        type: spc_t
#        level: s0:c123,c456
#      seccompProfile:
#        type: Localhost
#        localhostProfile: localhost/profile.json
#      supplementalGroups:
#      - 1001
#      sysctls:
#      - name: net.ipv4.tcp_keepalive_time
#        value: "600"
#      - name: net.ipv4.tcp_keepalive_intvl
#        value: "60"
#
#    walVolumeClaimSpec:
#       storageClassName: standard
#       accessModes:
#       - ReadWriteOnce
#       resources:
#         requests:
#           storage: 1Gi
#
    dataVolumeClaimSpec:
#      storageClassName: standard
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 1Gi
#      limits:
#          storage: 5Gi
#    tablespaceVolumes:
#      - name: user
#        dataVolumeClaimSpec:
#          accessModes:
#            - 'ReadWriteOnce'
#          resources:
#            requests:
#              storage: 1Gi
#    extraVolumes:
#      - name: fts-dicts
#        volumeSource:
#          configMap:
#            name: my-dicts
#        mounts:
#          - mountPath: /pgdata/dicts
#            readOnly: true

#  logicalReplicas:
#  - name: analytics
#    databases: []  # empty = all non-template databases except "postgres"
#    bootstrapMethod: pgbackrest
#    dataVolumeClaimSpec:
#      accessModes:
#      - ReadWriteOnce
#      resources:
#        requests:
#          storage: 1Gi
#    resources:
#      limits:
#        cpu: 2.0
#        memory: 4Gi
#    expose:
#      type: LoadBalancer

  proxy:
    pgBouncer:
      replicas: 3
      image: docker.io/percona/percona-pgbouncer:1.25.2-6
#      paused: true
#      env:
#      - name: MY_ENV
#        value: "1000"
#      envFrom:
#      - secretRef:
#          name: pgbouncer-env-secret
#      exposeSuperusers: false
#      usersSecret:
#        name: pgbouncer-users
#      resources:
#        limits:
#          cpu: 200m
#          memory: 128Mi
#        requests:
#          cpu: 150m
#          memory: 120Mi
#      containers:
#        pgbouncerConfig:
#          resources:
#            limits:
#              cpu: 200m
#              memory: 128Mi
#            requests:
#              cpu: 150m
#              memory: 120Mi
#
#      expose:
#        annotations:
#          my-annotation: value1
#        labels:
#          my-label: value2
#        type: LoadBalancer
#        loadBalancerClass: "eks.amazonaws.com/nlb"
#        loadBalancerSourceRanges:
#          - 10.0.0.0/8
#      additionalTrustedCAs:
#      - name: some-client-ca
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 1
            podAffinityTerm:
              labelSelector:
                matchLabels:
                  postgres-operator.crunchydata.com/role: pgbouncer
              topologyKey: kubernetes.io/hostname
#
#      tolerations:
#      - effect: NoSchedule
#        key: role
#        operator: Equal
#        value: connection-poolers
#
#      securityContext:
#        fsGroup: 1001
#        runAsUser: 1001
#        runAsNonRoot: true
#        fsGroupChangePolicy: "OnRootMismatch"
#        runAsGroup: 1001
#        seLinuxOptions:
#          type: spc_t
#          level: s0:c123,c456
#        seccompProfile:
#          type: Localhost
#          localhostProfile: localhost/profile.json
#        supplementalGroups:
#        - 1001
#        sysctls:
#        - name: net.ipv4.tcp_keepalive_time
#          value: "600"
#        - name: net.ipv4.tcp_keepalive_intvl
#          value: "60"
#
#      topologySpreadConstraints:
#        - maxSkew: 1
#          topologyKey: my-node-label
#          whenUnsatisfiable: ScheduleAnyway
#          labelSelector:
#            matchLabels:
#              postgres-operator.crunchydata.com/role: pgbouncer
#
#      sidecars:
#      - name: bouncertestcontainer1
#        image: busybox:latest
#        command: ["sleep", "30d"]
#        securityContext: {}
#        volumeMounts:
#          - name: sidecar-secret
#            mountPath: /tmp/secret/path
#          - name: sidecar-config
#            