PBM cannot write to NetApp ONTAP S3. Every PutObject fails with:
InvalidArgument: x-amz-content-sha256 must be UNSIGNED-PAYLOAD,
STREAMING-AWS4-HMAC-SHA256-PAYLOAD or a valid sha256 value
aws-sdk-go-v2 defaults requestChecksumCalculation to WHEN_SUPPORTED (Jan 2025) and sends STREAMING-UNSIGNED-PAYLOAD-TRAILER, which ONTAP S3 does not support. NetApp confirms this is unsupported and still unimplemented in 9.17.1P8 (their latest), and their KB names AWS_REQUEST_CHECKSUM_CALCULATION=when_required as the workaround.
PBM offers no way to set it. Under the Percona Operator for MongoDB the backup-agent container is operator-generated with envFrom: null and only explicit PBM_* variables, so the environment variable cannot be injected, and pbm config exposes no checksum option (region, endpointUrl, forcePathStyle, bucket, prefix, credentials, maxUploadParts, storageClass, insecureSkipTLSVerify).
Tested: 2.11.0 fails, 2.13.0 fails identically, 2.8.0 works (predates the SDK default change). We are pinned to 2.8.0 in production as the only workaround.
Note the failure only affects small objects — PITR oplog chunks upload fine because they go multipart, so pbm status shows PITR healthy while snapshots fail on .pbm.init. That makes it easy to miss.
Request: a storage.s3.requestChecksumCalculation (or equivalent) setting in pbm config, so it can be set where the other S3 options live.
In PBM v2.10, PBM needed to migrate to the AWS S3 v2 library simply because v1 was deprecated. As a result, the v2 library, used by PBM broke compatibility with some S3 custom storage.
This seems like a pretty important compatibility gap, especially since PBM 2.8 works and newer versions fail because of the SDK behavior change. Having a requestChecksumCalculation option alongside the existing S3 settings would be a clean solution and avoid forcing users to stay on an old PBM version.