Velero: Enable proper restic encryption

[philipp1992]

Describe the problem/challenge you have
As described in the documentation, restic backups are encrypted by default and the keys are stored in the bucket along with the backups, which renders the encryption useless.

Are there already plans, when the keys will be able to be stored in a different location?

[ashish-amarnath]

Managing restic keys for backups is not in our radar at the moment. Part of the reason is fact the restic is a tool that folk use to migrate workloads across providers. That being the case, coupling the key management to a cloud provider's key management service would be tricky.

As a workaround for this, you might be able to encrypt the object store using the provider encryption at rest features that may allow authorized reads and writes to the object store to occur seamlessly.

[aarononeal]

In the near-term, is there an easy way to override the default secret on a per cluster basis?

Seems like that would be sufficient for certain deployments.

[skriss]

@aarononeal I believe that if, just after installing Velero and before triggering your first restic backup, you create a secret named velero-restic-credentials in the velero namespace, with a key of repository-password, and your desired value, then all restic repos will be created/accessed using that password. You'd be responsible for storage and management of that key. (Note that I haven't actually tried this out in awhile, but that is how it's intended to work).

[skriss]

this is a dupe of #1053, so closing this one out in favor of that.