mountPath: /tmp/config/path
#      sidecarVolumes:
#      - name: sidecar-secret
#        secret:
#          secretName: mysecret
#      - name: sidecar-config
#        configMap:
#          name: myconfigmap
#      - name: backup-nfs
#        nfs:
#          server: "nfs-service.storage.svc.cluster.local"
#          path: "/pg-some-name"
#      sidecarPVCs:
#      - name: sidecar-volume-claim
#        spec:
#          resources:
#            requests:
#              storage: 1Gi
#          volumeMode: Filesystem
#          accessModes:
#            - ReadWriteOnce
#
#      customTLSSecret:
#        name: keycloakdb-pgbouncer.tls
#
#      config:
#        global:
#          pool_mode: transaction

  backups:
#    enabled: true
#    trackLatestRestorableTime: true
#    volumeSnapshots:
#      mode: offline
#      className: VOLUME-SNAPSHOT-CLASS
#      schedule: "0 0 * * 6"
    pgbackrest:
#      metadata:
#        labels:
      image: docker.io/percona/percona-pgbackrest:2.59.0-1
#      env:
#      - name: MY_ENV
#        value: "1000"
#      envFrom:
#      - secretRef:
#          name: repo-host-env-secret
#      initContainer:
#        image: docker.io/percona/percona-postgresql-operator:3.1.0
#        resources:
#          limits:
#            cpu: 2.0
#            memory: 4Gi
#          requests:
#            cpu: 1.0
#            memory: 3Gi
#        containerSecurityContext:
#          runAsUser: 1001
#          runAsGroup: 1001
#          runAsNonRoot: true
#          privileged: false
#          allowPrivilegeEscalation: false
#          readOnlyRootFilesystem: true
#          capabilities:
#            add:
#              - NET_ADMIN
#              - SYS_TIME
#            drop:
#              - ALL
#          seccompProfile:
#            type: Localhost
#            localhostProfile: localhost/profile.json
#          procMount: Default
#          seLinuxOptions:
#            type: spc_t
#            level: s0:c123,c456
#      containers:
#        pgbackrest:
#          resources:
#            limits:
#              cpu: 200m
#              memory: 128Mi
#            requests:
#              cpu: 150m
#              memory: 120Mi
#        pgbackrestConfig:
#          resources:
#            limits:
#              cpu: 200m
#              memory: 128Mi
#            requests:
#              cpu: 150m
#              memory: 120Mi
#
#      configuration:
#        - secret:
#            name: cluster1-pgbackrest-secrets
#      jobs:
#        restartPolicy: OnFailure
#        backoffLimit: 2
#        priorityClassName: high-priority
#        ttlSecondsAfterFinished: 60
#        resources:
#          limits:
#            cpu: 200m
#            memory: 128Mi
#          requests:
#            cpu: 150m
#            memory: 120Mi
#        tolerations:
#        - effect: NoSchedule
#          key: role
#          operator: Equal
#          value: connection-poolers
#
#        securityContext:
#          fsGroup: 1001
#          runAsUser: 1001
#          runAsNonRoot: true
#          fsGroupChangePolicy: "OnRootMismatch"
#          runAsGroup: 1001
#          seLinuxOptions:
#            type: spc_t
#            level: s0:c123,c456
#          seccompProfile:
#            type: Localhost
#            localhostProfile: localhost/profile.json
#          supplementalGroups:
#          - 1001
#          sysctls:
#          - name: net.ipv4.tcp_keepalive_time
#            value: "600"
#          - name: net.ipv4.tcp_keepalive_intvl
#            value: "60"
#
#      global:
#        repo1-retention-full: "14"
#        repo1-retention-full-type: time
#        repo1-path: /pgbackrest/postgres-operator/cluster1/repo1
#        repo1-cipher-type: aes-256-cbc
#        repo1-s3-uri-style: path
#        repo2-path: /pgbackrest/postgres-operator/cluster1-multi-repo/repo2
#        repo3-path: /pgbackrest/postgres-operator/cluster1-multi-repo/repo3
#        repo4-path: /pgbackrest/postgres-operator/cluster1-multi-repo/repo4
      repoHost:
