Merge 90dbe03a74 into acdbfb8b10

fix(deps): update all non-major go dependencies (#898 )
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Leonardo Cecchi <leonardo.cecchi@enterprisedb.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Leonardo Cecchi <leonardo.cecchi@enterprisedb.com>
2026-07-08 18:52:20 +02:00 · 2026-05-18 20:48:27 +00:00 · 2026-05-18 18:25:54 +02:00 · 2026-05-18 12:08:15 +02:00 · 2026-05-18 04:13:19 +02:00 · 2026-05-14 12:23:20 +02:00
44 changed files with 1588 additions and 905 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -44,7 +44,7 @@ jobs:
      - name: Install Dagger
        env:
          # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
-          DAGGER_VERSION: 0.20.6
+          DAGGER_VERSION: 0.20.8
        run: |
          curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh
      - name: Run CI task
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@ -31,7 +31,7 @@ jobs:
      - name: Install Dagger
        env:
          # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
-          DAGGER_VERSION: 0.20.6
+          DAGGER_VERSION: 0.20.8
        run: |
          curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh
      - name: Create image and manifest
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@ -21,7 +21,7 @@ jobs:
      - name: Install Dagger
        env:
          # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
-          DAGGER_VERSION: 0.20.6
+          DAGGER_VERSION: 0.20.8
        run: |
          curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh
      - name: Create image and manifest
--- a/.golangci.yml
+++ b/.golangci.yml
@ -16,7 +16,7 @@ linters:
    - gocyclo
    - goheader
    - gomoddirectives
-    - gomodguard
+    - gomodguard_v2
    - goprintffuncname
    - gosec
    - govet
--- a/Taskfile.yml
+++ b/Taskfile.yml
@ -7,7 +7,7 @@ output: prefixed
 # Variables that are shared across tasks.
 vars:
  GO_VERSION:
-    sh: sed -n 's/^toolchain go//p' go.mod
+    sh: sed -n 's/^toolchain go//p' go.mod | grep . || sed -n 's/^go //p' go.mod
  # renovate: datasource=docker depName=kindest/node versioning=semver
  E2E_KUBERNETES_VERSION: v1.35.1
  E2E_CLUSTER_NAME: barman-cloud-plugin-e2e-{{.E2E_KUBERNETES_VERSION}}
@ -21,9 +21,9 @@ tasks:
    desc: Run golangci-lint
    env:
      # renovate: datasource=git-refs depName=golangci-lint lookupName=https://github.com/sagikazarmark/daggerverse currentValue=main
-      DAGGER_GOLANGCI_LINT_SHA: 5dcc7e4c4cd5ed230046955f42e27f2166545155
+      DAGGER_GOLANGCI_LINT_SHA: 2d7fd409ba24712b0385956f1ba2006b09ff34db
      # renovate: datasource=docker depName=golangci/golangci-lint versioning=semver
-      GOLANGCI_LINT_VERSION: v2.11.4
+      GOLANGCI_LINT_VERSION: v2.12.2
    cmds:
      - >
        GITHUB_REF= dagger -sc "github.com/sagikazarmark/daggerverse/golangci-lint@${DAGGER_GOLANGCI_LINT_SHA}
@ -46,7 +46,7 @@ tasks:
      - wordlist-ordered
    env:
      # renovate: datasource=git-refs depName=spellcheck lookupName=https://github.com/cloudnative-pg/daggerverse currentValue=main
-      DAGGER_SPELLCHECK_SHA: eda3ea39e88ce2cb4be786ae74127a380adbfa38
+      DAGGER_SPELLCHECK_SHA: 2429c90cf92445de356493fcf908bcc7af68dddc
    cmds:
      - >
        GITHUB_REF= dagger -s call -m github.com/cloudnative-pg/daggerverse/spellcheck@${DAGGER_SPELLCHECK_SHA}
@ -60,7 +60,7 @@ tasks:
    desc: Check for conventional commits
    env:
      # renovate: datasource=git-refs depName=commitlint lookupName=https://github.com/cloudnative-pg/daggerverse currentValue=main
-      DAGGER_COMMITLINT_SHA: eda3ea39e88ce2cb4be786ae74127a380adbfa38
+      DAGGER_COMMITLINT_SHA: 2429c90cf92445de356493fcf908bcc7af68dddc
    cmds:
      - >
        GITHUB_REF= dagger -s call -m github.com/cloudnative-pg/daggerverse/commitlint@${DAGGER_COMMITLINT_SHA}
@ -74,7 +74,7 @@ tasks:
      - wordlist-ordered
    env:
      # renovate: datasource=git-refs depName=uncommitted lookupName=https://github.com/cloudnative-pg/daggerverse currentValue=main
-      DAGGER_UNCOMMITTED_SHA: eda3ea39e88ce2cb4be786ae74127a380adbfa38
+      DAGGER_UNCOMMITTED_SHA: 2429c90cf92445de356493fcf908bcc7af68dddc
    cmds:
      - GITHUB_REF= dagger -s call -m github.com/cloudnative-pg/daggerverse/uncommitted@${DAGGER_UNCOMMITTED_SHA} check-uncommitted --source . stdout
    sources:
@ -86,7 +86,7 @@ tasks:
      - controller-gen
    env:
      # renovate: datasource=git-refs depName=crd-gen-refs lookupName=https://github.com/cloudnative-pg/daggerverse currentValue=main
-      DAGGER_CRDGENREF_SHA: eda3ea39e88ce2cb4be786ae74127a380adbfa38
+      DAGGER_CRDGENREF_SHA: 2429c90cf92445de356493fcf908bcc7af68dddc
      # renovate: datasource=go depName=github.com/elastic/crd-ref-docs
      CRDREFDOCS_VERSION: v0.3.0
    cmds:
@ -133,7 +133,7 @@ tasks:
      # renovate: datasource=git-refs depname=kubernetes packageName=https://github.com/kubernetes/kubernetes versioning=semver
      K8S_VERSION: 1.31.0
      # renovate: datasource=git-refs depName=controller-runtime packageName=https://github.com/kubernetes-sigs/controller-runtime versioning=semver
-      SETUP_ENVTEST_VERSION: 0.23.3
+      SETUP_ENVTEST_VERSION: 0.24.1
    cmds:
      - >
        GITHUB_REF= dagger -s call -m ./dagger/gotest
@ -206,7 +206,7 @@ tasks:
      - start-build-network
    vars:
      # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
-      DAGGER_VERSION: 0.20.6
+      DAGGER_VERSION: 0.20.8
      DAGGER_ENGINE_IMAGE: registry.dagger.io/engine:v{{ .DAGGER_VERSION }}
    cmds:
      - >
@ -381,7 +381,7 @@ tasks:
    run: once
    env:
      # renovate: datasource=git-refs depName=controller-gen lookupName=https://github.com/cloudnative-pg/daggerverse currentValue=main
-      DAGGER_CONTROLLER_GEN_SHA: eda3ea39e88ce2cb4be786ae74127a380adbfa38
+      DAGGER_CONTROLLER_GEN_SHA: 2429c90cf92445de356493fcf908bcc7af68dddc
    cmds:
      - >
        GITHUB_REF= dagger -s call -m github.com/cloudnative-pg/daggerverse/controller-gen@${DAGGER_CONTROLLER_GEN_SHA}
@ -453,7 +453,7 @@ tasks:
      IMAGE_VERSION: '{{regexReplaceAll "(\\d+)/merge" .GITHUB_REF_NAME "pr-${1}"}}'
    env:
      # renovate: datasource=git-refs depName=kustomize lookupName=https://github.com/sagikazarmark/daggerverse currentValue=main
-      DAGGER_KUSTOMIZE_SHA: 5dcc7e4c4cd5ed230046955f42e27f2166545155
+      DAGGER_KUSTOMIZE_SHA: 2d7fd409ba24712b0385956f1ba2006b09ff34db
    cmds:
      - >
        dagger -s call -m https://github.com/sagikazarmark/daggerverse/kustomize@${DAGGER_KUSTOMIZE_SHA}
@ -483,7 +483,7 @@ tasks:
        - GITHUB_TOKEN
    env:
      # renovate: datasource=git-refs depName=gh lookupName=https://github.com/sagikazarmark/daggerverse
-      DAGGER_GH_SHA: 5dcc7e4c4cd5ed230046955f42e27f2166545155
+      DAGGER_GH_SHA: 2d7fd409ba24712b0385956f1ba2006b09ff34db
    preconditions:
      - sh: "[[ {{.GITHUB_REF}} =~ 'refs/tags/v.*' ]]"
        msg: not a tag, failing
--- a/api/v1/groupversion_info.go
+++ b/api/v1/groupversion_info.go
@ -20,17 +20,19 @@ SPDX-License-Identifier: Apache-2.0
 package v1
 import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"sigs.k8s.io/controller-runtime/pkg/scheme"
 )
-var (
+// GroupVersion is group version used to register these objects.
-	// GroupVersion is group version used to register these objects.
+var GroupVersion = schema.GroupVersion{Group: "barmancloud.cnpg.io", Version: "v1"}
 	GroupVersion = schema.GroupVersion{Group: "barmancloud.cnpg.io", Version: "v1"}
-	// SchemeBuilder is used to add go types to the GroupVersionKind scheme.
+// AddKnownTypes add to the passed schema the Kubernetes types
-	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
+// exposed by this package.
 func AddKnownTypes(scheme *runtime.Scheme) {
 	scheme.AddKnownTypes(GroupVersion,
 		&ObjectStore{}, &ObjectStoreList{})
-	// AddToScheme adds the types in this group-version to the given scheme.
