feat: support S3 SSE-C (customer-provided encryption keys)

Surface the new `sseCustomerKey` field on `s3Credentials` through the
ObjectStore CRD so users can enable Server-Side Encryption with
Customer-provided keys (SSE-C). This is required by S3-compatible
providers that only support SSE-C for encryption at rest, such as
Hetzner Object Storage.

The field flows through the embedded BarmanObjectStoreConfiguration
from the barman-cloud library, so this change is limited to bumping the
dependency, regenerating the CRD and the consolidated manifest, and
documenting usage in the object stores guide.

Depends on cloudnative-pg/barman-cloud#284 (temporarily pinned via a
replace directive until that change is released).

Closes #646

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Florian Schauer <florian@schauer.to>

Author: schaurian

config/crd/bases/barmancloud.cnpg.io_objectstores.yaml

@@ -315,6 +315,30 @@ spec:
                         - key
                         - name
                         type: object
+                      sseCustomerKey:
+                        description: |-
+                          The reference to the secret containing the key for
+                          Server-Side Encryption with Customer-provided keys (SSE-C).
+                          When set, every object barman-cloud uploads to and downloads from
+                          S3 is encrypted with this key using the AWS SSE-C protocol
+                          (the `--sse-customer-key` barman-cloud option).
+                          The referenced value must be a base64-encoded 256-bit (32-byte)
+                          AES key. This is orthogonal to the bucket-managed `encryption`
+                          field (SSE-S3/SSE-KMS) and is meant for S3-compatible providers
+                          that only support customer-provided keys (e.g. Hetzner Object
+                          Storage). It can be combined with any authentication method,
+                          including inheritFromIAMRole.
+                        properties:
+                          key:
+                            description: The key to select
+                            type: string
+                          name:
+                            description: Name of the referent.
+                            type: string
+                        required:
+                        - key
+                        - name
+                        type: object
                     type: object
                   serverName:
                     description: |-

go.mod

@@ -137,3 +137,5 @@ require (
 	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
+
+replace github.com/cloudnative-pg/barman-cloud => github.com/schaurian/barman-cloud v0.5.2-0.20260809132550-a30084171954

go.sum

@@ -20,8 +20,6 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cloudnative-pg/api v1.30.0 h1:L8hnvV/tPEQA1xYEi41FUBFA7FUNVGju8+SlgFlDDjI=
 github.com/cloudnative-pg/api v1.30.0/go.mod h1:XrKBbOWObL33si0FNuwX4uHNf5JShiZyOUqd6LxbJQo=
-github.com/cloudnative-pg/barman-cloud v0.5.2-0.20260720143032-950b0f57e122 h1:NuOztBdp+bUr/xYtaAw8o/x880hvWDRhJGl+R1YsZNw=
-github.com/cloudnative-pg/barman-cloud v0.5.2-0.20260720143032-950b0f57e122/go.mod h1:ZQLkdpk44FW5/BGWzABTOEcV9qPbwC+rbdscg2I8mBI=
 github.com/cloudnative-pg/cloudnative-pg v1.30.0 h1:fnhVq44xXx97MNiuvJsPrX1vSjYbgdyBK5MSGfdHdp0=
 github.com/cloudnative-pg/cloudnative-pg v1.30.0/go.mod h1:QkolwBOWZ+GvAiJt6KpDSymwkpf0K19/p4Q6MQlTM8U=
 github.com/cloudnative-pg/cnpg-i v0.6.0 h1:LA//DLkFOLIjU0ASOpFkydZhGir9IAIDfgSsTTX9IpU=
@@ -187,6 +185,8 @@ github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
 github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
+github.com/schaurian/barman-cloud v0.5.2-0.20260809132550-a30084171954 h1:Y+01J7nOz6jQdrkEEpS8Mq74aECXAdr+DTeY2Lo3DmQ=
+github.com/schaurian/barman-cloud v0.5.2-0.20260809132550-a30084171954/go.mod h1:ZQLkdpk44FW5/BGWzABTOEcV9qPbwC+rbdscg2I8mBI=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
 github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/snorwin/jsonpatch v1.5.0 h1:0m56YSt9cHiJOn8U+OcqdPGcDQZmhPM/zsG7Dv5QQP0=

