Skip to content

Commit 6cf1ad9

Browse files
egegunestplavcic
egegunes
authored and
tplavcic
committed
K8SPSMDB-850: Fix S3 Server Side Encryption fields (#1352)
1 parent bf273b2 commit 6cf1ad9

File tree

13 files changed

+73
-97
lines changed

13 files changed

+73
-97
lines changed

‎config/crd/bases/psmdb.percona.com_perconaservermongodbbackups.yaml

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -131,11 +131,6 @@ spec:
131131
type: string
132132
sseCustomerKey:
133133
type: string
134-
required:
135-
- kmsKeyID
136-
- sseAlgorithm
137-
- sseCustomerAlgorithm
138-
- sseCustomerKey
139134
type: object
140135
storageClass:
141136
type: string

‎config/crd/bases/psmdb.percona.com_perconaservermongodbrestores.yaml

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -101,11 +101,6 @@ spec:
101101
type: string
102102
sseCustomerKey:
103103
type: string
104-
required:
105-
- kmsKeyID
106-
- sseAlgorithm
107-
- sseCustomerAlgorithm
108-
- sseCustomerKey
109104
type: object
110105
storageClass:
111106
type: string

‎config/crd/bases/psmdb.percona.com_perconaservermongodbs.yaml

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -268,11 +268,6 @@ spec:
268268
type: string
269269
sseCustomerKey:
270270
type: string
271-
required:
272-
- kmsKeyID
273-
- sseAlgorithm
274-
- sseCustomerAlgorithm
275-
- sseCustomerKey
276271
type: object
277272
storageClass:
278273
type: string

‎deploy/bundle.yaml

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -130,11 +130,6 @@ spec:
130130
type: string
131131
sseCustomerKey:
132132
type: string
133-
required:
134-
- kmsKeyID
135-
- sseAlgorithm
136-
- sseCustomerAlgorithm
137-
- sseCustomerKey
138133
type: object
139134
storageClass:
140135
type: string
@@ -261,11 +256,6 @@ spec:
261256
type: string
262257
sseCustomerKey:
263258
type: string
264-
required:
265-
- kmsKeyID
266-
- sseAlgorithm
267-
- sseCustomerAlgorithm
268-
- sseCustomerKey
269259
type: object
270260
storageClass:
271261
type: string
@@ -909,11 +899,6 @@ spec:
909899
type: string
910900
sseCustomerKey:
911901
type: string
912-
required:
913-
- kmsKeyID
914-
- sseAlgorithm
915-
- sseCustomerAlgorithm
916-
- sseCustomerKey
917902
type: object
918903
storageClass:
919904
type: string

‎deploy/cr.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -519,7 +519,7 @@ spec:
519519
# credentialsSecret: my-cluster-name-backup-s3
520520
# serverSideEncryption:
521521
# kmsKeyID: 1234abcd-12ab-34cd-56ef-1234567890ab
522-
# sseAlgorithm: AES256
522+
# sseAlgorithm: aws:kms
523523
# sseCustomerAlgorithm: AES256
524524
# sseCustomerKey: Y3VzdG9tZXIta2V5
525525
# region: us-west-2

‎deploy/crd.yaml

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -130,11 +130,6 @@ spec:
130130
type: string
131131
sseCustomerKey:
132132
type: string
133-
required:
134-
- kmsKeyID
135-
- sseAlgorithm
136-
- sseCustomerAlgorithm
137-
- sseCustomerKey
138133
type: object
139134
storageClass:
140135
type: string
@@ -261,11 +256,6 @@ spec:
261256
type: string
262257
sseCustomerKey:
263258
type: string
264-
required:
265-
- kmsKeyID
266-
- sseAlgorithm
267-
- sseCustomerAlgorithm
268-
- sseCustomerKey
269259
type: object
270260
storageClass:
271261
type: string
@@ -909,11 +899,6 @@ spec:
909899
type: string
910900
sseCustomerKey:
911901
type: string
912-
required:
913-
- kmsKeyID
914-
- sseAlgorithm
915-
- sseCustomerAlgorithm
916-
- sseCustomerKey
917902
type: object
918903
storageClass:
919904
type: string

‎deploy/cw-bundle.yaml

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -130,11 +130,6 @@ spec:
130130
type: string
131131
sseCustomerKey:
132132
type: string
133-
required:
134-
- kmsKeyID
135-
- sseAlgorithm
136-
- sseCustomerAlgorithm
137-
- sseCustomerKey
138133
type: object
139134
storageClass:
140135
type: string
@@ -261,11 +256,6 @@ spec:
261256
type: string
262257
sseCustomerKey:
263258
type: string
264-
required:
265-
- kmsKeyID
266-
- sseAlgorithm
267-
- sseCustomerAlgorithm
268-
- sseCustomerKey
269259
type: object
270260
storageClass:
271261
type: string
@@ -909,11 +899,6 @@ spec:
909899
type: string
910900
sseCustomerKey:
911901
type: string
912-
required:
913-
- kmsKeyID
914-
- sseAlgorithm
915-
- sseCustomerAlgorithm
916-
- sseCustomerKey
917902
type: object
918903
storageClass:
919904
type: string