#        sidecars:
#        - name: testcontainer
#          image: busybox:latest
#          command: ["sleep", "30d"]
#          securityContext: {}
#          volumeMounts:
#            - name: sidecar-secret
#              mountPath: /tmp/secret/path
#            - name: sidecar-config
#              mountPath: /tmp/config/path
#        - name: testcontainer2
#          image: mycontainer1:latest
#        sidecarVolumes:
#        - name: sidecar-secret
#          secret:
#            secretName: mysecret
#        - name: sidecar-config
#          configMap:
#            name: myconfigmap
#        - name: backup-nfs
#          nfs:
#            server: "nfs-service.storage.svc.cluster.local"
#            path: "/pg-some-name"
#        sidecarPVCs:
#        - name: sidecar-volume-claim
#          spec:
#            resources:
#              requests:
#                storage: 1Gi
#            volumeMode: Filesystem
#            accessModes:
#              - ReadWriteOnce
#        resources:
#          limits:
#            cpu: 200m
#            memory: 128Mi
#          requests:
#            cpu: 150m
#            memory: 120Mi
        affinity:
          podAntiAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
             - weight: 1
               podAffinityTerm:
                 labelSelector:
                   matchLabels:
                     postgres-operator.crunchydata.com/data: pgbackrest
                 topologyKey: kubernetes.io/hostname
#        tolerations:
#        - effect: NoSchedule
#          key: role
#          operator: Equal
#          value: connection-poolers
#        priorityClassName: high-priority
#
#        topologySpreadConstraints:
#        - maxSkew: 1
#          topologyKey: my-node-label
#          whenUnsatisfiable: ScheduleAnyway
#          labelSelector:
#            matchLabels:
#              postgres-operator.crunchydata.com/pgbackrest: ""
#
#        securityContext:
#          fsGroup: 1001
#          runAsUser: 1001
#          runAsNonRoot: true
#          fsGroupChangePolicy: "OnRootMismatch"
#          runAsGroup: 1001
#          seLinuxOptions:
#            type: spc_t
#            level: s0:c123,c456
#          seccompProfile:
#            type: Localhost
#            localhostProfile: localhost/profile.json
#          supplementalGroups:
#          - 1001
#          sysctls:
#          - name: net.ipv4.tcp_keepalive_time
#            value: "600"
#          - name: net.ipv4.tcp_keepalive_intvl
#            value: "60"
#
      manual:
        repoName: repo1
        options:
         - --type=full
#        initialDelaySeconds: 120
      repos:
      - name: repo1
        schedules:
          full: "0 0 * * 6"
#          differential: "0 1 * * 1-6"
#          incremental: "0 1 * * 1-6"
        volume:
          volumeClaimSpec:
#            storageClassName: standard
            accessModes:
            - ReadWriteOnce
            resources:
              requests:
                storage: 1Gi
#      - name: repo2
#        s3:
#          bucket: "<YOUR_AWS_S3_BUCKET_NAME>"
#          endpoint: "<YOUR_AWS_S3_ENDPOINT>"
#          region: "<YOUR_AWS_S3_REGION>"
#      - name: repo3
#        gcs:
#          bucket: "<YOUR_GCS_BUCKET_NAME>"
#      - name: repo4
#        azure:
#          container: "<YOUR_AZURE_CONTAINER>"
#
#      restore:
#        repoName: repo1
#        tolerations:
#        - effect: NoSchedule
#          key: role
#          operator: Equal
#          value: connection-poolers

  pmm:
    enabled: false
    image: docker.io/percona/pmm-client:3.9.1
#    imagePullPolicy: IfNotPresent
    secret: cluster1-pmm-secret
    serverHost: monitoring-service
#    resources:
#      limits:
#        memory: 200M
#        cpu: 350m
#      requests:
#        memory: 150M
#        cpu: 300m
#    customClusterName: "<string>"
#    postgresParams: "<string>"
#    querySource: pgstatmonitor
  logcollector:
