PBM-1655 Release notes 2.12.0

docs/details/gcs.md

@@ -15,6 +15,10 @@ PBM supports communication with GCS via the JSON API and XML API. The preferred
 
     Until the issue is resolved, we recommend using a native GCS connection type with JSON keys rather than HMAC keys to ensure backup integrity.
 
+!!! warning "HMAC keys support deprecation"
+
+    Starting with version 2.12.0, HMAC keys support is deprecated. We encourage you to use JSON keys as native GCS connection type.
+
 To use GCS, you need the following:
 
 * [create a service account :octicons-link-external-16:](https://cloud.google.com/iam/docs/service-accounts-create#iam-service-accounts-create-console) 

docs/release-notes/2.12.0.md

@@ -0,0 +1,100 @@
+# Percona Backup for MongoDB 2.12.0 ({{date.2_12_0}})
+
+[Installation](../installation.md){.md-button}
+
+
+Percona Backup for MongoDB is a distributed, low-impact solution for creating consistent backups of MongoDB sharded clusters and replica sets, and for restoring those backups to a specific point in time.
+
+## Release Highlights
+
+This release focuses on improvements to backup storages. It includes new storage types, enhances Azure and GCS implementations and fixes issues with S3-compatible storage services. 
+
+Details below:
+
+### Support of Alibaba Cloud as the backup storage
+
+With **Percona Backup for MongoDB (PBM)** now supporting **Alibaba Cloud OSS** as a remote backup destination, you can seamlessly integrate your backup workflows into the Alibaba Cloud ecosystem. This means you can store any type of backups directly in OSS without extra tools or manual steps, taking full advantage of Alibaba's scalable infrastructure and strong regional performance. 
+
+You can authenticate directly using your OSS Access Key ID and Secret, or take advantage of full support for Alicloud's Security Token Service (STS) AssumeRole, which includes automatic security token refresh. The latter authentication flow is ideal for organizations that require temporary credentials for enhanced security. 
+
+This integration also resolves compatibility issues between the Alibaba’s RAM API  and the AWS SDK that PBM used previously for S3-compatible storage services, empowering teams already invested in Alibaba Cloud to adopt PBM better. Whether you're operating in Asia-Pacific or building cloud-native infrastructure, this gives you a secure, scalable, and compliant way to protect your data.
+
+### Ensure data upload to Azure blob storage even during unstable network
+
+You can now control the number of upload retries to Azure in PBM configuration. This enhancement ensures your data reaches its destination—even when the network is unstable or intermittent. By customizing retry behavior, you gain greater resilience and reliability in backup and sync workflows. It’s a simple way to reduce failed uploads and improve peace of mind.
+
+### Improved support for S3-compatible storage in PBM
+
+PBM now includes support for the **MinIo Go client library**, enhancing the experience for users of custom S3-compatible storage services.
+
+PBM keeps using the AWS SDK v2 with Signature Version 4 (SigV4) for authenticating to native Amazon S3 services. However, though SigV4 is more secure, it's not fully optimized for other S3-compatible services causing compatibility and connectivity issues. 
+
+To address these issues, we've added the MinIo Go client and introduced a new `minio` storage type in PBM configuration. 
+
+```yaml
+storage:
+  type: minio
+  minio:
+    endpoint: http://minio.example.com:9000
+    bucket: pbm-test-bucket
+    prefix: data/pbm/backup
+    credentials:
+      access-key-id: <your-access-key-id-here>
+      secret-access-key: <your-secret-key-here>
+```
+
+The MinIo client library ensures reliable connectivity and smooth backup and restore operations across a wide range of S3-compatible implementations.
+
+To keep using custom S3-compatible storage, consider re-configuring PBM to use the `minio` storage type after the upgrade. However, be aware of the current [known limitation](#known-limitation-for-using-the-minio-storage-type) for using the MinIO storage type.
+
+#### Known limitation for using the MinIO storage type
+
+While MinIo SDK supports concurrency, its implementation interferes with PBM's backup logic and affects PBM functionality.  Therefore, currently PBM uploads backups using a single thread which results in slower backup performance compared to S3. We're actively investigating safe ways to improve throughput without compromising reliability.
+
+### Deprecation of HMAC keys support for Google Cloud Storage
+
+Accessing Google Cloud Storage with HMAC keys relies on AWS Signature Version 2 (SigV2), an outdated authentication method that has been officially deprecated. It has been replaced by Signature Version 4 (SigV4), which does **not** support XML API communication using HMAC keys.
+