+	metav1.AddToGroupVersion(scheme, GroupVersion)
-	AddToScheme = SchemeBuilder.AddToScheme
+}
 )
--- a/api/v1/objectstore_types.go
+++ b/api/v1/objectstore_types.go
@ -124,7 +124,3 @@ type ObjectStoreList struct {
 	metav1.ListMeta `json:"metadata,omitempty"`
 	Items           []ObjectStore `json:"items"`
 }
 func init() {
 	SchemeBuilder.Register(&ObjectStore{}, &ObjectStoreList{})
 }
--- a/api/v1/zz_generated.deepcopy.go
+++ b/api/v1/zz_generated.deepcopy.go
@ -25,7 +25,7 @@ package v1
 import (
 	corev1 "k8s.io/api/core/v1"
-	runtime "k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime"
 )
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
--- a/config/crd/bases/barmancloud.cnpg.io_objectstores.yaml
+++ b/config/crd/bases/barmancloud.cnpg.io_objectstores.yaml
@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.1
+    controller-gen.kubebuilder.io/version: v0.21.0
  name: objectstores.barmancloud.cnpg.io
 spec:
  group: barmancloud.cnpg.io
--- a/containers/Dockerfile.plugin
+++ b/containers/Dockerfile.plugin
@ -1,5 +1,5 @@
 # Build the manager binary
-# GO_VERSION must be passed as a build arg (read from go.mod toolchain directive by Taskfile)
+# GO_VERSION must be passed as a build arg (read from go.mod by Taskfile)
 ARG GO_VERSION
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION} AS gobuilder
 ARG TARGETOS
--- a/containers/Dockerfile.sidecar
+++ b/containers/Dockerfile.sidecar
@ -5,7 +5,7 @@
 # Both components are built before going into a distroless container
 # Build the manager binary
-# GO_VERSION must be passed as a build arg (read from go.mod toolchain directive by Taskfile)
+# GO_VERSION must be passed as a build arg (read from go.mod by Taskfile)
 ARG GO_VERSION
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION} AS gobuilder
 ARG TARGETOS
--- a/containers/sidecar-requirements.txt
+++ b/containers/sidecar-requirements.txt
@ -22,19 +22,19 @@ barman==3.18.0 \
    --hash=sha256:8e752ac93d2f3a61e86b8374185209cae477a638ece7e6f540070f36d28d6997 \
    --hash=sha256:ff90c44dafa4107b7574142771cdc2611c4cf1af818d93d3e67440a0c81164b9
    # via -r sidecar-requirements.in
-boto3==1.42.91 \
+boto3==1.42.96 \
-    --hash=sha256:03d70532b17f7f84df37ca7e8c21553280454dea53ae12b15d1cfef9b16fcb8a \
+    --hash=sha256:2f4566da2c209a98bdbfc874d813ef231c84ad24e4f815e9bc91de5f63351a24 \
-    --hash=sha256:04e72071cde022951ce7f81bd9933c90095ab8923e8ced61c8dacfe9edac0f5c
+    --hash=sha256:b38a9e4a3fbbee9017252576f1379780d0a5814768676c08df2f539d31fcdd68
    # via barman
-botocore==1.42.91 \
+botocore==1.42.96 \
-    --hash=sha256:7a28c3cc6bfab5724ad18899d52402b776a0de7d87fa20c3c5270bcaaf199ce8 \
+    --hash=sha256:75b3b841ffacaa944f645196655a21ca777591dd8911e732bfb6614545af0250 \
-    --hash=sha256:d252e27bc454afdbf5ed3dc617aa423f2c855c081e98b7963093399483ecc698
+    --hash=sha256:db2c3e2006628be6fde81a24124a6563c363d6982fb92728837cf174bad9d98a
    # via
    #   boto3
    #   s3transfer
-certifi==2026.2.25 \
+certifi==2026.4.22 \
-    --hash=sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa \
+    --hash=sha256:3cb2210c8f88ba2318d29b0388d1023c8492ff72ecdde4ebdaddbb13a31b1c4a \
-    --hash=sha256:e887ab5cee78ea814d3472169153c2d12cd43b14bd03329a39a9c6e2e80bfba7
+    --hash=sha256:8d455352a37b71bf76a79caa83a3d6c25afee4a385d632127b6afb3963f1c580
    # via requests
 cffi==2.0.0 \
    --hash=sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb \
@ -390,56 +390,56 @@ cramjam==2.11.0 \
    # via
    #   barman
    #   python-snappy
-cryptography==46.0.7 \
+cryptography==47.0.0 \
-    --hash=sha256:04959522f938493042d595a736e7dbdff6eb6cc2339c11465b3ff89343b65f65 \
+    --hash=sha256:0024b87d47ae2399165a6bfb20d24888881eeab83ae2566d62467c5ff0030ce7 \
-    --hash=sha256:128c5edfe5e5938b86b03941e94fac9ee793a94452ad1365c9fc3f4f62216832 \
+    --hash=sha256:07efe86201817e7d3c18781ca9770bc0db04e1e48c994be384e4602bc38f8f27 \
-    --hash=sha256:1d25aee46d0c6f1a501adcddb2d2fee4b979381346a78558ed13e50aa8a59067 \
+    --hash=sha256:09f6d7bf6724f8db8b32f11eccf23efc8e759924bc5603800335cf8859a3ddbd \
-    --hash=sha256:24402210aa54baae71d99441d15bb5a1919c195398a87b563df84468160a65de \
+    --hash=sha256:11438c7518132d95f354fa01a4aa2f806d172a061a7bed18cf18cbdacdb204d7 \
-    --hash=sha256:258514877e15963bd43b558917bc9f54cf7cf866c38aa576ebf47a77ddbc43a4 \
+    --hash=sha256:11dbb9f50a0f1bb9757b3d8c27c1101780efb8f0bdecfb12439c22a74d64c001 \
-    --hash=sha256:35719dc79d4730d30f1c2b6474bd6acda36ae2dfae1e3c16f2051f215df33ce0 \
+    --hash=sha256:14432c8a9bcb37009784f9594a62fae211a2ae9543e96c92b2a8e4c3cd5cd0c4 \
-    --hash=sha256:397655da831414d165029da9bc483bed2fe0e75dde6a1523ec2fe63f3c46046b \
+    --hash=sha256:1581aef4219f7ca2849d0250edaa3866212fb74bf5667284f46aa92f9e65c1ca \
-    --hash=sha256:3986ac1dee6def53797289999eabe84798ad7817f3e97779b5061a95b0ee4968 \
+    --hash=sha256:160ad728f128972d362e714054f6ba0067cab7fb350c5202a9ae8ae4ce3ef1a0 \
-    --hash=sha256:420b1e4109cc95f0e5700eed79908cef9268265c773d3a66f7af1eef53d409ef \
+    --hash=sha256:1a405c08857258c11016777e11c02bacbe7ef596faf259305d282272a3a05cbe \
-    --hash=sha256:42a1e5f98abb6391717978baf9f90dc28a743b7d9be7f0751a6f56a75d14065b \
+    --hash=sha256:1e47422b5557bb82d3fff997e8d92cff4e28b9789576984f08c248d2b3535d93 \
-    --hash=sha256:462ad5cb1c148a22b2e3bcc5ad52504dff325d17daf5df8d88c17dda1f75f2a4 \
+    --hash=sha256:20fdbe3e38fb67c385d233c89371fa27f9909f6ebca1cecc20c13518dae65475 \
-    --hash=sha256:506c4ff91eff4f82bdac7633318a526b1d1309fc07ca76a3ad182cb5b686d6d3 \
+    --hash=sha256:2207a498b03275d0051589e326b79d4cf59985c99031b05bb292ac52631c37fe \
-    --hash=sha256:5ad9ef796328c5e3c4ceed237a183f5d41d21150f972455a9d926593a1dcb308 \
+    --hash=sha256:256d07c78a04d6b276f5df935a9923275f53bd1522f214447fdf365494e2d515 \
-    --hash=sha256:5d1c02a14ceb9148cc7816249f64f623fbfee39e8c03b3650d842ad3f34d637e \
+    --hash=sha256:2b45761c6ec22b7c726d6a829558777e32d0f1c8be7c3f3480f9c912d5ee8a10 \
-    --hash=sha256:5e51be372b26ef4ba3de3c167cd3d1022934bc838ae9eaad7e644986d2a3d163 \
+    --hash=sha256:2ebd84adf0728c039a3be2700289378e1c164afc6748df1a5ed456767bef9ba7 \
-    --hash=sha256:60627cf07e0d9274338521205899337c5d18249db56865f943cbe753aa96f40f \
+    --hash=sha256:34b4358b925a5ea3e14384ca781a2c0ef7ac219b57bb9eacc4457078e2b19f92 \
-    --hash=sha256:65814c60f8cc400c63131584e3e1fad01235edba2614b61fbfbfa954082db0ee \
+    --hash=sha256:3fb8fa48075fad7193f2e5496135c6a76ac4b2aa5a38433df0a539296b377829 \
-    --hash=sha256:73510b83623e080a2c35c62c15298096e2a5dc8d51c3b4e1740211839d0dea77 \
+    --hash=sha256:4e1de79e047e25d6e9f8cea71c86b4a53aced64134f0f003bbcbf3655fd172c8 \
-    --hash=sha256:7bbc6ccf49d05ac8f7d7b5e2e2c33830d4fe2061def88210a126d130d7f71a85 \
+    --hash=sha256:4f7722c97826770bab8ae92959a2e7b20a5e9e9bf4deae68fd86c3ca457bab52 \
-    --hash=sha256:80406c3065e2c55d7f49a9550fe0c49b3f12e5bfff5dedb727e319e1afb9bf99 \
+    --hash=sha256:51c9313e90bd1690ec5a75ed047c27c0b8e6c570029712943d6116ef9a90620b \
-    --hash=sha256:84d4cced91f0f159a7ddacad249cc077e63195c36aac40b4150e7a57e84fffe7 \
+    --hash=sha256:5d0e362ff51041b0c0d219cc7d6924d7b8996f57ce5712bdcef71eb3c65a59cc \
-    --hash=sha256:8a469028a86f12eb7d2fe97162d0634026d92a21f3ae0ac87ed1c4a447886c83 \
+    --hash=sha256:6651d32eff255423503aa276739da98c30f26c40cbeffcc6048e0d54ef704c0c \
-    --hash=sha256:91bbcb08347344f810cbe49065914fe048949648f6bd5c2519f34619142bbe85 \
+    --hash=sha256:6eebcaf0df1d21ce1f90605c9b432dd2c4f4ab665ac29a40d5e3fc68f51b5e63 \
-    --hash=sha256:935ce7e3cfdb53e3536119a542b839bb94ec1ad081013e9ab9b7cfd478b05006 \
+    --hash=sha256:6f29f36582e6151d9686235e586dd35bb67491f024767d10b842e520dc6a07ac \
-    --hash=sha256:9694078c5d44c157ef3162e3bf3946510b857df5a3955458381d1c7cfc143ddb \
+    --hash=sha256:7a02675e2fabd0c0fc04c868b8781863cbf1967691543c22f5470500ff840b31 \
-    --hash=sha256:a1529d614f44b863a7b480c6d000fe93b59acee9c82ffa027cfadc77521a9f5e \
+    --hash=sha256:7f1207974a904e005f762869996cf620e9bf79ecb4622f148550bb48e0eb35a7 \
-    --hash=sha256:abad9dac36cbf55de6eb49badd4016806b3165d396f64925bf2999bcb67837ba \
+    --hash=sha256:7f68d6fbc7fbbcfb0939fea72c3b96a9f9a6edfc0e1b1d29778a2066030418b1 \
-    --hash=sha256:b36a4695e29fe69215d75960b22577197aca3f7a25b9cf9d165dcfe9d80bc325 \
+    --hash=sha256:7fda2f02c9015db3f42bb8a22324a454516ed10a8c29ca6ece6cdbb5efe2a203 \
-    --hash=sha256:b7b412817be92117ec5ed95f880defe9cf18a832e8cafacf0a22337dc1981b4d \
+    --hash=sha256:80887c5cbd1774683cb126f0ab4184567f080071d5acf62205acb354b4b753b7 \
-    --hash=sha256:c5b1ccd1239f48b7151a65bc6dd54bcfcc15e028c8ac126d3fada09db0e07ef1 \
+    --hash=sha256:835d2d7f47cdc53b3224e90810fb1d36ca94ea29cc1801fb4c1bc43876735769 \
-    --hash=sha256:cbd5fb06b62bd0721e1170273d3f4d5a277044c47ca27ee257025146c34cbdd1 \
+    --hash=sha256:8c1a736bbb3288005796c3f7ccb9453360d7fed483b13b9f468aea5171432923 \
-    --hash=sha256:cdf1a610ef82abb396451862739e3fc93b071c844399e15b90726ef7470eeaf2 \
+    --hash=sha256:9af828c0d5a65c70ec729cd7495a4bf1a67ecb66417b8f02ff125ab8a6326a74 \
-    --hash=sha256:cdfbe22376065ffcf8be74dc9a909f032df19bc58a699456a21712d6e5eabfd0 \
+    --hash=sha256:9c59ab0e0fa3a180a5a9c59f3a5abe3ef90d474bc56d7fadfbe80359491b615b \
-    --hash=sha256:d02c738dacda7dc2a74d1b2b3177042009d5cab7c7079db74afc19e56ca1b455 \
+    --hash=sha256:9f8e55fe4e63613a5e1cc5819030f27b97742d720203a087802ce4ce9ceb52bb \
-    --hash=sha256:d151173275e1728cf7839aaa80c34fe550c04ddb27b34f48c232193df8db5842 \
+    --hash=sha256:9fe6b7c64926c765f9dff301f9c1b867febcda5768868ca084e18589113732ab \
-    --hash=sha256:d23c8ca48e44ee015cd0a54aeccdf9f09004eba9fc96f38c911011d9ff1bd457 \
+    --hash=sha256:a49a3eb5341b9503fa3000a9a0db033161db90d47285291f53c2a9d2cd1b7f76 \
-    --hash=sha256:d3b99c535a9de0adced13d159c5a9cf65c325601aa30f4be08afd680643e9c15 \
+    --hash=sha256:a9b761f012a943b7de0e828843c5688d0de94a0578d44d6c85a1bae32f87791f \
-    --hash=sha256:d5f7520159cd9c2154eb61eb67548ca05c5774d39e9c2c4339fd793fe7d097b2 \
+    --hash=sha256:b1c76fca783aa7698eb21eb14f9c4aa09452248ee54a627d125025a43f83e7a7 \
-    --hash=sha256:db0f493b9181c7820c8134437eb8b0b4792085d37dbb24da050476ccb664e59c \
+    --hash=sha256:b9a8943e359b7615db1a3ba587994618e094ff3d6fa5a390c73d079ce18b3973 \
-    --hash=sha256:e06acf3c99be55aa3b516397fe42f5855597f430add9c17fa46bf2e0fb34c9bb \
+    --hash=sha256:be12cb6a204f77ed968bcefe68086eb061695b540a3dd05edac507a3111b25f0 \
-    --hash=sha256:e4cfd68c5f3e0bfdad0d38e023239b96a2fe84146481852dffbcca442c245aa5 \
+    --hash=sha256:cffbba3392df0fa8629bb7f43454ee2925059ee158e23c54620b9063912b86c8 \
-    --hash=sha256:ea42cbe97209df307fdc3b155f1b6fa2577c0defa8f1f7d3be7d31d189108ad4 \
+    --hash=sha256:ed67ea4e0cfb5faa5bc7ecb6e2b8838f3807a03758eec239d6c21c8769355310 \
