search

fi-ts / postgreslet

A small controller which act as bridge between zalando-postgres-operator
GNU Affero General Public License v3.0
6 stars 0 forks source link

Support for encrypted backups #356

Open eberlep opened 2 years ago

eberlep commented 2 years ago

One option to consider: Setting the wal-g environment variables in the spilo image (via the pod_environment_configmap)

https://github.com/zalando/spilo/blob/master/ENVIRONMENT.rst#wal-g

That would make use of all the features already implemented by wal-g

Another option: encrypt the S3 bucket used for the backups (WALG_S3_SSE?).

Always required: bring your own key.

eberlep commented 2 years ago

Server side encryption is already implemented via the backup config / WALG_S3_SSE.

Cloning/restoring should set WALG_S3_SSE as well, which is currently not the case(?). When restoring an old backup which was created before we enabled SSE, it should be possible to disable the server side encryption (which would otherwise try to decrypt a non-encrypted wal-g backup?).

When creating a backup-config, it should automatically be created with a random SSE key.