Allow backup encryption (!6219) · Merge requests · Sylva-projects / sylva-core

What does this MR do and why?

This MR allow activating client side encryption for backups.

Depending on the component, the method applied is different.

for backup jobs, openssl is used
for rancher, the rancher-backup-operator is managing itself the encryption
for rke2 etcd, rke2 do not provide client side encryption mechanism but it backup data as is. so if the etcd is encrypted, the backup will be also encrypted

This MR contains 1 commit (for now):

configure encryption for backup jobs (capi, keycloak and kubeadm etcd)

as per discussions with @frmenguy , removed the support of aes-256-gcm as openssl no more supports GCM ciphers, faced errors for GCM such as enc: AEAD ciphers not supported and also verified from https://crypto.stackexchange.com/questions/114115/openssl-enc-aes-128-gcm-causes-enc-aead-ciphers-not-supported-on-centos-8-5

by default if cipher is not specified by the user, it'll take aes-256-cbc cipher for encryption of files
- ciphers which are reflected by openssl enc cmd, only those are supported.

using openssl enc cmd to encrypt the data

openssl enc -${ENCRYPTION_CIPHER} -pbkdf2 -salt -in ${ARCHIVE} -out ${ENCRYPTED_ARCHIVE} -pass pass:"${ENCRYPTION_KEY}"

Closes: #2328 (closed)

Test coverage

CI configuration

Below you can choose test deployment variants to run in this MR's CI.

Click to open to CI configuration

Legend:

Icon	Meaning	Available values
☁️	Infra Provider	`capd`, `capo`, `capm3`
🚀	Bootstrap Provider	`kubeadm` (alias `kadm`), `rke2`, `okd`, `ck8s`
🐧	Node OS	`ubuntu`, `suse`, `na`, `leapmicro`
🛠️	Deployment Options	`light-deploy`, `dev-sources`, `ha`, `misc`, `maxsurge-0`, `logging`, `no-logging`, `cilium`
🎬	Pipeline Scenarios	Available scenario list and description
🟢	Enabled units	Any available units name, by default apply to management and workload cluster. Can be prefixed by `mgmt:` or `wkld:` to be applied only to a specific cluster type

Global config for deployment pipelines

autorun pipelines
allow failure on pipelines
record sylvactl events

Notes:

Enabling autorun will make deployment pipelines to be run automatically without human interaction
Disabling allow failure will make deployment pipelines mandatory for pipeline success.
if both autorun and allow failure are disabled, deployment pipelines will need manual triggering but will be blocking the pipeline

Be aware: after configuration change, pipeline is not triggered automatically. Please run it manually (by clicking the run pipeline button in Pipelines tab) or push new code.

Edited Jul 16, 2026 by Sakshi Choudhary

Allow backup encryption

What does this MR do and why?

Related reference(s)

Test coverage

CI configuration

Global config for deployment pipelines

Merge request reports