-    --hash=sha256:ebd6daf519b9f189f85c479427bbd6e9c9037862cf8fe89ee35503bd209ed902 \
+    --hash=sha256:edd4da498015da5b9f26d38d3bfc2e90257bfa9cbed1f6767c282a0025ae649b \
-    --hash=sha256:f247c8c1a1fb45e12586afbb436ef21ff1e80670b2861a90353d9b025583d246 \
+    --hash=sha256:ef6b3634087f18d2155b1e8ce264e5345a753da2c5fa9815e7d41315c90f8318 \
-    --hash=sha256:fbfd0e5f273877695cb93baf14b185f4878128b250cc9f8e617ea0c025dfb022 \
+    --hash=sha256:f1557695e5c2b86e204f6ce9470497848634100787935ab7adc5397c54abd7ab \
-    --hash=sha256:fc9ab8856ae6cf7c9358430e49b368f3108f050031442eaeb6b9d87e4dcf4e4f \
+    --hash=sha256:f5c15764f261394b22aef6b00252f5195f46f2ca300bec57149474e2538b31f8 \
-    --hash=sha256:fcd8eac50d9138c1d7fc53a653ba60a2bee81a505f9f8850b6b2888555a45d0e \
+    --hash=sha256:f5c3296dab66202f1b18a91fa266be93d6aa0c2806ea3d67762c69f60adc71aa \
-    --hash=sha256:fdd1736fed309b4300346f88f74cd120c27c56852c3838cab416e7a166f67298 \
+    --hash=sha256:f7db373287273d8af1414cf95dc4118b13ffdc62be521997b0f2b270771fef50 \
-    --hash=sha256:ffca7aa1d00cf7d6469b988c581598f2259e46215e0140af408966a24cf086ce
+    --hash=sha256:f9a034b642b960767fb343766ae5ba6ad653f2e890ddd82955aef288ffea8736
    # via
    #   azure-identity
    #   azure-storage-blob
@ -512,9 +512,9 @@ googleapis-common-protos==1.74.0 \
    --hash=sha256:57971e4eeeba6aad1163c1f0fc88543f965bb49129b8bb55b2b7b26ecab084f1 \
    --hash=sha256:702216f78610bb510e3f12ac3cafd281b7ac45cc5d86e90ad87e4d301a3426b5
    # via google-api-core
-idna==3.11 \
+idna==3.13 \
-    --hash=sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea \
+    --hash=sha256:585ea8fe5d69b9181ec1afba340451fba6ba764af97026f92a91d4eef164a242 \
-    --hash=sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902
+    --hash=sha256:892ea0cde124a99ce773decba204c5552b69c3c67ffd5f232eb7696135bc8bb3
    # via requests
 isodate==0.7.2 \
    --hash=sha256:28009937d8031054830160fce6d409ed342816b543597cece116d966c6d99e15 \
@ -612,14 +612,14 @@ protobuf==7.34.1 \
    #   google-api-core
    #   googleapis-common-protos
    #   proto-plus
-psycopg2==2.9.11 \
+psycopg2==2.9.12 \
-    --hash=sha256:103e857f46bb76908768ead4e2d0ba1d1a130e7b8ed77d3ae91e8b33481813e8 \
+    --hash=sha256:09826a6b89714626a662275d03f21639f1c68d183e2dcc9ba134d463a3da753e \
-    --hash=sha256:210daed32e18f35e3140a1ebe059ac29209dd96468f2f7559aa59f75ee82a5cb \
+    --hash=sha256:1dedb1c7a1d8552c4a6044c6b1c41a52e6a8e2d144af83eccac758076b1b7c15 \
-    --hash=sha256:6ecddcf573777536bddfefaea8079ce959287798c8f5804bee6933635d538924 \
+    --hash=sha256:2532c0cdc6ad18c9c35cd935cc3159712e14f05276a6d29a6435c52d24b840c1 \
-    --hash=sha256:8dc379166b5b7d5ea66dcebf433011dfc51a7bb8a5fc12367fa05668e5fc53c8 \
+    --hash=sha256:3d23e684927d37b95cee9a943f6927b04ae2fdcd056fd0e2a30929ee89fee5a9 \
-    --hash=sha256:964d31caf728e217c697ff77ea69c2ba0865fa41ec20bb00f0977e62fdcc52e3 \
+    --hash=sha256:83d48e66e18c301d832e93c984a7bcbc0f4ac3bb79e2137e3bc335978c756dc0 \
-    --hash=sha256:e03e4a6dbe87ff81540b434f2e5dc2bddad10296db5eea7bdc995bf5f4162938 \
+    --hash=sha256:a73d5513bfe929c56555006c7a9cc7ae6e4276aa99dd2b1e2544eb8bb54f8b23 \
-    --hash=sha256:f10a48acba5fe6e312b891f290b4d2ca595fc9a06850fe53320beac353575578
+    --hash=sha256:d5fbe092315fb007c03544704e6d1e678a6c0378139d01cea433dc59edf041b4
    # via barman
 pyasn1==0.6.3 \
    --hash=sha256:697a8ecd6d98891189184ca1fa05d1bb00e2f84b5977c481452050549c8a72cf \
@ -657,9 +657,9 @@ requests==2.33.1 \
    #   google-api-core
    #   google-cloud-storage
    #   msal
-s3transfer==0.16.0 \
+s3transfer==0.16.1 \
-    --hash=sha256:18e25d66fed509e3868dc1572b3f427ff947dd2c56f844a5bf09481ad3f3b2fe \
+    --hash=sha256:61bcd00ccb83b21a0fe7e91a553fff9729d46c83b4e0106e7c314a733891f7c2 \
-    --hash=sha256:8e990f13268025792229cd52fa10cb7163744bf56e719e0b9cb925ab79abf920
+    --hash=sha256:8e424355754b9ccb32467bdc568edf55be82692ef2002d934b1311dbb3b9e524
    # via boto3
 six==1.17.0 \
    --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
--- a/go.mod
+++ b/go.mod
@ -1,36 +1,34 @@
 module github.com/cloudnative-pg/plugin-barman-cloud
-go 1.25.0
+go 1.26.3
 toolchain go1.26.2
 require (
 	github.com/cert-manager/cert-manager v1.20.2
-	github.com/cloudnative-pg/api v1.29.0
+	github.com/cloudnative-pg/api v1.29.1
 	github.com/cloudnative-pg/barman-cloud v0.5.1
 	github.com/cloudnative-pg/cloudnative-pg v1.29.0
 	github.com/cloudnative-pg/cnpg-i v0.5.0
 	github.com/cloudnative-pg/cnpg-i-machinery v0.4.2
 	github.com/cloudnative-pg/machinery v0.4.0
-	github.com/onsi/ginkgo/v2 v2.28.1
+	github.com/onsi/ginkgo/v2 v2.29.0
-	github.com/onsi/gomega v1.39.1
+	github.com/onsi/gomega v1.41.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/viper v1.21.0
-	google.golang.org/grpc v1.80.0
+	google.golang.org/grpc v1.81.1
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.35.4
+	k8s.io/api v0.36.1
-	k8s.io/apiextensions-apiserver v0.35.4
+	k8s.io/apiextensions-apiserver v0.36.1
-	k8s.io/apimachinery v0.35.4
+	k8s.io/apimachinery v0.36.1
-	k8s.io/client-go v0.35.4
+	k8s.io/client-go v0.36.1
-	k8s.io/utils v0.0.0-20260319190234-28399d86e0b5
+	k8s.io/utils v0.0.0-20260507154919-ff6756f316d2
-	sigs.k8s.io/controller-runtime v0.23.3
+	sigs.k8s.io/controller-runtime v0.24.1
 	sigs.k8s.io/kustomize/api v0.21.1
 	sigs.k8s.io/kustomize/kyaml v0.21.1
 )
 require (
 	cel.dev/expr v0.25.1 // indirect
-	github.com/Masterminds/semver/v3 v3.4.0 // indirect
+	github.com/Masterminds/semver/v3 v3.5.0 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/avast/retry-go/v5 v5.0.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@ -42,7 +40,7 @@ require (
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
 	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
@ -63,15 +61,14 @@ require (
 	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/cel-go v0.26.0 // indirect
 	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect
+	github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kubernetes-csi/external-snapshotter/client/v8 v8.4.0 // indirect
@ -81,13 +78,12 @@ require (
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.87.1 // indirect
 	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.4 // indirect
+	github.com/prometheus/common v0.67.5 // indirect
 	github.com/prometheus/procfs v0.19.2 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/snorwin/jsonpatch v1.5.0 // indirect
@ -101,42 +97,43 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
 	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 // indirect
 	go.opentelemetry.io/otel/metric v1.43.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.7.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.1 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/exp v0.0.0-20250718183923-645b1fa84792 // indirect
+	golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
-	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/mod v0.35.0 // indirect
-	golang.org/x/net v0.52.0 // indirect
+	golang.org/x/net v0.53.0 // indirect
-	golang.org/x/oauth2 v0.35.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/term v0.41.0 // indirect
+	golang.org/x/term v0.42.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.42.0 // indirect
+	golang.org/x/tools v0.44.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/apiserver v0.35.4 // indirect
+	k8s.io/apiserver v0.36.1 // indirect
-	k8s.io/component-base v0.35.4 // indirect
+	k8s.io/component-base v0.36.1 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 // indirect
+	k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787 // indirect
-	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0 // indirect
+	k8s.io/streaming v0.36.1 // indirect
 	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 // indirect
 	sigs.k8s.io/gateway-api v1.5.0 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
--- a/go.sum
+++ b/go.sum
@ -1,7 +1,7 @@
 cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
 cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
-github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
-github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
 github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
@ -18,8 +18,8 @@ github.com/cert-manager/cert-manager v1.20.2 h1:CimnY00nLqB2lmxhoSuEC4GDMFDK7JCX
 github.com/cert-manager/cert-manager v1.20.2/go.mod h1:1g/+a/WK5zWH/dXPZa3dMD3aJQJNRXQu+PN17C6WrOw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cloudnative-pg/api v1.29.0 h1:mNx6yJ5qi+Xrjs0NYrUy6V4MlXBkVJxGKwvTJZIuTX4=
+github.com/cloudnative-pg/api v1.29.1 h1:FWr8S7EQeOfdhYXyr2cof8wUXLARZiiQt5Qa6ltED7w=
-github.com/cloudnative-pg/api v1.29.0/go.mod h1:bF3HI8UVVcllZ7M8CfBufnb+Us8FyQArhD+4qtX0qhM=
+github.com/cloudnative-pg/api v1.29.1/go.mod h1:QtWF3yzSvIfORMHaSkPAk/o3bhCJwEHJgN3riyRiz3o=
 github.com/cloudnative-pg/barman-cloud v0.5.1 h1:vjkXrrxo2DQXHT9u9usqhtaHiPZ/lTfDVs/pIWYTepQ=
 github.com/cloudnative-pg/barman-cloud v0.5.1/go.mod h1:XPc5IUFP1y4cZX1sg+Pd8j9V4tmUEVnv3BGCpfQOOg8=
 github.com/cloudnative-pg/cloudnative-pg v1.29.0 h1:49Dm8+y4va7RODspJjeaK8uMWP3OGAD0gMsxhjm16Mo=
@ -47,8 +47,8 @@ github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHk
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
-github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/gkampitakis/ciinfo v0.3.2 h1:JcuOPk8ZU7nZQjdUhctuhQofk7BGHuIy0c9Ez8BNhXs=
 github.com/gkampitakis/ciinfo v0.3.2/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo=
 github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZdC4M=
@ -108,8 +108,6 @@ github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
 github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/cel-go v0.26.0 h1:DPGjXackMpJWH680oGY4lZhYjIameYmR+/6RBdDGmaI=
 github.com/google/cel-go v0.26.0/go.mod h1:A9O8OU9rdvrK5MQyrqfIxo1a0u4g3sF8KB6PUIaryMM=
 github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c=
@ -119,16 +117,16 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
-github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 h1:B+8ClL/kCQkRiU82d9xajRPKYMrB7E0MbtzWVi1K4ns=
 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3/go.mod h1:NbCUVmiS4foBGBHOYlCT25+YmGpJ32dZPi75pGEUpj4=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 h1:X+2YciYSxvMQK0UZ7sg45ZVabVZBeBuvMkmuI2V3Fak=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7/go.mod h1:lW34nIZuQ8UDPdkon5fmfp2l3+ZkQ2me/+oecHYLOII=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE=
@ -163,12 +161,10 @@ github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/
 github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
+github.com/onsi/ginkgo/v2 v2.29.0 h1:rfh+ZFjgJhYWRoIqVf3Uwx/W20yLrcrE2h2GmYVRaag=
-github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/onsi/ginkgo/v2 v2.29.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