manifest.yaml

@@ -314,6 +314,30 @@ spec:
                         - key
                         - name
                         type: object
+                      sseCustomerKey:
+                        description: |-
+                          The reference to the secret containing the key for
+                          Server-Side Encryption with Customer-provided keys (SSE-C).
+                          When set, every object barman-cloud uploads to and downloads from
+                          S3 is encrypted with this key using the AWS SSE-C protocol
+                          (the `--sse-customer-key` barman-cloud option).
+                          The referenced value must be a base64-encoded 256-bit (32-byte)
+                          AES key. This is orthogonal to the bucket-managed `encryption`
+                          field (SSE-S3/SSE-KMS) and is meant for S3-compatible providers
+                          that only support customer-provided keys (e.g. Hetzner Object
+                          Storage). It can be combined with any authentication method,
+                          including inheritFromIAMRole.
+                        properties:
+                          key:
+                            description: The key to select
+                            type: string
+                          name:
+                            description: Name of the referent.
+                            type: string
+                        required:
+                        - key
+                        - name
+                        type: object
                     type: object
                   serverName:
                     description: |-

web/docs/object_stores.md

@@ -194,6 +194,70 @@ spec:
   [...]
 ```
 
+### Server-Side Encryption with Customer Keys (SSE-C)
+
+Some S3-compatible providers — most notably **Hetzner Object Storage** — do
+not offer bucket-managed server-side encryption (SSE-S3 / SSE-KMS) and instead
+only support **Server-Side Encryption with Customer-provided keys (SSE-C)**.
+With SSE-C the encryption key never leaves your control: it is supplied with
+every request, and the provider uses it to encrypt and decrypt objects without
+storing it.
+
+To enable SSE-C, set the `sseCustomerKey` field in the `s3Credentials` block to
+a secret reference holding a **base64-encoded 256-bit (32-byte) AES key**.
+
+Generate the key and store it in a Kubernetes secret:
+
+```sh
+# Generate a random 256-bit key, base64-encoded
+openssl rand 32 | base64 > sse-c.key
+
+kubectl create secret generic aws-sse-c \
+  --from-file=key=sse-c.key
+```
+
+:::warning
+Keep this key safe and backed up **outside** the object store. If you lose
+it, your backups and WAL files become permanently unrecoverable — the
+provider cannot decrypt them for you.
+:::
+
+Reference it in your `ObjectStore` definition:
+
+```yaml
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: hetzner-store
+spec:
+  configuration:
+    destinationPath: "s3://BUCKET_NAME/path/to/folder"
+    endpointURL: "https://fsn1.your-objectstorage.com"
+    s3Credentials:
+      accessKeyId:
+        name: aws-creds
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: aws-creds
+        key: ACCESS_SECRET_KEY
+      sseCustomerKey:
+        name: aws-sse-c
+        key: key
+  [...]
+```
+
+The same key is applied to **every** operation — base backups, WAL archiving,
+WAL restore, and data restore — so it must remain unchanged and available for
+the whole lifetime of the backups it protects. `sseCustomerKey` is independent
+of the bucket-managed `encryption` field (SSE-S3 / SSE-KMS) and can be combined
+with any authentication method, including `inheritFromIAMRole`.
+
+:::note
+SSE-C support requires a sidecar image whose `barman-cloud` build includes
+the `--sse-customer-key` option
+(see [barman#973](https://github.com/EnterpriseDB/barman/issues/973)).
+:::
+
 ### Using Object Storage with a Private CA
 
 For object storage services (e.g., MinIO) that use HTTPS with certificates