‎e2e-tests/version-service/conf/crd.yaml

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -130,11 +130,6 @@ spec:
130130
type: string
131131
sseCustomerKey:
132132
type: string
133-
required:
134-
- kmsKeyID
135-
- sseAlgorithm
136-
- sseCustomerAlgorithm
137-
- sseCustomerKey
138133
type: object
139134
storageClass:
140135
type: string
@@ -261,11 +256,6 @@ spec:
261256
type: string
262257
sseCustomerKey:
263258
type: string
264-
required:
265-
- kmsKeyID
266-
- sseAlgorithm
267-
- sseCustomerAlgorithm
268-
- sseCustomerKey
269259
type: object
270260
storageClass:
271261
type: string
@@ -909,11 +899,6 @@ spec:
909899
type: string
910900
sseCustomerKey:
911901
type: string
912-
required:
913-
- kmsKeyID
914-
- sseAlgorithm
915-
- sseCustomerAlgorithm
916-
- sseCustomerKey
917902
type: object
918903
storageClass:
919904
type: string

‎pkg/apis/psmdb/v1/psmdb_defaults.go

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -485,6 +485,19 @@ func (cr *PerconaServerMongoDB) CheckNSetDefaults(platform version.Platform, log
485485
FSGroup: fsgroup,
486486
}
487487
}
488+
489+
for _, stg := range cr.Spec.Backup.Storages {
490+
if stg.Type != BackupStorageS3 {
491+
continue
492+
}
493+
494+
if len(stg.S3.ServerSideEncryption.SSECustomerAlgorithm) != 0 &&
495+
len(stg.S3.ServerSideEncryption.SSECustomerKey) != 0 &&
496+
len(stg.S3.ServerSideEncryption.KMSKeyID) != 0 &&
497+
len(stg.S3.ServerSideEncryption.SSEAlgorithm) != 0 {
498+
return errors.New("For S3 storage only one encryption method can be used. Set either (sseAlgorithm and kmsKeyID) or (sseCustomerAlgorithm and sseCustomerKey)")
499+
}
500+
}
488501
}
489502

490503
if !cr.Spec.Backup.Enabled {

‎pkg/apis/psmdb/v1/psmdb_types.go

Lines changed: 24 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ import (
1010
v "github.com/hashicorp/go-version"
1111
"github.com/percona/percona-backup-mongodb/pbm"
1212
"github.com/percona/percona-backup-mongodb/pbm/compress"
13-
"github.com/percona/percona-backup-mongodb/pbm/storage/s3"
1413
"github.com/pkg/errors"
1514
"gopkg.in/yaml.v2"
1615
appsv1 "k8s.io/api/apps/v1"
@@ -713,17 +712,31 @@ func (task *BackupTaskSpec) JobName(cr *PerconaServerMongoDB) string {
713712
return fmt.Sprintf("%s-backup-%s-%s", cr.Name, task.Name, cr.Namespace)
714713
}
715714

715+
type S3ServiceSideEncryption struct {
716+
// Used to specify the SSE algorithm used when keys are managed by the server
717+
SSEAlgorithm string `json:"sseAlgorithm,omitempty"`
718+
KMSKeyID string `json:"kmsKeyID,omitempty"`
719+
720+
// Used to specify SSE-C style encryption. For Amazon S3 SSECustomerAlgorithm must be 'AES256'
721+
// see https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerSideEncryptionCustomerKeys.html
722+
SSECustomerAlgorithm string `json:"sseCustomerAlgorithm,omitempty"`
723+
724+
// If SSECustomerAlgorithm is set, this must be a base64 encoded key compatible with the algorithm
725+
// specified in the SseCustomerAlgorithm field.
726+
SSECustomerKey string `json:"sseCustomerKey,omitempty"`
727+
}
728+
716729
type BackupStorageS3Spec struct {
717-
Bucket string `json:"bucket"`
718-
Prefix string `json:"prefix,omitempty"`
719-
Region string `json:"region,omitempty"`
720-
EndpointURL string `json:"endpointUrl,omitempty"`
721-
CredentialsSecret string `json:"credentialsSecret,omitempty"`
722-
ServerSideEncryption s3.AWSsse `json:"serverSideEncryption,omitempty"`
723-
UploadPartSize int `json:"uploadPartSize,omitempty"`
724-
MaxUploadParts int `json:"maxUploadParts,omitempty"`
725-
StorageClass string `json:"storageClass,omitempty"`
726-
InsecureSkipTLSVerify bool `json:"insecureSkipTLSVerify,omitempty"`
730+
Bucket string `json:"bucket"`
731+
Prefix string `json:"prefix,omitempty"`
732+
Region string `json:"region,omitempty"`
733+
EndpointURL string `json:"endpointUrl,omitempty"`
734+
CredentialsSecret string `json:"credentialsSecret,omitempty"`
735+
UploadPartSize int `json:"uploadPartSize,omitempty"`
736+
MaxUploadParts int `json:"maxUploadParts,omitempty"`
737+
StorageClass string `json:"storageClass,omitempty"`
738+
InsecureSkipTLSVerify bool `json:"insecureSkipTLSVerify,omitempty"`
739+
ServerSideEncryption S3ServiceSideEncryption `json:"serverSideEncryption,omitempty"`
727740
}
728741

729742
type BackupStorageAzureSpec struct {

0 commit comments

Comments
 (0)