-github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
+github.com/onsi/gomega v1.41.0 h1:OwKp4pXNgVxf6sCplzYo794OFNuoL2q2SBMU5NSWOjA=
-github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
+github.com/onsi/gomega v1.41.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
 github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
 github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@ -182,8 +178,8 @@ github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h
 github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.67.4 h1:yR3NqWO1/UyO1w2PhUvXlGQs/PtFmoveVO0KZ4+Lvsc=
+github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
-github.com/prometheus/common v0.67.4/go.mod h1:gP0fq6YjjNCLssJCQp0yk4M8W6ikLURwkdd/YKtTbyI=
+github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
 github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
 github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
@ -241,14 +237,14 @@ github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
 github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 h1:7iP2uCb7sGddAr30RRS6xjKy7AZ2JtTOPA3oolgVSw8=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0/go.mod h1:c7hN3ddxs/z6q9xwvfLPk+UHlWRQyaeR1LdgfL/66l0=
 go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
 go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 h1:QKdN8ly8zEMrByybbQgv8cWBcdAarwmIPZ6FThrWXJs=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0/go.mod h1:bTdK1nhqF76qiPoCCdyFIV+N/sRHYXYCTQc+3VCi3MI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 h1:DvJDOPmSWQHWywQS6lKL+pb8s3gBLOZUtw4N+mavW1I=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0/go.mod h1:EtekO9DEJb4/jRyN4v4Qjc2yA7AtfCBuz2FynRUWTXs=
 go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
 go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
 go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
@ -257,50 +253,50 @@ go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfC
 go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
 go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
 go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
-go.opentelemetry.io/proto/otlp v1.7.0 h1:jX1VolD6nHuFzOYso2E73H85i92Mv8JQYk0K9vz09os=
+go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
-go.opentelemetry.io/proto/otlp v1.7.0/go.mod h1:fSKjH6YJ7HDlwzltzyMj036AJ3ejJLCgCSHGj4efDDo=
+go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
 go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/exp v0.0.0-20250718183923-645b1fa84792 h1:R9PFI6EUdfVKgwKjZef7QIwGcBKu86OEFpJ9nUEP2l4=
+golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 h1:fQsdNF2N+/YewlRZiricy4P1iimyPKZ/xwniHj8Q2a0=
-golang.org/x/exp v0.0.0-20250718183923-645b1fa84792/go.mod h1:A+z0yzpGtvnG90cToK5n2tu8UJVP2XUATh+r+sfOOOc=
+golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
-golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
-golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
-golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
 golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
-golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
-golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
 gomodules.xyz/jsonpatch/v2 v2.5.0 h1:JELs8RLM12qJGXU4u/TO3V25KW8GreMKl9pdkk14RM0=
 gomodules.xyz/jsonpatch/v2 v2.5.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 h1:merA0rdPeUV3YIIfHHcH4qBkiQAc1nfCKSI7lB4cV2M=
+google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 h1:tu/dtnW1o3wfaxCOjSLn5IRX4YDcJrtlpzYkhHhGaC4=
-google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409/go.mod h1:fl8J1IvUjCilwZzQowmw2b7HQB2eAuYBabMXzWurF+I=
+google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171/go.mod h1:M5krXqk4GhBKvB596udGL3UyjL4I1+cTbK0orROM9ng=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 h1:ndE4FoJqsIceKP2oYSnUZqhTdYufCYYkqwtFzfrhI7w=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
+google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@ -312,28 +308,30 @@ gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/api v0.35.4 h1:P7nFYKl5vo9AGUp1Z+Pmd3p2tA7bX2wbFWCvDeRv988=
+k8s.io/api v0.36.1 h1:XbL/EMj8K2aJpJtePmqUyQMsM0D4QI2pvl7YKJ20FTY=
-k8s.io/api v0.35.4/go.mod h1:yl4lqySWOgYJJf9RERXKUwE9g2y+CkuwG+xmcOK8wXU=
+k8s.io/api v0.36.1/go.mod h1:KOWo4ey3TINlXjeHVuwB3i+tXXnu+UcwFBHlI/9dvEo=
-k8s.io/apiextensions-apiserver v0.35.4 h1:HeP+Upp7ItdvnyGmub0yoix+2z5+ev4M5cE5TCgtOUU=
+k8s.io/apiextensions-apiserver v0.36.1 h1:6JfYmPUsuUIHuN+3QxutXYWj492RqF5fBSx67GYK5Ks=
-k8s.io/apiextensions-apiserver v0.35.4/go.mod h1:ogQlk+stIE8mnoRthSYCwlOS12fVqgWFiErMwPaXA7c=
+k8s.io/apiextensions-apiserver v0.36.1/go.mod h1:pLzZin90riwisdzKwv/GoTwENooytoIx5zWJb4Hkby8=
-k8s.io/apimachinery v0.35.4 h1:xtdom9RG7e+yDp71uoXoJDWEE2eOiHgeO4GdBzwWpds=
+k8s.io/apimachinery v0.36.1 h1:G63Gjx2W+q0YD+72Vo8oY0nDnePVwnuzTmmy5ENrVSA=
-k8s.io/apimachinery v0.35.4/go.mod h1:NNi1taPOpep0jOj+oRha3mBJPqvi0hGdaV8TCqGQ+cc=
+k8s.io/apimachinery v0.36.1/go.mod h1:ibYOR00vW/I1kzvi5SF0dRuJ52BvKtfvRdOn35GPQ+8=
-k8s.io/apiserver v0.35.4 h1:vtuFqNFmF9bPRdHDL2lpK6qCTPWDreZJL4LRPwVM6ho=
+k8s.io/apiserver v0.36.1 h1:iMS5V+rPUertv5P9RaqJgmHHTuh4quWpoxchvMUY+JY=
-k8s.io/apiserver v0.35.4/go.mod h1:JnBcb+J8kFXKpZkgcbcUnPBBHi4qgBii1I7dLxFY/oo=
+k8s.io/apiserver v0.36.1/go.mod h1:Cby1PbLWztu0GDOxoO6iFOyyqIsziHNEW+w9zVQ22Kw=
-k8s.io/client-go v0.35.4 h1:DN6fyaGuzK64UvnKO5fOA6ymSjvfGAnCAHAR0C66kD8=
+k8s.io/client-go v0.36.1 h1:FN/K8QIT2CEDt+2WB2HnWrUANZ50AP5GII43/SP2JR0=
-k8s.io/client-go v0.35.4/go.mod h1:2Pg9WpsS4NeOpoYTfHHfMxBG8zFMSAUi4O/qoiJC3nY=
+k8s.io/client-go v0.36.1/go.mod h1:s6rAnCtTGYDQnpNjEhSaISV+2O8jwruZ6m3QOYBFbtU=
-k8s.io/component-base v0.35.4 h1:6n1tNJ87johN0Hif0Fs8K2GMthsaUwMqCebUDLYyv7U=
+k8s.io/component-base v0.36.1 h1:iG6GsELftXqTNG9HG6kiVjatSgAw1sf5pJ6R5a6N0kA=
-k8s.io/component-base v0.35.4/go.mod h1:qaDJgz5c1KYKla9occFmlJEfPpkuA55s90G509R+PeY=
+k8s.io/component-base v0.36.1/go.mod h1:nf9XPlntRdqO6WMeEWAA5F93Y4ICZQdeT9GeqLDB3JI=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4 h1:HhDfevmPS+OalTjQRKbTHppRIz01AWi8s45TMXStgYY=
+k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787 h1:kHv8PETbPIVHfqKBYwTNNSjqChf/7xn3JOS3re+NWs8=
-k8s.io/kube-openapi v0.0.0-20260127142750-a19766b6e2d4/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
+k8s.io/kube-openapi v0.0.0-20260502001324-b7f5293f4787/go.mod h1:Cyq7UE0QtGe+Zo+/6XFrxiS4Mq0tLyQEONkFzSkfp9o=
-k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 h1:kBawHLSnx/mYHmRnNUf9d4CpjREbeZuxoSGOX/J+aYM=
+k8s.io/streaming v0.36.1 h1:L+K68n4Gg940BGNNYtUBvL1WTLL0YnKT3s+P1MNAmR4=
-k8s.io/utils v0.0.0-20260319190234-28399d86e0b5/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+k8s.io/streaming v0.36.1/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0 h1:qPrZsv1cwQiFeieFlRqT627fVZ+tyfou/+S5S0H5ua0=
+k8s.io/utils v0.0.0-20260507154919-ff6756f316d2 h1:wU4tMEhLGgIbLvXQb1cfN+EcM0wf7zC6CPF+C79jroc=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
+k8s.io/utils v0.0.0-20260507154919-ff6756f316d2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
-sigs.k8s.io/controller-runtime v0.23.3 h1:VjB/vhoPoA9l1kEKZHBMnQF33tdCLQKJtydy4iqwZ80=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0 h1:hSfpvjjTQXQY2Fol2CS0QHMNs/WI1MOSGzCm1KhM5ec=
-sigs.k8s.io/controller-runtime v0.23.3/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.34.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
 sigs.k8s.io/controller-runtime v0.24.1 h1:miPEwrmirImAvgME1L9qebGHrOnGJoVmVdtOU9fRfo4=
 sigs.k8s.io/controller-runtime v0.24.1/go.mod h1:vFkfY5fGt5xAC/sKb8IBFKgWPNKG9OUG29dR8Y2wImw=
 sigs.k8s.io/gateway-api v1.5.0 h1:duoo14Ky/fJXpjpmyMISE2RTBGnfCg8zICfTYLTnBJA=
 sigs.k8s.io/gateway-api v1.5.0/go.mod h1:GvCETiaMAlLym5CovLxGjS0NysqFk3+Yuq3/rh6QL2o=
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
@ -344,7 +342,7 @@ sigs.k8s.io/kustomize/kyaml v0.21.1 h1:IVlbmhC076nf6foyL6Taw4BkrLuEsXUXNpsE+ScX7
 sigs.k8s.io/kustomize/kyaml v0.21.1/go.mod h1:hmxADesM3yUN2vbA5z1/YTBnzLJ1dajdqpQonwBL1FQ=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.0 h1:qmp2e3ZfFi1/jJbDGpD4mt3wyp6PE1NfKHCYLqgNQJo=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
--- a/internal/cnpgi/common/scheme.go
+++ b/internal/cnpgi/common/scheme.go
@ -29,7 +29,6 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	"sigs.k8s.io/controller-runtime/pkg/scheme"
 	barmancloudv1 "github.com/cloudnative-pg/plugin-barman-cloud/api/v1"
 )
@ -40,7 +39,7 @@ import (
 func GenerateScheme(ctx context.Context) *runtime.Scheme {
 	result := runtime.NewScheme()
-	utilruntime.Must(barmancloudv1.AddToScheme(result))
+	barmancloudv1.AddKnownTypes(result)
 	utilruntime.Must(clientgoscheme.AddToScheme(result))
 	cnpgGroup := viper.GetString("custom-cnpg-group")
@ -54,11 +53,11 @@ func GenerateScheme(ctx context.Context) *runtime.Scheme {
 	// Proceed with custom registration of the CNPG scheme
 	schemeGroupVersion := schema.GroupVersion{Group: cnpgGroup, Version: cnpgVersion}
-	schemeBuilder := &scheme.Builder{GroupVersion: schemeGroupVersion}
+	result.AddKnownTypes(schemeGroupVersion,
-	schemeBuilder.Register(&cnpgv1.Cluster{}, &cnpgv1.ClusterList{})
+		&cnpgv1.Cluster{}, &cnpgv1.ClusterList{},
-	schemeBuilder.Register(&cnpgv1.Backup{}, &cnpgv1.BackupList{})
+		&cnpgv1.Backup{}, &cnpgv1.BackupList{},
-	schemeBuilder.Register(&cnpgv1.ScheduledBackup{}, &cnpgv1.ScheduledBackupList{})
+		&cnpgv1.ScheduledBackup{}, &cnpgv1.ScheduledBackupList{},
-	utilruntime.Must(schemeBuilder.AddToScheme(result))
+	)
 	schemeLog := log.FromContext(ctx)
 	schemeLog.Info("CNPG types registration", "schemeGroupVersion", schemeGroupVersion)
--- a/internal/cnpgi/instance/internal/client/client_test.go
+++ b/internal/cnpgi/instance/internal/client/client_test.go
@ -39,7 +39,7 @@ var scheme = buildScheme()
 func buildScheme() *runtime.Scheme {
 	scheme := runtime.NewScheme()
 	_ = corev1.AddToScheme(scheme)
-	_ = barmancloudv1.AddToScheme(scheme)
+	barmancloudv1.AddKnownTypes(scheme)
 	return scheme
 }
--- a/internal/cnpgi/instance/metrics_test.go
+++ b/internal/cnpgi/instance/metrics_test.go
@ -55,7 +55,7 @@ var _ = Describe("Metrics Collect method", func() {
 	BeforeEach(func() {
 		ctx = context.Background()
 		scheme := runtime.NewScheme()
-		Expect(barmancloudv1.AddToScheme(scheme)).To(Succeed())
+		barmancloudv1.AddKnownTypes(scheme)
 		// Timestamps for the test
 		firstRecoverabilityPoint := metav1.NewTime(time.Now().Add(-24 * time.Hour))
--- a/internal/cnpgi/metadata/constants.go
+++ b/internal/cnpgi/metadata/constants.go
@ -28,8 +28,24 @@ const PluginName = "barman-cloud.cloudnative-pg.io"
 const (
 	// ClusterLabelName is the label applied to RBAC resources created
 	// by this plugin. Its value is the name of the owning Cluster.
