Percona Backup for MongoDB failing to work on GCS

MongoDB Percona Backup for MongoDB
1

Hello.

I have a MongoDB 7 with 3 nodes in a replicaset configuration, but while trying to configure PBM to interact with a GCS bucket, I am getting the below error:

mongodb-replica-set:
  - 10.0.1.11:27017 [S]: pbm-agent [v2.10.0] FAILED status:
      > ERROR with storage: storage check failed with: file stat: get properties: Get "https://storage.googleapis.com/storage/v1/b/fabriciojorge-tests-1/o/mongodb%2F.pbm.init?alt=json&prettyPrint=false&projection=full": private key should be a PEM or plain PKCS1 or PKCS8; parse error: asn1: structure error: tags don't match (16 vs {class:0 tag:15 length:104 isCompound:true}) {optional:false explicit:false application:false private:false defaultValue:<nil> tag:<nil> stringType:0 timeType:0 set:false omitEmpty:false} pkcs1PrivateKey @2
  - 10.0.1.12:27017 [S]: pbm-agent [v2.10.0] FAILED status:
      > ERROR with storage: storage check failed with: file stat: get properties: Get "https://storage.googleapis.com/storage/v1/b/fabriciojorge-tests-1/o/mongodb%2F.pbm.init?alt=json&prettyPrint=false&projection=full": private key should be a PEM or plain PKCS1 or PKCS8; parse error: asn1: structure error: tags don't match (16 vs {class:0 tag:15 length:104 isCompound:true}) {optional:false explicit:false application:false private:false defaultValue:<nil> tag:<nil> stringType:0 timeType:0 set:false omitEmpty:false} pkcs1PrivateKey @2
  - 10.0.1.13:27017 [P]: pbm-agent [v2.10.0] FAILED status:
      > ERROR with storage: storage check failed with: file stat: get properties: Get "https://storage.googleapis.com/storage/v1/b/fabriciojorge-tests-1/o/mongodb%2F.pbm.init?alt=json&prettyPrint=false&projection=full": private key should be a PEM or plain PKCS1 or PKCS8; parse error: asn1: structure error: tags don't match (16 vs {class:0 tag:15 length:104 isCompound:true}) {optional:false explicit:false application:false private:false defaultValue:<nil> tag:<nil> stringType:0 timeType:0 set:false omitEmpty:false} pkcs1PrivateKey @2

I am running PBM version 2.10 on Rocky Linux 9 in Google Cloud:

Version:   2.10.0
Platform:  linux/amd64
GitCommit: 92dfac319381e7861d6958733a3a46d2e2f7a5a1
GitBranch: release-2.10.0
BuildTime: 2025-06-23_09:47_UTC
GoVersion: go1.23.8

My “pbm_config.yaml” file looks like this:

storage:
 type: gcs
 gcs:
    bucket: <bucket-bkp>
    prefix: mongodb
    credentials:
      clientEmail: <service-account>
      privateKey: <path>/pbm_gcs.pem
backup:
  priority:
     "10.0.1.11:27017": 0.5
     "10.0.1.12:27017": 0.5
     "10.0.1.13:27017": 1.0

My PEM file seems to be on the right format, as obtained directly from “gcloud iam service-accounts keys” command

Any insights on why this is failing?

Thanks a lot.

2

Hi @FabricioPedrosoJorge !
privateKey should be a string not a path to the file, something like:

privateKey: "-----BEGIN PRIVATE KEY----- ....... -----END PRIVATE KEY-----"
3

Also you can check you PEM get like that:

Use the command that has the extension of your certificate replacing
cert.xxx with the name of your certificate

openssl x509 -in cert.pem -text -noout
4

Hello team, and apologies for the delay.

When I run “openssl” command, I get this:

openssl x509 -in pbm_gcs.pem -text -noout
Could not find certificate from pbm_gcs.pem
00CEB4B8FF7E0000:error:1608010C:STORE routines:ossl_store_handle_load_result:unsupported:crypto/store/store_result.c:151: