Search code examples
postgresqlcloudnative-pg

How does CloudnativePG encrypt data

# Example of PostgreSQL cluster
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: test-db-cluster
spec:
  instances: 1
  imageName: ghcr.io/cloudnative-pg/postgresql:16.1


  backup:
    barmanObjectStore:
      wal:
        compression: gzip
        encryption: AES256
      data:
        compression: gzip
        encryption: AES256
---

I have here as encryption AES256, but how does postgres know how to decrypt the files without a pw?

If it's pw protected and the pw gets generated dynamically, it would mean i have to backup the password as well, right?

Solution

  • Currently we only support the server-side encryption provided by the Cloud Provider. However, we are planning to enhance and provide more options in the future for WAL and backup management.