 	//
 	// Discovery contract: internal/controller/objectstore_controller.go
 	// selects Roles by this key when an ObjectStore is reconciled.
 	// Renaming or removing the label would break that controller; new
 	// recommended-label keys are added alongside it, never in place
 	// of it.
 	ClusterLabelName = "barmancloud.cnpg.io/cluster"
 	// AppLabelValue is the value applied to app.kubernetes.io/name on
 	// every plugin-managed object. It identifies the application as
 	// the Barman Cloud plugin (see issue #545).
 	AppLabelValue = "barman-cloud-plugin"
 	// ManagedByLabelValue is the value applied to app.kubernetes.io/managed-by
 	// on every plugin-managed object. It identifies this plugin as
 	// the controller responsible for the object.
 	ManagedByLabelValue = "plugin-barman-cloud"
 	// CheckEmptyWalArchiveFile is the name of the file in the PGDATA that,
 	// if present, requires the WAL archiver to check that the backup object
 	// store is empty.
--- a/internal/cnpgi/operator/lifecycle.go
+++ b/internal/cnpgi/operator/lifecycle.go
@ -41,6 +41,9 @@ import (
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/operator/config"
 )
 // fullRecoveryJobName is the name of the restore job.
 const fullRecoveryJobName = "full-recovery"
 // LifecycleImplementation is the implementation of the lifecycle handler
 type LifecycleImplementation struct {
 	lifecycle.UnimplementedOperatorLifecycleServer
@ -48,6 +51,8 @@ type LifecycleImplementation struct {
 }
 // GetCapabilities exposes the lifecycle capabilities
 //
 //nolint:goconst
 func (impl LifecycleImplementation) GetCapabilities(
 	_ context.Context,
 	_ *lifecycle.OperatorLifecycleCapabilitiesRequest,
@ -186,7 +191,7 @@ func reconcileJob(
 	contextLogger.Debug("starting job reconciliation")
 	jobRole := getCNPGJobRole(&job)
-	if jobRole != "full-recovery" &&
+	if jobRole != fullRecoveryJobName &&
 		jobRole != "snapshot-recovery" {
 		contextLogger.Debug("job is not a recovery job, skipping")
 		return nil, nil
--- a/internal/cnpgi/operator/lifecycle_test.go
+++ b/internal/cnpgi/operator/lifecycle_test.go
@ -55,7 +55,7 @@ var _ = Describe("LifecycleImplementation", func() {
 	// helper to build a fake client with our scheme and optional objects
 	buildClientFunc := func(objs ...runtime.Object) *fake.ClientBuilder {
 		s := runtime.NewScheme()
-		_ = barmancloudv1.AddToScheme(s)
+		barmancloudv1.AddKnownTypes(s)
 		return fake.NewClientBuilder().WithScheme(s).WithRuntimeObjects(objs...)
 	}
@ -139,10 +139,10 @@ var _ = Describe("LifecycleImplementation", func() {
 				Spec: batchv1.JobSpec{Template: corev1.PodTemplateSpec{
 					ObjectMeta: metav1.ObjectMeta{
 						Labels: map[string]string{
-							utils.JobRoleLabelName: "full-recovery",
+							utils.JobRoleLabelName: fullRecoveryJobName,
 						},
 					},
-					Spec: corev1.PodSpec{Containers: []corev1.Container{{Name: "full-recovery"}}},
+					Spec: corev1.PodSpec{Containers: []corev1.Container{{Name: fullRecoveryJobName}}},
 				}},
 			}
 			jobJSON, _ := json.Marshal(job)
@ -351,7 +351,7 @@ var _ = Describe("LifecycleImplementation", func() {
 				},
 			}
 			s := runtime.NewScheme()
-			_ = barmancloudv1.AddToScheme(s)
+			barmancloudv1.AddKnownTypes(s)
 			cli := fake.NewClientBuilder().WithScheme(s).WithRuntimeObjects(store).Build()
 			impl := LifecycleImplementation{Client: cli}
@ -378,7 +378,7 @@ var _ = Describe("LifecycleImplementation", func() {
 				},
 			}
 			s := runtime.NewScheme()
-			_ = barmancloudv1.AddToScheme(s)
+			barmancloudv1.AddKnownTypes(s)
 			cli := fake.NewClientBuilder().WithScheme(s).WithRuntimeObjects(store).Build()
 			impl := LifecycleImplementation{Client: cli}
--- a/internal/cnpgi/operator/manager.go
+++ b/internal/cnpgi/operator/manager.go
@ -47,7 +47,7 @@ var scheme = runtime.NewScheme()
 func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
-	utilruntime.Must(barmancloudv1.AddToScheme(scheme))
+	barmancloudv1.AddKnownTypes(scheme)
 	// +kubebuilder:scaffold:scheme
 }
--- a/internal/cnpgi/operator/rbac/ensure.go
+++ b/internal/cnpgi/operator/rbac/ensure.go
@ -21,6 +21,7 @@ package rbac
 import (
 	"context"
 	"fmt"
 	cnpgv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
 	"github.com/cloudnative-pg/machinery/pkg/log"
@ -31,7 +32,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	barmancloudv1 "github.com/cloudnative-pg/plugin-barman-cloud/api/v1"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/metadata"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/operator/specs"
 )
@ -62,9 +62,7 @@ func EnsureRole(
 		return err
 	}
-	return patchRole(ctx, c, roleKey, newRole.Rules, map[string]string{
+	return patchRole(ctx, c, roleKey, newRole.Rules, specs.BuildLabels(cluster))
 		metadata.ClusterLabelName: cluster.Name,
 	})
 }
 // EnsureRoleRules updates the rules of an existing Role to match
@ -90,6 +88,143 @@ func EnsureRoleRules(
 	return err
 }
 // EnsureRoleBinding ensures the RoleBinding for the given Cluster
 // is present and carries the recommended labels.
 //
 // This function is called from the Pre hook (gRPC). It creates the
 // RoleBinding if it does not exist, then reconciles labels and
 // Subjects:
 //   - Labels are written per-key. Keys the plugin manages overwrite
 //     existing values; unrelated keys (anything outside the desired
 //     set) are left alone.
 //   - Subjects are additive. The plugin guarantees its own Subject
 //     is bound, but never removes Subjects added by other actors —
 //     a Subject is a grant of access, and silently revoking access
 //     someone else granted is the wrong default.
 //
 // RoleRef is immutable in Kubernetes. If the existing RoleBinding
 // points to a different Role, the plugin fails loudly so the
 // operator notices and recreates the object.
 func EnsureRoleBinding(ctx context.Context, c client.Client, cluster *cnpgv1.Cluster) error {
 	desiredRoleBinding := specs.BuildRoleBinding(cluster)
 	if err := specs.SetControllerReference(cluster, desiredRoleBinding); err != nil {
 		return err
 	}
 	roleBinding, err := getOrCreateRoleBinding(ctx, c, desiredRoleBinding)
 	if err != nil || roleBinding == nil {
 		// Either an error, or we just created the object with the
 		// desired state — nothing to patch.
 		return err
 	}
 	return reconcileRoleBinding(ctx, c, roleBinding, desiredRoleBinding)
 }
 // getOrCreateRoleBinding returns the existing RoleBinding when it
 // is already present on the API server, or nil after a successful
 // Create when the just-created object already carries the desired
 // state (so the caller can skip the patch path).
 //
 // On a stale-informer-cache race during plugin pod startup, where
 // Get returns NotFound but Create returns AlreadyExists, the
 // function re-Gets to return the racing winner — the caller then
 // falls through to reconciliation against that real object.
 func getOrCreateRoleBinding(
 	ctx context.Context,
 	c client.Client,
 	desired *rbacv1.RoleBinding,
 ) (*rbacv1.RoleBinding, error) {
 	contextLogger := log.FromContext(ctx)
 	rb := &rbacv1.RoleBinding{}
 	err := c.Get(ctx, client.ObjectKeyFromObject(desired), rb)
 	if err == nil {
 		return rb, nil
 	}
 	if !apierrs.IsNotFound(err) {
 		return nil, err
 	}
 	createErr := c.Create(ctx, desired)
 	switch {
 	case createErr == nil:
 		contextLogger.Info("Created RoleBinding",
 			"name", desired.Name, "namespace", desired.Namespace)
 		// Just-created with the desired state — caller skips patch.
 		return nil, nil
 	case apierrs.IsAlreadyExists(createErr):
 		contextLogger.Debug(
 			"RoleBinding already exists, likely a stale informer cache; re-fetching",
 			"name", desired.Name, "namespace", desired.Namespace)
 		// Re-Get to return the racing winner so the caller can
 		// reconcile against the real existing object.
 		fetched := &rbacv1.RoleBinding{}
 		if err := c.Get(ctx, client.ObjectKeyFromObject(desired), fetched); err != nil {
 			return nil, err
 		}
 		return fetched, nil
 	default:
 		return nil, createErr
 	}
 }
 // reconcileRoleBinding brings an existing RoleBinding's labels and
 // Subjects into alignment with desired. It re-Gets the object on
 // conflict-retry so each attempt observes fresh server state, and
 // uses optimistic locking so a competing writer's patch is rejected
 // with 409 instead of silently last-write-winning.
 //
 // On the first attempt the function uses the existing object passed
 // in by the caller, avoiding a second Get on the steady-state path.
 func reconcileRoleBinding(
 	ctx context.Context,
 	c client.Client,
 	existing, desired *rbacv1.RoleBinding,
 ) error {
 	contextLogger := log.FromContext(ctx)
 	first := true
 	return retry.RetryOnConflict(retry.DefaultBackoff, func() error {
 		var roleBinding *rbacv1.RoleBinding
 		if first {
 			roleBinding = existing
 			first = false
 		} else {
 			roleBinding = &rbacv1.RoleBinding{}
 			if err := c.Get(ctx, client.ObjectKeyFromObject(desired), roleBinding); err != nil {
 				return err
 			}
 		}
 		// RoleRef is immutable in Kubernetes; we cannot patch it.
 		// Divergence at the canonical name is corruption regardless
 		// of who wrote the existing object — fail loudly so the
 		// operator notices and deletes the RoleBinding, and the
 		// next Pre call recreates it correctly.
 		if !equality.Semantic.DeepEqual(roleBinding.RoleRef, desired.RoleRef) {
 			return fmt.Errorf(
 				"RoleBinding %s/%s has divergent immutable RoleRef "+
 					"(existing=%+v, desired=%+v); delete the RoleBinding to allow recreation",
 				roleBinding.Namespace, roleBinding.Name,
 				roleBinding.RoleRef, desired.RoleRef)
 		}
 		if !roleBindingNeedsUpdate(roleBinding, desired) {
 			return nil
 		}
 		contextLogger.Info("Patching role binding",
 			"name", roleBinding.Name, "namespace", roleBinding.Namespace)
 		oldRoleBinding := roleBinding.DeepCopy()
 		roleBinding.Labels = mergeLabels(roleBinding.Labels, desired.Labels)
 		roleBinding.Subjects = mergeSubjects(roleBinding.Subjects, desired.Subjects)
 		return c.Patch(ctx, roleBinding,
 			client.MergeFromWithOptions(oldRoleBinding, client.MergeFromWithOptimisticLock{}))
 	})
 }
 // ensureRoleExists creates the Role if it does not exist. Returns
 // nil on success and nil on AlreadyExists (another writer created
 // it concurrently). The caller always follows up with patchRole.
@ -155,22 +290,32 @@ func patchRole(
 		oldRole := role.DeepCopy()
 		role.Rules = desiredRules
 		role.Labels = mergeLabels(role.Labels, desiredLabels)
-		if desiredLabels != nil {
+		return c.Patch(ctx, &role,
-			if role.Labels == nil {
+			client.MergeFromWithOptions(oldRole, client.MergeFromWithOptimisticLock{}))
 				role.Labels = make(map[string]string, len(desiredLabels))
 			}
 			for k, v := range desiredLabels {
 				role.Labels[k] = v
 			}
 		}
 		return c.Patch(ctx, &role, client.MergeFrom(oldRole))
 	})
 }
-// labelsNeedUpdate returns true if any key in desired is missing
+// mergeLabels writes the desired labels onto existing per-key.
-// or has a different value in existing.
+// Keys in desired overwrite the existing value; keys not in desired
 // (any unrelated label a user may have set) are left alone.
 func mergeLabels(existing, desired map[string]string) map[string]string {
 	if len(desired) == 0 {
 		return existing
 	}
 	if existing == nil {
 		existing = make(map[string]string, len(desired))
 	}
 	for k, v := range desired {
 		existing[k] = v
 	}
 	return existing
 }
 // labelsNeedUpdate returns true if a Patch is required to bring
 // existing labels into the state mergeLabels would produce, i.e.
 // any desired key is missing or has a different value in existing.
 func labelsNeedUpdate(existing, desired map[string]string) bool {
 	for k, v := range desired {
 		if existing[k] != v {
@ -179,3 +324,46 @@ func labelsNeedUpdate(existing, desired map[string]string) bool {
 	}
 	return false
 }
 // containsSubject reports whether subjects contains an element that
 // is semantically equal to subject.
 func containsSubject(subjects []rbacv1.Subject, subject rbacv1.Subject) bool {
 	for _, s := range subjects {
 		if equality.Semantic.DeepEqual(s, subject) {
 			return true
 		}
 	}
 	return false
 }
 // mergeSubjects appends desired Subjects that are not already
 // present in existing.
 //
 // This is intentionally asymmetric to mergeLabels: labels are
 // metadata, so replacing stale plugin-set values is safe. A
 // Subject is a grant of access, so removing a Subject silently
 // revokes permissions an external operator chose to grant. The
 // plugin only requires that ITS Subject is present, not that it
 // is exclusive.
 func mergeSubjects(existing, desired []rbacv1.Subject) []rbacv1.Subject {
 	for _, d := range desired {
 		if !containsSubject(existing, d) {
 			existing = append(existing, d)
 		}
 	}
 	return existing
 }
 // roleBindingNeedsUpdate returns true if a Patch is required to
 // bring existing into alignment with desired — any desired Subject
 // missing (see mergeSubjects), or any desired label key missing
 // or holding a stale value (see mergeLabels).
 func roleBindingNeedsUpdate(existing, desired *rbacv1.RoleBinding) bool {
 	for _, s := range desired.Subjects {
 		if !containsSubject(existing.Subjects, s) {
 			return true
 		}
 	}
 	return labelsNeedUpdate(existing.Labels, desired.Labels)
 }
--- a/internal/cnpgi/operator/rbac/ensure_test.go
+++ b/internal/cnpgi/operator/rbac/ensure_test.go
@ -25,6 +25,7 @@ import (
 	barmanapi "github.com/cloudnative-pg/barman-cloud/pkg/api"
 	cnpgv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
 	"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
 	machineryapi "github.com/cloudnative-pg/machinery/pkg/api"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@ -42,11 +43,47 @@ import (
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/operator/rbac"
 )
 func expectRequiredLabels(labels map[string]string, clusterName string) {
 	ExpectWithOffset(1, labels).To(HaveKeyWithValue(metadata.ClusterLabelName, clusterName))
 	ExpectWithOffset(1, labels).To(HaveKeyWithValue(utils.KubernetesAppLabelName, metadata.AppLabelValue))
 	ExpectWithOffset(1, labels).To(HaveKeyWithValue(utils.KubernetesAppInstanceLabelName, clusterName))
 	ExpectWithOffset(1, labels).To(HaveKeyWithValue(utils.KubernetesAppManagedByLabelName, metadata.ManagedByLabelValue))
 	ExpectWithOffset(1, labels).To(HaveKeyWithValue(utils.KubernetesAppComponentLabelName, utils.DatabaseComponentName))
 	ExpectWithOffset(1, labels).To(HaveKeyWithValue(utils.KubernetesAppVersionLabelName, metadata.Data.Version))
 }
 // newPatchCountingClient returns a fake client plus a pointer to a
 // counter incremented on every Patch call. Useful for asserting
 // that a "no-op" reconcile path issues no Patch — more reliable
 // than comparing ResourceVersion across reads, which depends on
 // fake-client RV-bumping semantics that are not part of the
 // controller-runtime contract.
 func newPatchCountingClient(initObjs ...client.Object) (client.Client, *int) {
 	count := 0
 	c := fake.NewClientBuilder().
 		WithScheme(newScheme()).
 		WithObjects(initObjs...).
 		WithInterceptorFuncs(interceptor.Funcs{
 			Patch: func(
 				ctx context.Context,
 				client client.WithWatch,
 				obj client.Object,
 				patch client.Patch,
 				opts ...client.PatchOption,
 			) error {
 				count++
 				return client.Patch(ctx, obj, patch, opts...)
 			},
 		}).
 		Build()
 	return c, &count
 }
 func newScheme() *runtime.Scheme {
 	s := runtime.NewScheme()
 	utilruntime.Must(rbacv1.AddToScheme(s))
 	utilruntime.Must(cnpgv1.AddToScheme(s))
-	utilruntime.Must(barmancloudv1.AddToScheme(s))
+	barmancloudv1.AddKnownTypes(s)
 	return s
 }
@ -124,33 +161,23 @@ var _ = Describe("EnsureRole", func() {
 			Expect(role.OwnerReferences[0].Name).To(Equal("test-cluster"))
 			Expect(role.OwnerReferences[0].Kind).To(Equal("Cluster"))
-			Expect(role.Labels).To(HaveKeyWithValue(metadata.ClusterLabelName, "test-cluster"))
+			expectRequiredLabels(role.Labels, "test-cluster")
 		})
 	})
 	Context("when the Role exists with matching rules", func() {
 		var patchCount *int
 		BeforeEach(func() {
-			fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
+			fakeClient, patchCount = newPatchCountingClient()
 			Expect(rbac.EnsureRole(ctx, fakeClient, cluster, objects)).To(Succeed())
 			*patchCount = 0
 		})
 		It("should not patch the Role", func() {
 			var before rbacv1.Role
 			Expect(fakeClient.Get(ctx, client.ObjectKey{
 				Namespace: "default",
 				Name:      "test-cluster-barman-cloud",
 			}, &before)).To(Succeed())
 			err := rbac.EnsureRole(ctx, fakeClient, cluster, objects)
 			Expect(err).NotTo(HaveOccurred())
-
+			Expect(*patchCount).To(BeZero())
 			var after rbacv1.Role
 			Expect(fakeClient.Get(ctx, client.ObjectKey{
 				Namespace: "default",
 				Name:      "test-cluster-barman-cloud",
 			}, &after)).To(Succeed())
 			Expect(after.ResourceVersion).To(Equal(before.ResourceVersion))
 		})
 	})
@ -210,7 +237,7 @@ var _ = Describe("EnsureRole", func() {
 					Name:      "test-cluster-barman-cloud",
 					Namespace: "default",
 					Labels: map[string]string{
-						"app.kubernetes.io/managed-by": "helm",
+						"custom-label": "custom-value",
 					},
 				},
 			}
@ -227,8 +254,40 @@ var _ = Describe("EnsureRole", func() {
 				Name:      "test-cluster-barman-cloud",
 			}, &role)).To(Succeed())
-			Expect(role.Labels).To(HaveKeyWithValue("app.kubernetes.io/managed-by", "helm"))
+			Expect(role.Labels).To(HaveKeyWithValue("custom-label", "custom-value"))
-			Expect(role.Labels).To(HaveKeyWithValue(metadata.ClusterLabelName, "test-cluster"))
+			expectRequiredLabels(role.Labels, "test-cluster")
 		})
 	})
 	Context("when the Role exists with a stale label value", func() {
 		BeforeEach(func() {
 			fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
 			existing := &rbacv1.Role{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-cluster-barman-cloud",
 					Namespace: "default",
 					Labels: map[string]string{
 						// Stale value as if written by an older plugin
 						// version.
 						utils.KubernetesAppVersionLabelName: "0.0.0-stale",
 					},
 				},
 			}
 			Expect(fakeClient.Create(ctx, existing)).To(Succeed())
 		})
 		It("should overwrite the stale value with the current plugin's value", func() {
 			err := rbac.EnsureRole(ctx, fakeClient, cluster, objects)
 			Expect(err).NotTo(HaveOccurred())
 			var role rbacv1.Role
 			Expect(fakeClient.Get(ctx, client.ObjectKey{
 				Namespace: "default",
 				Name:      "test-cluster-barman-cloud",
 			}, &role)).To(Succeed())
 			Expect(role.Labels).To(HaveKeyWithValue(
 				utils.KubernetesAppVersionLabelName, metadata.Data.Version))
 		})
 	})
@ -257,12 +316,348 @@ var _ = Describe("EnsureRole", func() {
 				Name:      "test-cluster-barman-cloud",
 			}, &role)).To(Succeed())
-			Expect(role.Labels).To(HaveKeyWithValue(metadata.ClusterLabelName, "test-cluster"))
+			expectRequiredLabels(role.Labels, "test-cluster")
 			Expect(role.Rules).To(HaveLen(3))
 		})
 	})
 })
 var _ = Describe("EnsureRoleBinding", func() {
 	var (
 		ctx        context.Context
 		cluster    *cnpgv1.Cluster
 		fakeClient client.Client
 	)
 	BeforeEach(func() {
 		ctx = context.Background()
 		cluster = newCluster("test-cluster", "default")
 	})
 	Context("when the RoleBinding does not exist", func() {
 		BeforeEach(func() {
 			fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
 		})
 		It("should create the RoleBinding with owner reference, labels, and correct subjects", func() {
 			err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
 			Expect(err).NotTo(HaveOccurred())
 			var rb rbacv1.RoleBinding
 			Expect(fakeClient.Get(ctx, client.ObjectKey{
 				Namespace: "default",
 				Name:      "test-cluster-barman-cloud",
 			}, &rb)).To(Succeed())
 			Expect(rb.OwnerReferences).To(HaveLen(1))
 			Expect(rb.OwnerReferences[0].Name).To(Equal("test-cluster"))
 			Expect(rb.OwnerReferences[0].Kind).To(Equal("Cluster"))
 			expectRequiredLabels(rb.Labels, "test-cluster")
 			Expect(rb.Subjects).To(HaveLen(1))
 			Expect(rb.Subjects[0].Name).To(Equal("test-cluster"))
 			Expect(rb.Subjects[0].Kind).To(Equal("ServiceAccount"))
 			Expect(rb.RoleRef.Kind).To(Equal("Role"))
 			Expect(rb.RoleRef.Name).To(Equal("test-cluster-barman-cloud"))
 		})
 	})
 	Context("when the RoleBinding exists with matching state", func() {
 		var patchCount *int
 		BeforeEach(func() {
 			fakeClient, patchCount = newPatchCountingClient()
 			Expect(rbac.EnsureRoleBinding(ctx, fakeClient, cluster)).To(Succeed())
 			*patchCount = 0
 		})
 		It("should not patch the RoleBinding", func() {
 			err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(*patchCount).To(BeZero())
 		})
 	})
 	Context("when the RoleBinding exists with extra user-added subjects", func() {
 		BeforeEach(func() {
 			fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
 			existing := &rbacv1.RoleBinding{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-cluster-barman-cloud",
 					Namespace: "default",
 				},
 				Subjects: []rbacv1.Subject{
 					{
 						Kind:     "ServiceAccount",
 						Name:     "user-debug-sa",
 						APIGroup: "",
 					},
 				},
 				RoleRef: rbacv1.RoleRef{
 					APIGroup: "rbac.authorization.k8s.io",
 					Kind:     "Role",
 					Name:     "test-cluster-barman-cloud",
 				},
 			}
 			Expect(fakeClient.Create(ctx, existing)).To(Succeed())
 		})
 		It("should add the plugin's subject without removing user-added ones", func() {
 			err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
 			Expect(err).NotTo(HaveOccurred())
 			var rb rbacv1.RoleBinding
 			Expect(fakeClient.Get(ctx, client.ObjectKey{
 				Namespace: "default",
 				Name:      "test-cluster-barman-cloud",
 			}, &rb)).To(Succeed())
 			// Additive policy: the user-added subject must remain.
 			Expect(rb.Subjects).To(ContainElement(rbacv1.Subject{
 				Kind:     "ServiceAccount",
 				Name:     "user-debug-sa",
 				APIGroup: "",
 			}))
 			// The plugin's required subject must be present.