+Continuing to use SigV2 can lead to serious issues: Percona Backup for MongoDB may incorrectly mark incomplete backups as successful and upload corrupted data to storage. This puts your restore process at risk and undermines backup reliability.
+
+Using the outdated Signature Version 2 (SigV2) authentication for Google Cloud Storage is not recommended because it lacks important security enhancements, is no longer maintained, and can introduce critical reliability issues.
+
+To prevent this, support for HMAC keys is now deprecated. We strongly recommend migrating to a native GCS connection type [with JSON keys :octicons-link-external-16:](https://cloud.google.com/iam/docs/keys-create-delete#creating). Refer to the [documentation](../details/gcs.md#adjust-pbm-configuration-to-use-gcs) for guidance on adjusting PBM configuration to use JSON keys.
+
+If you need a temporary workaround during your migration, you can switch to the `minio` storage type and set the `storage.minio.signature-ver` option to `V2`. This workaround is intended for backward compatibility only and should not be used as a long-term solution.  
+
+We will end-of-life HMAC support and remove it in the PBM release after April 30, 2026.
+
+
+## Changelog
+
+### New features
+
+- [PBM-1588](https://perconadev.atlassian.net/browse/PBM-1588) - Percona Backup for MongoDB now supports Alibaba Cloud Object storage Service (OSS) as the remote backup storage (Thank you Imre Nagi for reporting and contributing to this feature).
+
+- [PBM-1631](https://perconadev.atlassian.net/browse/PBM-1631) - Use MinIO client for S3-compatible storage to improve compatibility.
+
+
+### Improvements
+
+- [PBM-1321](https://perconadev.atlassian.net/browse/PBM-1321) - Improved PBM logs for logical backups by providing clearer status messages during the backup process.
+
+- [PBM-1593](https://perconadev.atlassian.net/browse/PBM-1593) - Interrupted downloads from Azure Blob storage now automatically resume, preventing restore failures due to temporary network issues (Thank you Daniel Oliver for reporting and contributing to this issue).
+
+- [PBM-1628](https://perconadev.atlassian.net/browse/PBM-1628) - Backups to Google Cloud Storage (GCS) are now more resilient to temporary network interruptions.
+
+## Fixed bugs
+
+- [PBM-1093](https://perconadev.atlassian.net/browse/PBM-1093) - Added the ability to retry data upload to Azure Blob storage in case of connection issues, ensuring reliable backups.
+
+- [PBM-1594](https://perconadev.atlassian.net/browse/PBM-1594) -  Fixed the issue with backups failing to be uploaded due to data chunks exceeding the limit when HTTPS connection is used with MinIO. The issue is fixed by adding a MinIO client library (Thank you Rama Mekala for reporting this issue).
+
+- [PBM-1605](https://perconadev.atlassian.net/browse/PBM-1605) - Fixed the issue with PBM marking incomplete backups as successful without logging errors during network disruptions and when HMAC keys are used for accessing Google Cloud Storage. PBM now calculates Cyclic Redundancy Check (CRC) and compares it with GCS generated one, reporting the error in case of mismatch. 
+
+- [PBM-1607](https://perconadev.atlassian.net/browse/PBM-1607) - Fixed the issue with already uploaded files remaining on the storage if the backup failed by correctly reporting the actual error in logs
+
+- [PBM-1610](https://perconadev.atlassian.net/browse/PBM-1610) - Fixed the issue with data upload to a custom S3-compatible storage that was caused by a new upload algorithm introduced in AWS SDK v2 by adding a MinIO Go client library that resolves compatibility issues for custom S3-compatible storage services.
+
+- [PBM-1619](https://perconadev.atlassian.net/browse/PBM-1619) - Fixed the issue with PBM failing with segmentation fault (segfault) on invalid configuration by introducing basic checks and returning the meaningful error message on failed check. (Thank you Neha Oudin for reporting and contributing to this issue)
+
+- [PBM-1627](https://perconadev.atlassian.net/browse/PBM-1627) - GCS storage retry configurations now correctly interpret time units (e.g., '60s') and include a new `ChunkRetryDeadline` setting to manage upload timeouts.

mkdocs-base.yml

@@ -273,7 +273,8 @@ nav:
   - Release notes:
       - release-notes.md
       - PBM 2.x:
-        - "{{pbm.full_name}} 2.11.0 ({{date.2_11_0}})": release-notes/2.11.0.md
+        - "{{pbm.full_name}} 2.12.0 ({{date.2_12_0}})": release-notes/2.12.0.md
+        - release-notes/2.11.0.md
         - release-notes/2.10.0.md
         - release-notes/2.9.1.md
         - release-notes/2.9.0.md

variables.yml

@@ -1,13 +1,14 @@
 # PBM Variables set for HTML output
 # See also mkdocs.yml plugins.with-pdf.cover_subtitle and output_path
 
-release: '2.11.0'
-version: '2.11'
+release: '2.12.0'
+version: '2.12'
 year: '2025'
 
 pbm:
   full_name: 'Percona Backup for MongoDB'
 date:
+  2_12_0: 2025-11-04
   2_11_0: 2025-09-25
   2_10_0: 2025-06-26
   2_9_1: 2025-03-27