cloudnative-pg · schaurian · Jul 19, 2026
@@ -315,6 +315,30 @@ spec:
                         - key
                         - name
                         type: object
+                      sseCustomerKey:
+                        description: |-
+                          The reference to the secret containing the key for
+                          Server-Side Encryption with Customer-provided keys (SSE-C).
+                          When set, every object barman-cloud uploads to and downloads from
+                          S3 is encrypted with this key using the AWS SSE-C protocol
+                          (the `--sse-customer-key` barman-cloud option).
+                          The referenced value must be a base64-encoded 256-bit (32-byte)
+                          AES key. This is orthogonal to the bucket-managed `encryption`
+                          field (SSE-S3/SSE-KMS) and is meant for S3-compatible providers
+                          that only support customer-provided keys (e.g. Hetzner Object
+                          Storage). It can be combined with any authentication method,
+                          including inheritFromIAMRole.
+                        properties:
+                          key:
+                            description: The key to select
+                            type: string
+                          name:
+                            description: Name of the referent.
+                            type: string
+                        required:
+                        - key
+                        - name
+                        type: object
                     type: object
                   serverName:
                     description: |-

@@ -137,3 +137,5 @@ require (
 	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
+
+replace github.com/cloudnative-pg/barman-cloud => github.com/schaurian/barman-cloud v0.5.2-0.20260719023441-76e12b2044aa
@@ -20,8 +20,6 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cloudnative-pg/api v1.30.0 h1:L8hnvV/tPEQA1xYEi41FUBFA7FUNVGju8+SlgFlDDjI=
 github.com/cloudnative-pg/api v1.30.0/go.mod h1:XrKBbOWObL33si0FNuwX4uHNf5JShiZyOUqd6LxbJQo=
-github.com/cloudnative-pg/barman-cloud v0.5.2-0.20260709152604-43158c204df1 h1:+AV67yFPqnwmHQ5PIYkAaJUDsOrrwJCvH+J1JzHXyQc=
-github.com/cloudnative-pg/barman-cloud v0.5.2-0.20260709152604-43158c204df1/go.mod h1:ZQLkdpk44FW5/BGWzABTOEcV9qPbwC+rbdscg2I8mBI=
 github.com/cloudnative-pg/cloudnative-pg v1.30.0 h1:fnhVq44xXx97MNiuvJsPrX1vSjYbgdyBK5MSGfdHdp0=
 github.com/cloudnative-pg/cloudnative-pg v1.30.0/go.mod h1:QkolwBOWZ+GvAiJt6KpDSymwkpf0K19/p4Q6MQlTM8U=
 github.com/cloudnative-pg/cnpg-i v0.5.0 h1:/TOzpNT6cwNgrpftTtrnLKdoHgMwd+88vZgXjlVgXeE=
@@ -187,6 +185,8 @@ github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
 github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
+github.com/schaurian/barman-cloud v0.5.2-0.20260719023441-76e12b2044aa h1:baHZBPn5DCOI1+/2GC7/iPJltwYHwJ1fAchAeQA8eDI=
+github.com/schaurian/barman-cloud v0.5.2-0.20260719023441-76e12b2044aa/go.mod h1:ZQLkdpk44FW5/BGWzABTOEcV9qPbwC+rbdscg2I8mBI=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/snorwin/jsonpatch v1.5.0 h1:0m56YSt9cHiJOn8U+OcqdPGcDQZmhPM/zsG7Dv5QQP0=

@@ -314,6 +314,30 @@ spec:
                         - key
                         - name
                         type: object
+                      sseCustomerKey:
+                        description: |-
+                          The reference to the secret containing the key for
+                          Server-Side Encryption with Customer-provided keys (SSE-C).
+                          When set, every object barman-cloud uploads to and downloads from
+                          S3 is encrypted with this key using the AWS SSE-C protocol
+                          (the `--sse-customer-key` barman-cloud option).
+                          The referenced value must be a base64-encoded 256-bit (32-byte)
+                          AES key. This is orthogonal to the bucket-managed `encryption`
+                          field (SSE-S3/SSE-KMS) and is meant for S3-compatible providers
+                          that only support customer-provided keys (e.g. Hetzner Object
+                          Storage). It can be combined with any authentication method,
+                          including inheritFromIAMRole.
+                        properties:
+                          key:
+                            description: The key to select
+                            type: string
+                          name:
+                            description: Name of the referent.
+                            type: string
+                        required:
+                        - key
+                        - name
+                        type: object
                     type: object
                   serverName:
                     description: |-

@@ -194,6 +194,70 @@ spec:
   [...]
 ```
 
+### Server-Side Encryption with Customer Keys (SSE-C)
+
+Some S3-compatible providers — most notably **Hetzner Object Storage** — do
+not offer bucket-managed server-side encryption (SSE-S3 / SSE-KMS) and instead
+only support **Server-Side Encryption with Customer-provided keys (SSE-C)**.
+With SSE-C the encryption key never leaves your control: it is supplied with
+every request, and the provider uses it to encrypt and decrypt objects without
+storing it.
+
+To enable SSE-C, set the `sseCustomerKey` field in the `s3Credentials` block to
+a secret reference holding a **base64-encoded 256-bit (32-byte) AES key**.
+
+Generate the key and store it in a Kubernetes secret:
+
+```sh
+# Generate a random 256-bit key, base64-encoded
+openssl rand 32 | base64 > sse-c.key
+
+kubectl create secret generic aws-sse-c \
+  --from-file=key=sse-c.key
+```
+
+:::warning
+Keep this key safe and backed up **outside** the object store. If you lose
+it, your backups and WAL files become permanently unrecoverable — the
+provider cannot decrypt them for you.
+:::
+
+Reference it in your `ObjectStore` definition:
+
+```yaml
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: hetzner-store
+spec:
+  configuration:
+    destinationPath: "s3://BUCKET_NAME/path/to/folder"
+    endpointURL: "https://fsn1.your-objectstorage.com"
+    s3Credentials:
+      accessKeyId:
+        name: aws-creds
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: aws-creds
+        key: ACCESS_SECRET_KEY
+      sseCustomerKey:
+        name: aws-sse-c
+        key: key
+  [...]
+```
+
+The same key is applied to **every** operation — base backups, WAL archiving,
+WAL restore, and data restore — so it must remain unchanged and available for
+the whole lifetime of the backups it protects. `sseCustomerKey` is independent
+of the bucket-managed `encryption` field (SSE-S3 / SSE-KMS) and can be combined
+with any authentication method, including `inheritFromIAMRole`.
+
+:::note
+SSE-C support requires a sidecar image whose `barman-cloud` build includes
+the `--sse-customer-key` option
+(see [barman#973](https://github.com/EnterpriseDB/barman/issues/973)).
+:::
+
 ### Using Object Storage with a Private CA
 
 For object storage services (e.g., MinIO) that use HTTPS with certificates