 			Expect(rb.Subjects).To(ContainElement(rbacv1.Subject{
 				Kind:      "ServiceAccount",
 				Name:      "test-cluster",
 				Namespace: "default",
 				APIGroup:  "",
 			}))
 		})
 	})
 	Context("when the RoleBinding exists with a stale label value", func() {
 		BeforeEach(func() {
 			fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
 			existing := &rbacv1.RoleBinding{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-cluster-barman-cloud",
 					Namespace: "default",
 					Labels: map[string]string{
 						utils.KubernetesAppVersionLabelName: "0.0.0-stale",
 					},
 				},
 				Subjects: []rbacv1.Subject{
 					{
 						Kind:      "ServiceAccount",
 						Name:      "test-cluster",
 						Namespace: "default",
 						APIGroup:  "",
 					},
 				},
 				RoleRef: rbacv1.RoleRef{
 					APIGroup: "rbac.authorization.k8s.io",
 					Kind:     "Role",
 					Name:     "test-cluster-barman-cloud",
 				},
 			}
 			Expect(fakeClient.Create(ctx, existing)).To(Succeed())
 		})
 		It("should overwrite the stale value with the current plugin's value", func() {
 			err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
 			Expect(err).NotTo(HaveOccurred())
 			var rb rbacv1.RoleBinding
 			Expect(fakeClient.Get(ctx, client.ObjectKey{
 				Namespace: "default",
 				Name:      "test-cluster-barman-cloud",
 			}, &rb)).To(Succeed())
 			Expect(rb.Labels).To(HaveKeyWithValue(
 				utils.KubernetesAppVersionLabelName, metadata.Data.Version))
 		})
 	})
 	Context("when the RoleBinding has pre-existing unrelated labels", func() {
 		BeforeEach(func() {
 			fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
 			existing := &rbacv1.RoleBinding{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-cluster-barman-cloud",
 					Namespace: "default",
 					Labels: map[string]string{
 						"custom-label": "custom-value",
 					},
 				},
 				Subjects: []rbacv1.Subject{
 					{
 						Kind:      "ServiceAccount",
 						Name:      "test-cluster",
 						Namespace: "default",
 						APIGroup:  "",
 					},
 				},
 				RoleRef: rbacv1.RoleRef{
 					APIGroup: "rbac.authorization.k8s.io",
 					Kind:     "Role",
 					Name:     "test-cluster-barman-cloud",
 				},
 			}
 			Expect(fakeClient.Create(ctx, existing)).To(Succeed())
 		})
 		It("should preserve unrelated labels while adding the required labels", func() {
 			err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
 			Expect(err).NotTo(HaveOccurred())
 			var rb rbacv1.RoleBinding
 			Expect(fakeClient.Get(ctx, client.ObjectKey{
 				Namespace: "default",
 				Name:      "test-cluster-barman-cloud",
 			}, &rb)).To(Succeed())
 			Expect(rb.Labels).To(HaveKeyWithValue("custom-label", "custom-value"))
 			expectRequiredLabels(rb.Labels, "test-cluster")
 		})
 	})
 	Context("when the RoleBinding has a divergent RoleRef", func() {
 		BeforeEach(func() {
 			fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
 			existing := &rbacv1.RoleBinding{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-cluster-barman-cloud",
 					Namespace: "default",
 				},
 				Subjects: []rbacv1.Subject{
 					{
 						Kind:      "ServiceAccount",
 						Name:      "test-cluster",
 						Namespace: "default",
 						APIGroup:  "",
 					},
 				},
 				RoleRef: rbacv1.RoleRef{
 					APIGroup: "rbac.authorization.k8s.io",
 					Kind:     "Role",
 					Name:     "wrong-role",
 				},
 			}
 			Expect(fakeClient.Create(ctx, existing)).To(Succeed())
 		})
 		It("should return a descriptive error since RoleRef is immutable", func() {
 			err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
 			Expect(err).To(HaveOccurred())
 			Expect(err.Error()).To(ContainSubstring("RoleRef"))
 			Expect(err.Error()).To(ContainSubstring("wrong-role"))
 		})
 	})
 	Context("when an AlreadyExists race happens during a stale-cache create (plugin pod startup)", func() {
 		var preExisting *rbacv1.RoleBinding
 		BeforeEach(func() {
 			preExisting = &rbacv1.RoleBinding{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-cluster-barman-cloud",
 					Namespace: "default",
 				},
 				Subjects: []rbacv1.Subject{
 					{
 						Kind:      "ServiceAccount",
 						Name:      "test-cluster",
 						Namespace: "default",
 						APIGroup:  "",
 					},
 				},
 				RoleRef: rbacv1.RoleRef{
 					APIGroup: "rbac.authorization.k8s.io",
 					Kind:     "Role",
 					Name:     "test-cluster-barman-cloud",
 				},
 			}
 			// First Get returns NotFound (simulates cold informer
 			// cache after plugin pod restart). Subsequent Gets
 			// fall through to real fake-client behavior.
 			gets := 0
 			fakeClient = fake.NewClientBuilder().
 				WithScheme(newScheme()).
 				WithObjects(preExisting).
 				WithInterceptorFuncs(interceptor.Funcs{
 					Get: func(
 						ctx context.Context,
 						c client.WithWatch,
 						key client.ObjectKey,
 						obj client.Object,
 						opts ...client.GetOption,
 					) error {
 						gets++
 						if gets == 1 {
 							return apierrs.NewNotFound(
 								rbacv1.Resource("rolebindings"), key.Name)
 						}
 						return c.Get(ctx, key, obj, opts...)
 					},
 				}).
 				Build()
 		})
 		It("should tolerate the AlreadyExists and reconcile from the existing object", func() {
 			err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
 			Expect(err).NotTo(HaveOccurred())
 			var rb rbacv1.RoleBinding
 			Expect(fakeClient.Get(ctx, client.ObjectKey{
 				Namespace: "default",
 				Name:      "test-cluster-barman-cloud",
 			}, &rb)).To(Succeed())
 			Expect(rb.Subjects).To(ContainElement(rbacv1.Subject{
 				Kind:      "ServiceAccount",
 				Name:      "test-cluster",
 				Namespace: "default",
 				APIGroup:  "",
 			}))
 		})
 	})
 	Context("when the RoleBinding exists without labels (upgrade scenario)", func() {
 		BeforeEach(func() {
 			fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
 			existing := &rbacv1.RoleBinding{
 				ObjectMeta: metav1.ObjectMeta{
 					Name:      "test-cluster-barman-cloud",
 					Namespace: "default",
 				},
 				Subjects: []rbacv1.Subject{
 					{
 						Kind:      "ServiceAccount",
 						Name:      "test-cluster",
 						Namespace: "default",
 						APIGroup:  "",
 					},
 				},
 				RoleRef: rbacv1.RoleRef{
 					APIGroup: "rbac.authorization.k8s.io",
 					Kind:     "Role",
 					Name:     "test-cluster-barman-cloud",
 				},
 			}
 			Expect(fakeClient.Create(ctx, existing)).To(Succeed())
 		})
 		It("should add the required labels", func() {
 			err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
 			Expect(err).NotTo(HaveOccurred())
 			var rb rbacv1.RoleBinding
 			Expect(fakeClient.Get(ctx, client.ObjectKey{
 				Namespace: "default",
 				Name:      "test-cluster-barman-cloud",
 			}, &rb)).To(Succeed())
 			expectRequiredLabels(rb.Labels, "test-cluster")
 		})
 	})
 })
 var _ = Describe("EnsureRoleRules", func() {
 	var (
 		ctx        context.Context
@ -306,23 +701,21 @@ var _ = Describe("EnsureRoleRules", func() {
 		})
 		It("should not patch when rules already match", func() {
-			// Seed with the same objects so rules match
+			// Replace the seeded client with a counting one,
 			// then re-seed via EnsureRole so the desired rules
 			// are already in place when EnsureRoleRules runs.
 			var patchCount *int
 			fakeClient, patchCount = newPatchCountingClient()
 			cluster := newCluster("test-cluster", "default")
 			Expect(rbac.EnsureRole(ctx, fakeClient, cluster, objects)).To(Succeed())
 			*patchCount = 0
 			roleKey := client.ObjectKey{
 				Namespace: "default",
 				Name:      "test-cluster-barman-cloud",
 			}
 			var before rbacv1.Role
 			Expect(fakeClient.Get(ctx, roleKey, &before)).To(Succeed())
 			Expect(rbac.EnsureRoleRules(ctx, fakeClient, roleKey, objects)).To(Succeed())
-
+			Expect(*patchCount).To(BeZero())
 			var after rbacv1.Role
 			Expect(fakeClient.Get(ctx, roleKey, &after)).To(Succeed())
 			Expect(after.ResourceVersion).To(Equal(before.ResourceVersion))
 		})
 		It("should not modify labels", func() {
--- a/internal/cnpgi/operator/reconciler.go
+++ b/internal/cnpgi/operator/reconciler.go
@ -27,14 +27,12 @@ import (
 	"github.com/cloudnative-pg/cnpg-i-machinery/pkg/pluginhelper/object"
 	"github.com/cloudnative-pg/cnpg-i/pkg/reconciler"
 	"github.com/cloudnative-pg/machinery/pkg/log"
 	rbacv1 "k8s.io/api/rbac/v1"
 	apierrs "k8s.io/apimachinery/pkg/api/errors"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	barmancloudv1 "github.com/cloudnative-pg/plugin-barman-cloud/api/v1"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/operator/config"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/operator/rbac"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/operator/specs"
 )
 // ReconcilerImplementation implements the Reconciler capability
@ -117,7 +115,7 @@ func (r ReconcilerImplementation) Pre(
 		return nil, err
 	}
-	if err := r.ensureRoleBinding(ctx, &cluster); err != nil {
+	if err := rbac.EnsureRoleBinding(ctx, r.Client, &cluster); err != nil {
 		return nil, err
 	}
@ -136,34 +134,3 @@ func (r ReconcilerImplementation) Post(
 		Behavior: reconciler.ReconcilerHooksResult_BEHAVIOR_CONTINUE,
 	}, nil
 }
 func (r ReconcilerImplementation) ensureRoleBinding(
 	ctx context.Context,
 	cluster *cnpgv1.Cluster,
 ) error {
 	var roleBinding rbacv1.RoleBinding
 	if err := r.Client.Get(ctx, client.ObjectKey{
 		Namespace: cluster.Namespace,
 		Name:      specs.GetRBACName(cluster.Name),
 	}, &roleBinding); err != nil {
 		if apierrs.IsNotFound(err) {
 			return r.createRoleBinding(ctx, cluster)
 		}
 		return err
 	}
 	// TODO: this assumes role bindings never change.
 	// Is that true? Should we relax this assumption?
 	return nil
 }
 func (r ReconcilerImplementation) createRoleBinding(
 	ctx context.Context,
 	cluster *cnpgv1.Cluster,
 ) error {
 	roleBinding := specs.BuildRoleBinding(cluster)
 	if err := specs.SetControllerReference(cluster, roleBinding); err != nil {
 		return err
 	}
 	return r.Client.Create(ctx, roleBinding)
 }
--- a/internal/cnpgi/operator/specs/labels.go
+++ b/internal/cnpgi/operator/specs/labels.go
@ -0,0 +1,41 @@
 /*
 Copyright © contributors to CloudNativePG, established as
 CloudNativePG a Series of LF Projects, LLC.
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
    http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 SPDX-License-Identifier: Apache-2.0
 */
 package specs
 import (
 	cnpgv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
 	"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/metadata"
 )
 // BuildLabels returns the Kubernetes recommended labels applied to
 // every object managed by this plugin for the given Cluster. See
 // https://github.com/cloudnative-pg/plugin-barman-cloud/issues/545.
 func BuildLabels(cluster *cnpgv1.Cluster) map[string]string {
 	return map[string]string{
 		metadata.ClusterLabelName:             cluster.Name,
 		utils.KubernetesAppLabelName:          metadata.AppLabelValue,
 		utils.KubernetesAppInstanceLabelName:  cluster.Name,
 		utils.KubernetesAppVersionLabelName:   metadata.Data.Version,
 		utils.KubernetesAppComponentLabelName: utils.DatabaseComponentName,
 		utils.KubernetesAppManagedByLabelName: metadata.ManagedByLabelValue,
 	}
 }
--- a/internal/cnpgi/operator/specs/labels_test.go
+++ b/internal/cnpgi/operator/specs/labels_test.go
@ -0,0 +1,68 @@
 /*
 Copyright © contributors to CloudNativePG, established as
 CloudNativePG a Series of LF Projects, LLC.
