diff --git a/config/crd/bases/barmancloud.cnpg.io_objectstores.yaml b/config/crd/bases/barmancloud.cnpg.io_objectstores.yaml index c5cf9711..919cb730 100644 --- a/config/crd/bases/barmancloud.cnpg.io_objectstores.yaml +++ b/config/crd/bases/barmancloud.cnpg.io_objectstores.yaml @@ -315,6 +315,30 @@ spec: - key - name type: object + sseCustomerKey: + description: |- + The reference to the secret containing the key for + Server-Side Encryption with Customer-provided keys (SSE-C). + When set, every object barman-cloud uploads to and downloads from + S3 is encrypted with this key using the AWS SSE-C protocol + (the `--sse-customer-key` barman-cloud option). + The referenced value must be a base64-encoded 256-bit (32-byte) + AES key. This is orthogonal to the bucket-managed `encryption` + field (SSE-S3/SSE-KMS) and is meant for S3-compatible providers + that only support customer-provided keys (e.g. Hetzner Object + Storage). It can be combined with any authentication method, + including inheritFromIAMRole. + properties: + key: + description: The key to select + type: string + name: + description: Name of the referent. + type: string + required: + - key + - name + type: object type: object serverName: description: |- diff --git a/go.mod b/go.mod index 5a95b0eb..a0796a0a 100644 --- a/go.mod +++ b/go.mod @@ -137,3 +137,5 @@ require ( sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect sigs.k8s.io/yaml v1.6.0 // indirect ) + +replace github.com/cloudnative-pg/barman-cloud => github.com/schaurian/barman-cloud v0.5.2-0.20260719023441-76e12b2044aa diff --git a/go.sum b/go.sum index ada804db..77df3d52 100644 --- a/go.sum +++ b/go.sum @@ -20,8 +20,6 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cloudnative-pg/api v1.30.0 h1:L8hnvV/tPEQA1xYEi41FUBFA7FUNVGju8+SlgFlDDjI= github.com/cloudnative-pg/api v1.30.0/go.mod h1:XrKBbOWObL33si0FNuwX4uHNf5JShiZyOUqd6LxbJQo= -github.com/cloudnative-pg/barman-cloud v0.5.2-0.20260709152604-43158c204df1 h1:+AV67yFPqnwmHQ5PIYkAaJUDsOrrwJCvH+J1JzHXyQc= -github.com/cloudnative-pg/barman-cloud v0.5.2-0.20260709152604-43158c204df1/go.mod h1:ZQLkdpk44FW5/BGWzABTOEcV9qPbwC+rbdscg2I8mBI= github.com/cloudnative-pg/cloudnative-pg v1.30.0 h1:fnhVq44xXx97MNiuvJsPrX1vSjYbgdyBK5MSGfdHdp0= github.com/cloudnative-pg/cloudnative-pg v1.30.0/go.mod h1:QkolwBOWZ+GvAiJt6KpDSymwkpf0K19/p4Q6MQlTM8U= github.com/cloudnative-pg/cnpg-i v0.5.0 h1:/TOzpNT6cwNgrpftTtrnLKdoHgMwd+88vZgXjlVgXeE= @@ -187,6 +185,8 @@ github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc= github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik= +github.com/schaurian/barman-cloud v0.5.2-0.20260719023441-76e12b2044aa h1:baHZBPn5DCOI1+/2GC7/iPJltwYHwJ1fAchAeQA8eDI= +github.com/schaurian/barman-cloud v0.5.2-0.20260719023441-76e12b2044aa/go.mod h1:ZQLkdpk44FW5/BGWzABTOEcV9qPbwC+rbdscg2I8mBI= github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw= github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4= github.com/snorwin/jsonpatch v1.5.0 h1:0m56YSt9cHiJOn8U+OcqdPGcDQZmhPM/zsG7Dv5QQP0= diff --git a/manifest.yaml b/manifest.yaml index 85115eaa..22c7f28c 100644 --- a/manifest.yaml +++ b/manifest.yaml @@ -314,6 +314,30 @@ spec: - key - name type: object + sseCustomerKey: + description: |- + The reference to the secret containing the key for + Server-Side Encryption with Customer-provided keys (SSE-C). + When set, every object barman-cloud uploads to and downloads from + S3 is encrypted with this key using the AWS SSE-C protocol + (the `--sse-customer-key` barman-cloud option). + The referenced value must be a base64-encoded 256-bit (32-byte) + AES key. This is orthogonal to the bucket-managed `encryption` + field (SSE-S3/SSE-KMS) and is meant for S3-compatible providers + that only support customer-provided keys (e.g. Hetzner Object + Storage). It can be combined with any authentication method, + including inheritFromIAMRole. + properties: + key: + description: The key to select + type: string + name: + description: Name of the referent. + type: string + required: + - key + - name + type: object type: object serverName: description: |- diff --git a/web/docs/object_stores.md b/web/docs/object_stores.md index 11b1ff8c..5946609c 100644 --- a/web/docs/object_stores.md +++ b/web/docs/object_stores.md @@ -194,6 +194,70 @@ spec: [...] ``` +### Server-Side Encryption with Customer Keys (SSE-C) + +Some S3-compatible providers — most notably **Hetzner Object Storage** — do +not offer bucket-managed server-side encryption (SSE-S3 / SSE-KMS) and instead +only support **Server-Side Encryption with Customer-provided keys (SSE-C)**. +With SSE-C the encryption key never leaves your control: it is supplied with +every request, and the provider uses it to encrypt and decrypt objects without +storing it. + +To enable SSE-C, set the `sseCustomerKey` field in the `s3Credentials` block to +a secret reference holding a **base64-encoded 256-bit (32-byte) AES key**. + +Generate the key and store it in a Kubernetes secret: + +```sh +# Generate a random 256-bit key, base64-encoded +openssl rand 32 | base64 > sse-c.key + +kubectl create secret generic aws-sse-c \ + --from-file=key=sse-c.key +``` + +:::warning +Keep this key safe and backed up **outside** the object store. If you lose +it, your backups and WAL files become permanently unrecoverable — the +provider cannot decrypt them for you. +::: + +Reference it in your `ObjectStore` definition: + +```yaml +apiVersion: barmancloud.cnpg.io/v1 +kind: ObjectStore +metadata: + name: hetzner-store +spec: + configuration: + destinationPath: "s3://BUCKET_NAME/path/to/folder" + endpointURL: "https://fsn1.your-objectstorage.com" + s3Credentials: + accessKeyId: + name: aws-creds + key: ACCESS_KEY_ID + secretAccessKey: + name: aws-creds + key: ACCESS_SECRET_KEY + sseCustomerKey: + name: aws-sse-c + key: key + [...] +``` + +The same key is applied to **every** operation — base backups, WAL archiving, +WAL restore, and data restore — so it must remain unchanged and available for +the whole lifetime of the backups it protects. `sseCustomerKey` is independent +of the bucket-managed `encryption` field (SSE-S3 / SSE-KMS) and can be combined +with any authentication method, including `inheritFromIAMRole`. + +:::note +SSE-C support requires a sidecar image whose `barman-cloud` build includes +the `--sse-customer-key` option +(see [barman#973](https://github.com/EnterpriseDB/barman/issues/973)). +::: + ### Using Object Storage with a Private CA For object storage services (e.g., MinIO) that use HTTPS with certificates