No flag for enabling encyption in pg_hardstorgage.yaml

[sebastiansuter-advact]

I've been testing pg_hardstorage and my pg_hardstorage.yaml creates backups in an s3 compatible storage from a CNPG deployment in kubernetes. I have deployed the charts/pg-hardstorage-sidecar Helm Chart. I have defined the following 'config':

config: |
  deployments:
    db1:
      pg_connection: <working connection string>
      repo: s3://backup-bucket/?endpoint=https://<some s3 compatible host>&path_style=true
      retention:
        policy: gfs
        keep_daily: 7
        keep_weekly: 4
        keep_monthly: 12
        keep_yearly: 5
      schedule:
        backup: { every: "5m" }
        rotate: { every: "10m" }

The kek.bin exists and the keyring is OK

kubectl exec -it pg-hardstorage-pg-hardstorage-sidecar-0 -- pg_hardstorage kms inspect
keyring at /var/lib/pg_hardstorage/keyring
  manifest_signing.ed25519
    present:     yes (mode -rw-------, 165 bytes, 2026-07-24T12:33:27Z)
  manifest_signing.pub
    present:     yes (mode -rw-rw-r--, 159 bytes, 2026-07-24T12:33:27Z)
    fingerprint: sha256:21de1f0865492035
  kek.bin
    present:     yes (mode -rw-------, 32 bytes, 2026-07-24T15:04:43Z)

With the CLI I can execute an encrypted backup:

kubectl exec -it pg-hardstorage-pg-hardstorage-sidecar-0 -- pg_hardstorage backup db1 --encrypt --kek local:default
...
  Deployment:       db1
...
  Encryption:       AES-256-GCM (per-backup DEK, wrapped under local KEK)

But the backups created by the pg_hardstorage.yaml do not encrypt the backups.

kubectl exec -it pg-hardstorage-pg-hardstorage-sidecar-0 -- pg_hardstorage kms verify
kms verify — all deployments
  Considered:            5
  ✓ OK:                  0
  · Unencrypted:         5 (policy decision)
  Duration:              430 ms
  ✓ envelope health: clean

I checked the internal/config/config.go source for the type DeploymentConfig struct and there is no option to enforce encryption. Could anybody give me a hint on how to enforce the encryption in the pg_hardstorage.yaml? The documentation does not mention it anywhere.

Thanks

[sebastiansuter-advact]

Works now in Version v1.1.0 with the following config by adding kek_ref: local:default. Backups now get encrypted, provided the kek.bin is present.

config: |
  deployments:
    db1:
      pg_connection: <working connection string>
      repo: s3://backup-bucket/?endpoint=https://<some s3 compatible host>&path_style=true
      kek_ref: local:default
      retention:
        policy: gfs
        keep_daily: 7
        keep_weekly: 4
        keep_monthly: 12
        keep_yearly: 5
      schedule:
        backup: { every: "5m" }
        rotate: { every: "10m" }