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
    http://www.apache.org/licenses/LICENSE-2.0
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 SPDX-License-Identifier: Apache-2.0
 */
 package specs
 import (
 	cnpgv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
 	"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/metadata"
 )
 var _ = Describe("BuildLabels", func() {
 	It("should return the recommended labels with plugin identity", func() {
 		cluster := &cnpgv1.Cluster{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "my-cluster",
 				Namespace: "default",
 			},
 		}
 		labels := BuildLabels(cluster)
 		Expect(labels).To(HaveKeyWithValue(metadata.ClusterLabelName, "my-cluster"))
 		Expect(labels).To(HaveKeyWithValue(utils.KubernetesAppLabelName, metadata.AppLabelValue))
 		Expect(labels).To(HaveKeyWithValue(utils.KubernetesAppInstanceLabelName, "my-cluster"))
 		Expect(labels).To(HaveKeyWithValue(utils.KubernetesAppVersionLabelName, metadata.Data.Version))
 		Expect(labels).To(HaveKeyWithValue(utils.KubernetesAppComponentLabelName, utils.DatabaseComponentName))
 		Expect(labels).To(HaveKeyWithValue(utils.KubernetesAppManagedByLabelName, metadata.ManagedByLabelValue))
 		Expect(labels).To(HaveLen(6))
 	})
 	It("should report the plugin version regardless of the cluster's Postgres image", func() {
 		cluster := &cnpgv1.Cluster{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "pg16-cluster",
 				Namespace: "default",
 			},
 			Spec: cnpgv1.ClusterSpec{
 				ImageCatalogRef: &cnpgv1.ImageCatalogRef{
 					Major: 16,
 				},
 			},
 		}
 		labels := BuildLabels(cluster)
 		Expect(labels).To(HaveKeyWithValue(utils.KubernetesAppVersionLabelName, metadata.Data.Version))
 		Expect(labels).To(HaveKeyWithValue(utils.KubernetesAppInstanceLabelName, "pg16-cluster"))
 	})
 })
--- a/internal/cnpgi/operator/specs/role.go
+++ b/internal/cnpgi/operator/specs/role.go
@ -29,7 +29,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	barmancloudv1 "github.com/cloudnative-pg/plugin-barman-cloud/api/v1"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/metadata"
 )
 // BuildRole builds the Role object for this cluster
@ -41,15 +40,15 @@ func BuildRole(
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace: cluster.Namespace,
 			Name:      GetRBACName(cluster.Name),
-			Labels: map[string]string{
+			Labels:    BuildLabels(cluster),
 				metadata.ClusterLabelName: cluster.Name,
 			},
 		},
 		Rules: BuildRoleRules(barmanObjects),
 	}
 }
 // BuildRoleRules builds the RBAC PolicyRules for the given ObjectStores.
 //
 //nolint:goconst
 func BuildRoleRules(barmanObjects []barmancloudv1.ObjectStore) []rbacv1.PolicyRule {
 	secretsSet := stringset.New()
 	barmanObjectsSet := stringset.New()
@ -131,6 +130,7 @@ func BuildRoleBinding(
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace: cluster.Namespace,
 			Name:      GetRBACName(cluster.Name),
 			Labels:    BuildLabels(cluster),
 		},
 		Subjects: []rbacv1.Subject{
 			{
--- a/internal/controller/objectstore_controller_test.go
+++ b/internal/controller/objectstore_controller_test.go
@ -46,7 +46,7 @@ import (
 func newFakeScheme() *runtime.Scheme {
 	s := runtime.NewScheme()
 	utilruntime.Must(rbacv1.AddToScheme(s))
-	utilruntime.Must(barmancloudv1.AddToScheme(s))
+	barmancloudv1.AddKnownTypes(s)
 	return s
 }
--- a/internal/scheme/cnpg.go
+++ b/internal/scheme/cnpg.go
@ -27,8 +27,6 @@ import (
 	"github.com/spf13/viper"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	crscheme "sigs.k8s.io/controller-runtime/pkg/scheme"
 )
 // AddCNPGToScheme registers CNPG types into the given scheme using
@ -46,11 +44,11 @@ func AddCNPGToScheme(ctx context.Context, s *runtime.Scheme) {
 	}
 	schemeGroupVersion := schema.GroupVersion{Group: cnpgGroup, Version: cnpgVersion}
-	schemeBuilder := &crscheme.Builder{GroupVersion: schemeGroupVersion}
+	s.AddKnownTypes(schemeGroupVersion,
-	schemeBuilder.Register(&cnpgv1.Cluster{}, &cnpgv1.ClusterList{})
+		&cnpgv1.Cluster{}, &cnpgv1.ClusterList{},
-	schemeBuilder.Register(&cnpgv1.Backup{}, &cnpgv1.BackupList{})
+		&cnpgv1.Backup{}, &cnpgv1.BackupList{},
-	schemeBuilder.Register(&cnpgv1.ScheduledBackup{}, &cnpgv1.ScheduledBackupList{})
+		&cnpgv1.ScheduledBackup{}, &cnpgv1.ScheduledBackupList{},
-	utilruntime.Must(schemeBuilder.AddToScheme(s))
+	)
 	log.FromContext(ctx).Info("CNPG types registration", "schemeGroupVersion", schemeGroupVersion)
 }
--- a/manifest.yaml
+++ b/manifest.yaml
@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
  annotations:
-    controller-gen.kubebuilder.io/version: v0.20.1
+    controller-gen.kubebuilder.io/version: v0.21.0
  name: objectstores.barmancloud.cnpg.io
 spec:
  group: barmancloud.cnpg.io
--- a/test/e2e/internal/client/client.go
+++ b/test/e2e/internal/client/client.go
@ -91,12 +91,11 @@ func addScheme(cl client.Client) error {
 	if err := certmanagerv1.AddToScheme(scheme); err != nil {
 		return fmt.Errorf("failed to add cert-manager/v1 to scheme: %w", err)
 	}
 	if err := pluginBarmanCloudV1.AddToScheme(scheme); err != nil {
 		return fmt.Errorf("failed to add plugin-barman-cloud/v1 to scheme: %w", err)
 	}
 	if err := cloudnativepgv1.AddToScheme(scheme); err != nil {
 		return fmt.Errorf("failed to add cloudnativepg/v1 to scheme: %w", err)
 	}
 	pluginBarmanCloudV1.AddKnownTypes(scheme)
 	return nil
 }
--- a/web/docs/usage.md
+++ b/web/docs/usage.md
@ -46,7 +46,7 @@ spec:
 The `.spec.configuration` schema follows the same format as the
 [in-tree barman-cloud support](https://pkg.go.dev/github.com/cloudnative-pg/barman-cloud/pkg/api#BarmanObjectStoreConfiguration).
-Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/preview/backup_barmanobjectstore/)
+Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/current/appendixes/backup_barmanobjectstore/)
 for additional details.
 :::important
--- a/web/package.json
+++ b/web/package.json
@ -15,8 +15,8 @@
    "typecheck": "tsc"
  },
  "dependencies": {
-    "@docusaurus/core": "3.10.0",
+    "@docusaurus/core": "3.10.1",
-    "@docusaurus/preset-classic": "3.10.0",
+    "@docusaurus/preset-classic": "3.10.1",
    "@easyops-cn/docusaurus-search-local": "^0.55.0",
    "@mdx-js/react": "^3.0.0",
    "clsx": "^2.0.0",
@ -25,9 +25,9 @@
    "react-dom": "^19.0.0"
  },
  "devDependencies": {
-    "@docusaurus/module-type-aliases": "3.10.0",
+    "@docusaurus/module-type-aliases": "3.10.1",
-    "@docusaurus/tsconfig": "3.10.0",
+    "@docusaurus/tsconfig": "3.10.1",
-    "@docusaurus/types": "3.10.0",
+    "@docusaurus/types": "3.10.1",
    "typescript": "~6.0.0"
  },
  "browserslist": {
--- a/web/versioned_docs/version-0.10.0/usage.md
+++ b/web/versioned_docs/version-0.10.0/usage.md
@ -46,7 +46,7 @@ spec:
 The `.spec.configuration` schema follows the same format as the
 [in-tree barman-cloud support](https://pkg.go.dev/github.com/cloudnative-pg/barman-cloud/pkg/api#BarmanObjectStoreConfiguration).
-Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/preview/backup_barmanobjectstore/)
+Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/current/appendixes/backup_barmanobjectstore/)
 for additional details.
 :::important
--- a/web/versioned_docs/version-0.11.0/usage.md
+++ b/web/versioned_docs/version-0.11.0/usage.md
@ -46,7 +46,7 @@ spec:
 The `.spec.configuration` schema follows the same format as the
 [in-tree barman-cloud support](https://pkg.go.dev/github.com/cloudnative-pg/barman-cloud/pkg/api#BarmanObjectStoreConfiguration).
-Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/preview/backup_barmanobjectstore/)
+Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/current/appendixes/backup_barmanobjectstore/)
 for additional details.
 :::important
--- a/web/versioned_docs/version-0.12.0/usage.md
+++ b/web/versioned_docs/version-0.12.0/usage.md
@ -46,7 +46,7 @@ spec:
 The `.spec.configuration` schema follows the same format as the
 [in-tree barman-cloud support](https://pkg.go.dev/github.com/cloudnative-pg/barman-cloud/pkg/api#BarmanObjectStoreConfiguration).
-Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/preview/backup_barmanobjectstore/)
+Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/current/appendixes/backup_barmanobjectstore/)
 for additional details.
 :::important
--- a/web/versioned_docs/version-0.4.0/usage.md
+++ b/web/versioned_docs/version-0.4.0/usage.md
@ -46,7 +46,7 @@ spec:
 The `.spec.configuration` schema follows the same format as the
 [in-tree barman-cloud support](https://pkg.go.dev/github.com/cloudnative-pg/barman-cloud/pkg/api#BarmanObjectStoreConfiguration).
-Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/preview/backup_barmanobjectstore/)
+Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/current/appendixes/backup_barmanobjectstore/)
 for additional details.
 :::important
--- a/web/versioned_docs/version-0.4.1/usage.md
+++ b/web/versioned_docs/version-0.4.1/usage.md
@ -46,7 +46,7 @@ spec:
 The `.spec.configuration` schema follows the same format as the
 [in-tree barman-cloud support](https://pkg.go.dev/github.com/cloudnative-pg/barman-cloud/pkg/api#BarmanObjectStoreConfiguration).
-Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/preview/backup_barmanobjectstore/)
+Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/current/appendixes/backup_barmanobjectstore/)
 for additional details.
 :::important
--- a/web/versioned_docs/version-0.5.0/usage.md
+++ b/web/versioned_docs/version-0.5.0/usage.md
@ -46,7 +46,7 @@ spec:
 The `.spec.configuration` schema follows the same format as the
 [in-tree barman-cloud support](https://pkg.go.dev/github.com/cloudnative-pg/barman-cloud/pkg/api#BarmanObjectStoreConfiguration).
-Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/preview/backup_barmanobjectstore/)
+Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/current/appendixes/backup_barmanobjectstore/)
 for additional details.
 :::important
--- a/web/versioned_docs/version-0.6.0/usage.md
+++ b/web/versioned_docs/version-0.6.0/usage.md
@ -46,7 +46,7 @@ spec:
 The `.spec.configuration` schema follows the same format as the
 [in-tree barman-cloud support](https://pkg.go.dev/github.com/cloudnative-pg/barman-cloud/pkg/api#BarmanObjectStoreConfiguration).
-Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/preview/backup_barmanobjectstore/)
+Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/current/appendixes/backup_barmanobjectstore/)
 for additional details.
 :::important
--- a/web/versioned_docs/version-0.7.0/usage.md
+++ b/web/versioned_docs/version-0.7.0/usage.md
@ -46,7 +46,7 @@ spec:
 The `.spec.configuration` schema follows the same format as the
 [in-tree barman-cloud support](https://pkg.go.dev/github.com/cloudnative-pg/barman-cloud/pkg/api#BarmanObjectStoreConfiguration).
-Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/preview/backup_barmanobjectstore/)
+Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/current/appendixes/backup_barmanobjectstore/)
 for additional details.
 :::important
--- a/web/versioned_docs/version-0.8.0/usage.md
+++ b/web/versioned_docs/version-0.8.0/usage.md
@ -46,7 +46,7 @@ spec:
 The `.spec.configuration` schema follows the same format as the
 [in-tree barman-cloud support](https://pkg.go.dev/github.com/cloudnative-pg/barman-cloud/pkg/api#BarmanObjectStoreConfiguration).
-Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/preview/backup_barmanobjectstore/)
+Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/current/appendixes/backup_barmanobjectstore/)
 for additional details.
 :::important
--- a/web/versioned_docs/version-0.9.0/usage.md
+++ b/web/versioned_docs/version-0.9.0/usage.md
@ -46,7 +46,7 @@ spec:
 The `.spec.configuration` schema follows the same format as the
 [in-tree barman-cloud support](https://pkg.go.dev/github.com/cloudnative-pg/barman-cloud/pkg/api#BarmanObjectStoreConfiguration).
-Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/preview/backup_barmanobjectstore/)
+Refer to [the CloudNativePG documentation](https://cloudnative-pg.io/documentation/current/appendixes/backup_barmanobjectstore/)
 for additional details.
 :::important
--- a/web/yarn.lock
+++ b/web/yarn.lock