    enabled: true
    image: docker.io/percona/fluentbit:5.1.1-1
#    imagePullPolicy: IfNotPresent
#    # Extra fluent-bit configuration merged with the operator-managed config.
#    # Must be in Fluent Bit's YAML configuration format.
#    # NOTE: the operator already ships a `service:` section (HTTP server on,
#    # port 2020). Fluent Bit does not merge duplicate top-level sections, so do
#    # not add your own `service:` here or the collector will fail to start.
#    configuration: |
#      pipeline:
#        filters:
#          - name: record_modifier
#            match: "*"
#            record:
#              - cluster_name cluster1
#    env:
#    - name: MY_ENV
#      value: "my-value"
#    envFrom:
#    - secretRef:
#        name: my-log-collector-secret
#    resources:
#      limits:
#        memory: 200M
#        cpu: 350m
#      requests:
#        memory: 150M
#        cpu: 300m
#    # Liveness/readiness probes for the fluent-bit "logs" container.
#    # When not set, the container has no probes.
#    livenessProbe:
#      tcpSocket:
#        port: 2020
#      initialDelaySeconds: 30
#      periodSeconds: 15
#    readinessProbe:
#      tcpSocket:
#        port: 2020
#      initialDelaySeconds: 5
#      periodSeconds: 10
#    # Extra volumes/mounts for the collector sidecars, e.g. a CA bundle so an
#    # S3 output can verify TLS via tls.ca_file.
#    volumeMounts:
#    - name: s3-ca
#      mountPath: /etc/fluentbit/tls
#      readOnly: true
#    volumes:
#    - name: s3-ca
#      secret:
#        secretName: my-s3-ca
#    logRotate:
#      # Override the operator-managed logrotate config. The snippet below mirrors
#      # the default the operator ships; adjust it to your needs.
#      configuration: |
#        # PostgreSQL server logs. logging_collector already rotates these daily,
#        # so this block is a size-based safety net only.
#        /pgdata/pg[0-9]*/log/*.log
#        /pgdata/pg[0-9]*/log/*.csv {
#            size 100M
#            rotate 7
#            missingok
#            nocompress
#            notifempty
#            copytruncate
#            sharedscripts
#        }
#        # pgBackRest client logs on instance pods.
#        /pgdata/pgbackrest/log/*.log {
#            daily
#            maxsize 100M
#            rotate 7
#            missingok
#            nocompress
#            notifempty
#            copytruncate
#            sharedscripts
#        }
#      # Additional logrotate config supplied via a ConfigMap.
#      extraConfig:
#        name: my-logrotate-config
#      # Cron schedule for logrotate runs (default "0 0 * * *").
#      schedule: "0 0 * * *"
#      # Liveness/readiness probes for the "logrotate" container.
#      # When not set, the container has no probes.
#      livenessProbe:
#        exec:
#          command:
#            - /bin/true
#        initialDelaySeconds: 30
#        periodSeconds: 15
#      readinessProbe:
#        exec:
#          command:
#            - /bin/true
#        initialDelaySeconds: 5
#        periodSeconds: 10
#  patroni:
#    # Some values of the Liveness/Readiness probes of the patroni container are calculated using syncPeriodSeconds by the following formulas:
#    # - timeoutSeconds:   syncPeriodSeconds / 2;
#    # - periodSeconds:    syncPeriodSeconds;
#    # - failureThreshold: leaderLeaseDurationSeconds / syncPeriodSeconds.
#    syncPeriodSeconds: 10 # default: 10
#    leaderLeaseDurationSeconds: 30 # default: 30
#    dynamicConfiguration:
#      postgresql:
#        parameters:
#          restore_command: "pgbackrest --stanza=db archive-get %f \"%p\""
#          max_parallel_workers: 2
#          max_worker_processes: 2
#          shared_buffers: 1GB
#          work_mem: 2MB
#        use_slots: true
#      slots:
#        cdc_consumer:
#          type: logical
#          database: myapp
#          plugin: pgoutput
#        external_replica:
#          type: physical
#    createReplicaMethods:
#    - pgbackrest
#    - basebackup

#  extensions:
#    image: docker.io/percona/percona-postgresql-operator:3.1.0
#    imagePullPolicy: Always
#    storage:
#      type: s3
#      bucket: pg-extensions
#      region: eu-central-1
#      endpoint: s3.eu-central-1.amazonaws.com
#      forcePathStyle: false
#      disableSSL: false
#      secret:
#        name: cluster1-extensions-secret
#    pg_stat_monitor:
#      enabled: false
#    pg_stat_statements:
#      enabled: false
#    pg_audit:
#      enabled: true
#    pgvector:
#      enabled: false
#    pg_repack:
#      enabled: false
#    pg_cron:
#      enabled: false
#    set_user:
#      enabled: false
#    pg_tde:
#      enabled: false
#      walEncryption: false
#      vault:
#        host: https://vault-service:8200
#        mountPath: tde
#        tokenSecret:
#          name: pg-tde-vault-secret
#          key: token
#        caSecret:
#          name: pg-tde-vault-secret
#          key: ca.crt
#    custom:
#    - name: pg_cron
#      version: 1.6.1