docs: import CloudNativePG main

Author: cnpg-bot

website/docs/bootstrap.md

@@ -782,4 +782,4 @@ a replica cluster.
     and the applications. In particular, it is fundamental that you run the migration
     procedure as many times as needed to systematically measure the downtime of your
     applications in production.
-:::
+:::

website/docs/cloudnative-pg.v1.md

@@ -19,6 +19,8 @@ Package v1 contains API Schema definitions for the postgresql v1 API group
 - [Cluster](#cluster)
 - [ClusterImageCatalog](#clusterimagecatalog)
 - [Database](#database)
+- [DatabaseRole](#databaserole)
+- [DatabaseRoleList](#databaserolelist)
 - [FailoverQuorum](#failoverquorum)
 - [ImageCatalog](#imagecatalog)
 - [Pooler](#pooler)
@@ -848,6 +850,65 @@ _Appears in:_
 | `retain` | DatabaseReclaimRetain means the database will be left in its current phase for manual<br />reclamation by the administrator. The default policy is Retain.<br /> |
 
 
+#### DatabaseRole
+
+
+
+DatabaseRole is the Schema for the databaseroles API
+
+
+
+_Appears in:_
+
+- [DatabaseRoleList](#databaserolelist)
+
+| Field | Description | Required | Default | Validation |
+| --- | --- | --- | --- | --- |
+| `apiVersion` _string_ | `postgresql.cnpg.io/v1` | True | | |
+| `kind` _string_ | `DatabaseRole` | True | | |
+| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | True |  |  |
+| `spec` _[DatabaseRoleSpec](#databaserolespec)_ | Specification of the desired DatabaseRole.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status | True |  |  |
+| `status` _[DatabaseRoleStatus](#databaserolestatus)_ | Most recently observed status of the DatabaseRole. This data may not be up<br />to date. Populated by the system. Read-only.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status |  |  |  |
+
+
+
+
+#### DatabaseRoleList
+
+
+
+DatabaseRoleList contains a list of DatabaseRoles
+
+
+
+
+
+| Field | Description | Required | Default | Validation |
+| --- | --- | --- | --- | --- |
+| `apiVersion` _string_ | `postgresql.cnpg.io/v1` | True | | |
+| `kind` _string_ | `DatabaseRoleList` | True | | |
+| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | True |  |  |
+| `items` _[DatabaseRole](#databaserole) array_ |  | True |  |  |
+
+
+#### DatabaseRoleReclaimPolicy
+
+_Underlying type:_ _string_
+
+DatabaseRoleReclaimPolicy describes a policy for end-of-life maintenance of Roles.
+
+
+
+_Appears in:_
+
+- [DatabaseRoleSpec](#databaserolespec)
+
+| Field | Description |
+| --- | --- |
+| `delete` | DatabaseRoleReclaimDelete means the Role will be deleted from Kubernetes on release<br />from its claim.<br /> |
+| `retain` | DatabaseRoleReclaimRetain means the Role will be left in its current phase for manual<br />reclamation by the administrator. The default policy is Retain.<br /> |
+
+
 #### DatabaseRoleRef
 
