cloudnative-pg / cloudnative-pg/plugin-barman-cloud
[Feature request] Support for S3 SSE-C - Server-Side Encryption with Customer-provided keys
- Lenguaje dominante
- Go
- Estrellas
- 191
- Forks
- 72
- Merge medio
- 2 d 21 h
- PR fusionados (30 d)
- 21
Descripción
I'm using k3s on Hetzner Cloud (https://docs.hetzner.com/storage/object-storage/faq/general#what-configuration-and-security-features-are-currently-supported) and running a PostgreSQL cluster with cnpg. I tried to configure barman-cloud for automatic backups to Hetzner S3 storage, but it seems that this is only possible without encryption.
Currently, Hetzner S3 only supports SSE-C (which means you have to provide an encryption key). I don't really understand what the option `encryption: AES256` means in context of S3 encryption, but I assume for SSE-C there are more options required - at least for providing a secret containing the SSE-C key.
Any chance to get SSE-C support in barman-cloud? I've spend much time in securing my k8s setup (node encryption, pv encryption etc.) and storing plaintext backups in external storage makes this whole effort pointless 😞
BTW: if I just enable `encryption: ASE265`, barman-cloud fails with this log line:
````
{"level":"info","ts":"2025-11-06T19:57:05.717632266Z","logger":"barman-cloud-wal-archive","msg":"2025-11-06 19:57:05,717 [947] ERROR: Barman cloud WAL archiver exception: An error occurred (InvalidArgument) when calling the PutObject operation: None","pipe":"stderr","logging_pod":"my-pg-cluster-1"}
````
Guía de contribución
Línea de trabajo
Comienza en el punto de entrada de barman-cloud WAL archiver y sigue el tratamiento existente de `encryption: AES256` hasta la llamada S3 `PutObject` mostrada en el informe. Revisa cómo se proporcionan los secretos de configuración y, después, identifica las pruebas de carga relevantes o añade cobertura para las entradas SSE-C solicitadas. Se considera terminado cuando las cargas SSE-C funcionan para el almacenamiento compatible con S3 indicado en el informe sin el error `InvalidArgument`.
Escrito por el modelo de indexación a partir del texto del issue.
Evaluación
- Stack tecnológico
- go, postgresql
- Área
- cloud, databases
- Tipo de issue
- Nueva funcionalidad
- Dificultad
- 4/5
- Tiempo estimado
- 3-5 días
- Estado de actividad
- Tranquilo
- Claridad
- Bastante claro
- Aptitud para principiantes
- 45/100