feat(s3): support SSE-C customer-provided keys

.wordlist.txt

@@ -1,3 +1,4 @@
+AES
 AKS
 AccessDenied
 AdditionalContainerArgs
@@ -21,11 +22,13 @@ EnvVar
 GCP
 GKE
 Gi
+Hetzner
 IAM
 IRSA
 IfNotPresent
 InstanceSidecarConfiguration
 JSON
+KMS
 Kustomize
 Lifecycle
 Linode
@@ -95,6 +98,7 @@ creds
 csi
 customresourcedefinition
 declaratively
+decrypt
 deps
 desc
 devel
@@ -131,6 +135,7 @@ namespaces
 nonResourceURLs
 objectstore
 objectstores
+openssl
 pluginConfiguration
 podName
 postgres
@@ -155,6 +160,7 @@ serverName
 serviceaccount
 sha
 sig
+sse
 storageClass
 subcommand
 tfddg

api/v1/objectstore_types.go

@@ -59,6 +59,8 @@ type InstanceSidecarConfiguration struct {
 type ObjectStoreSpec struct {
 	// The configuration for the barman-cloud tool suite
 	// +kubebuilder:validation:XValidation:rule="!has(self.serverName)",fieldPath=".serverName",reason="FieldValueForbidden",message="use the 'serverName' plugin parameter in the Cluster resource"
+	// +kubebuilder:validation:XValidation:rule="!has(self.s3Credentials) || !has(self.s3Credentials.sseCustomerKey) || !has(self.data) || !has(self.data.encryption)",fieldPath=".data.encryption",reason="FieldValueForbidden",message="cannot be used together with s3Credentials.sseCustomerKey"
+	// +kubebuilder:validation:XValidation:rule="!has(self.s3Credentials) || !has(self.s3Credentials.sseCustomerKey) || !has(self.wal) || !has(self.wal.encryption)",fieldPath=".wal.encryption",reason="FieldValueForbidden",message="cannot be used together with s3Credentials.sseCustomerKey"
 	Configuration barmanapi.BarmanObjectStoreConfiguration `json:"configuration"`
 
 	// RetentionPolicy is the retention policy to be used for backups

config/crd/bases/barmancloud.cnpg.io_objectstores.yaml

@@ -443,6 +443,16 @@ spec:
                   message: use the 'serverName' plugin parameter in the Cluster resource
                   reason: FieldValueForbidden
                   rule: '!has(self.serverName)'
+                - fieldPath: .data.encryption
+                  message: cannot be used together with s3Credentials.sseCustomerKey
+                  reason: FieldValueForbidden
+                  rule: '!has(self.s3Credentials) || !has(self.s3Credentials.sseCustomerKey)
+                    || !has(self.data) || !has(self.data.encryption)'
+                - fieldPath: .wal.encryption
+                  message: cannot be used together with s3Credentials.sseCustomerKey
+                  reason: FieldValueForbidden
+                  rule: '!has(self.s3Credentials) || !has(self.s3Credentials.sseCustomerKey)
+                    || !has(self.wal) || !has(self.wal.encryption)'
                 - fieldPath: .s3AddressingStyle
                   message: s3AddressingStyle requires s3Credentials
                   reason: FieldValueForbidden

internal/cnpgi/operator/specs/role.go

@@ -55,7 +55,7 @@ func BuildRoleRules(barmanObjects []barmancloudv1.ObjectStore) []rbacv1.PolicyRu
 
 	for _, barmanObject := range barmanObjects {
 		barmanObjectsSet.Put(barmanObject.Name)
-		for _, secret := range CollectSecretNamesFromCredentials(&barmanObject.Spec.Configuration.BarmanCredentials) {
+		for _, secret := range barmanObject.Spec.Configuration.SecretNames() {
 			secretsSet.Put(secret)
 		}
 	}

internal/cnpgi/operator/specs/role_test.go

@@ -87,6 +87,16 @@ var _ = Describe("BuildRoleRules", func() {
 		Expect(rules[2].ResourceNames).To(BeEmpty())
 	})
 
+	It("should grant access to the SSE-C customer key secret", func() {
+		store := newTestObjectStore("store-a", "secret-a")
+		store.Spec.Configuration.AWS.SSECustomerKey = &machineryapi.SecretKeySelector{
+			LocalObjectReference: machineryapi.LocalObjectReference{Name: "sse-c-key"},
+			Key:                  "key",
+		}
+		rules := BuildRoleRules([]barmancloudv1.ObjectStore{store})
+		Expect(rules[2].ResourceNames).To(ConsistOf("secret-a", "sse-c-key"))
+	})
+
 	It("should deduplicate secret names across ObjectStores", func() {
 		objects := []barmancloudv1.ObjectStore{
 			newTestObjectStore("store-a", "shared-secret"),