 
@@ -865,6 +926,60 @@ _Appears in:_
 | `name` _string_ |  |  |  |  |
 
 
+#### DatabaseRoleSpec
+
+
+
+DatabaseRoleSpec represents a role in Postgres
+
+
+
+_Appears in:_
+
+- [DatabaseRole](#databaserole)
+
+| Field | Description | Required | Default | Validation |
+| --- | --- | --- | --- | --- |
+| `name` _string_ | Name of the role | True |  |  |
+| `comment` _string_ | Description of the role |  |  |  |
+| `ensure` _[EnsureOption](#ensureoption)_ | Ensure the role is `present` or `absent` - defaults to "present" |  | present | Enum: [present absent] <br /> |
+| `passwordSecret` _[LocalObjectReference](https://pkg.go.dev/github.com/cloudnative-pg/machinery/pkg/api#LocalObjectReference)_ | Secret containing the password of the role (if present).<br />If null, the password will be ignored unless DisablePassword is set.<br />When set, the secret must follow the `kubernetes.io/basic-auth` format<br />and contain both a `username` and a `password` field. |  |  |  |
+| `connectionLimit` _integer_ | If the role can log in, this specifies how many concurrent<br />connections the role can make. `-1` (the default) means no limit. |  | -1 |  |
+| `validUntil` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#time-v1-meta)_ | Date and time after which the role's password is no longer valid.<br />When omitted, the password will never expire (default). |  |  |  |
+| `inRoles` _string array_ | List of one or more existing roles to which this role will be<br />immediately added as a new member. Default empty.<br />Changes to the list are applied to an existing role through<br />`GRANT` and `REVOKE` statements, not only at role creation. |  |  |  |
+| `inherit` _boolean_ | Whether a role "inherits" the privileges of roles it is a member of.<br />Default is `true`. |  | true |  |
+| `disablePassword` _boolean_ | DisablePassword indicates that a role's password should be set to NULL in Postgres |  |  |  |
+| `superuser` _boolean_ | Whether the role is a `superuser` who can override all access<br />restrictions within the database - superuser status is dangerous and<br />should be used only when really needed. You must yourself be a<br />superuser to create a new superuser. Defaults is `false`. |  |  |  |
+| `createdb` _boolean_ | When set to `true`, the role being defined will be allowed to create<br />new databases. Specifying `false` (default) will deny a role the<br />ability to create databases. |  |  |  |
+| `createrole` _boolean_ | Whether the role will be permitted to create, alter, drop, comment<br />on, change the security label for, and grant or revoke membership in<br />other roles. Default is `false`. |  |  |  |
+| `login` _boolean_ | Whether the role is allowed to log in. A role having the `login`<br />attribute can be thought of as a user. Roles without this attribute<br />are useful for managing database privileges, but are not users in<br />the usual sense of the word. Default is `false`. |  |  |  |
+| `replication` _boolean_ | Whether a role is a replication role. A role must have this<br />attribute (or be a superuser) in order to be able to connect to the<br />server in replication mode (physical or logical replication) and in<br />order to be able to create or drop replication slots. A role having<br />the `replication` attribute is a very highly privileged role, and<br />should only be used on roles actually used for replication. Default<br />is `false`. |  |  |  |
+| `bypassrls` _boolean_ | Whether a role bypasses every row-level security (RLS) policy.<br />Default is `false`. |  |  |  |
+| `cluster` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#localobjectreference-v1-core)_ | The corresponding cluster | True |  |  |
+| `databaseRoleReclaimPolicy` _[DatabaseRoleReclaimPolicy](#databaserolereclaimpolicy)_ | The policy for end-of-life maintenance of this role |  | retain | Enum: [delete retain] <br /> |
+
+
+#### DatabaseRoleStatus
+
+
+
+DatabaseRoleStatus defines the observed state of a DatabaseRole
+
+
+
+_Appears in:_
+
+- [DatabaseRole](#databaserole)
+
+| Field | Description | Required | Default | Validation |
+| --- | --- | --- | --- | --- |
+| `observedGeneration` _integer_ | A sequence number representing the latest<br />desired state that was synchronized |  |  |  |
+| `applied` _boolean_ | Applied is true if the role was reconciled correctly |  |  |  |
+| `message` _string_ | Message is the reconciliation error message |  |  |  |
+| `secretResourceVersion` _string_ | SecretResourceVersion is the resource version of the password secret<br />last applied to the role; a change to it triggers reconciliation. |  |  |  |
+| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#condition-v1-meta) array_ | Conditions for the DatabaseRole object |  |  |  |
+
+
 #### DatabaseSpec
 
 
@@ -959,6 +1074,7 @@ a Role in a PostgreSQL instance
 _Appears in:_
 
 - [DatabaseObjectSpec](#databaseobjectspec)
+- [DatabaseRoleSpec](#databaserolespec)
 - [DatabaseSpec](#databasespec)
 - [ExtensionSpec](#extensionspec)
 - [FDWSpec](#fdwspec)
@@ -2478,6 +2594,7 @@ Reference: https://www.postgresql.org/docs/current/sql-createrole.html
 
 _Appears in:_
 
+- [DatabaseRoleSpec](#databaserolespec)
 - [ManagedConfiguration](#managedconfiguration)
 
 | Field | Description | Required | Default | Validation |
@@ -2488,8 +2605,8 @@ _Appears in:_
 | `passwordSecret` _[LocalObjectReference](https://pkg.go.dev/github.com/cloudnative-pg/machinery/pkg/api#LocalObjectReference)_ | Secret containing the password of the role (if present).<br />If null, the password will be ignored unless DisablePassword is set.<br />When set, the secret must follow the `kubernetes.io/basic-auth` format<br />and contain both a `username` and a `password` field. |  |  |  |
 | `connectionLimit` _integer_ | If the role can log in, this specifies how many concurrent<br />connections the role can make. `-1` (the default) means no limit. |  | -1 |  |
 | `validUntil` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#time-v1-meta)_ | Date and time after which the role's password is no longer valid.<br />When omitted, the password will never expire (default). |  |  |  |
-| `inRoles` _string array_ | List of one or more existing roles to which this role will be<br />immediately added as a new member. Default empty. |  |  |  |
-| `inherit` _boolean_ | Whether a role "inherits" the privileges of roles it is a member of.<br />Defaults is `true`. |  | true |  |
+| `inRoles` _string array_ | List of one or more existing roles to which this role will be<br />immediately added as a new member. Default empty.<br />Changes to the list are applied to an existing role through<br />`GRANT` and `REVOKE` statements, not only at role creation. |  |  |  |
+| `inherit` _boolean_ | Whether a role "inherits" the privileges of roles it is a member of.<br />Default is `true`. |  | true |  |
 | `disablePassword` _boolean_ | DisablePassword indicates that a role's password should be set to NULL in Postgres |  |  |  |
 | `superuser` _boolean_ | Whether the role is a `superuser` who can override all access<br />restrictions within the database - superuser status is dangerous and<br />should be used only when really needed. You must yourself be a<br />superuser to create a new superuser. Defaults is `false`. |  |  |  |
 | `createdb` _boolean_ | When set to `true`, the role being defined will be allowed to create<br />new databases. Specifying `false` (default) will deny a role the<br />ability to create databases. |  |  |  |