# serverSideEncryption.sseCustomerKey ignored when authenticating with IRSA

**URL:** <https://forums.percona.com/t/serversideencryption-ssecustomerkey-ignored-when-authenticating-with-irsa/39492>\
**Category:** Percona Operator for MongoDB\
**Created:** [October 3, 2025, 4:37pm UTC](https://forums.percona.com/t/serversideencryption-ssecustomerkey-ignored-when-authenticating-with-irsa/39492 "2025-10-03T16:37:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![gnobiron](https://avatars.discourse-cdn.com/v4/letter/g/47e85d/32.png) [@gnobiron](https://forums.percona.com/u/gnobiron)\
**Post date:** [October 3, 2025, 4:37pm UTC](https://forums.percona.com/t/serversideencryption-ssecustomerkey-ignored-when-authenticating-with-irsa/39492/1 "2025-10-03T16:37:25Z")

</div>

## Description:

When using an s3 storage for backups with sse-c (customer-provided keys) and authenticating with IRSA, the serverSideEncryption.sseCustomerKey is not pushed by the operator to PLM config, which make the backups unencrypted.

## Steps to Reproduce:

Deploying a cluster with the following configuration :

```auto
secrets:
  encryptionKey: percona-mongodb-mongodb-encryption-key
  keyFile: percona-mongodb-mongodb-keyfile
  sse: percona-mongodb-s3-backup-sse-key
  users: percona-mongodb-users
replsets:
  rs0:
    name: rs0
    size: 3
    serviceAccountName: percona-mongodb
    ...
backup:
  enabled: true
  storages:
    s3-daily:
      main: true
      type: s3
      s3:
        bucket: percona-mongodb-backups
        prefix: daily
        region: us-west-2
        storageClass: STANDARD
        serverSideEncryption:
          sseCustomerAlgorithm: AES256

```

Authentication on S3 is done with IRSA.

After deployment, the resulting pbm config is :

```auto
$ pbm config
storage:
  type: s3
  s3:
    region: us-west-2
    forcePathStyle: true
    bucket: percona-mongodb-backups
    prefix: daily
    credentials: {}
    maxUploadParts: 10000
    storageClass: STANDARD
    insecureSkipTLSVerify: false
pitr:
  enabled: false
  compression: s2
backup:
  oplogSpanMin: 0
  compression: s2
restore: {}

```

## Version:

percona-server-mongodb-operator 1.20.1  
percona-backup-mongodb:2.9.1  
percona-server-mongodb:7.0.18-11

## Logs:

No error found in logs.

## Expected Result:

Backups encrypted with the provided sse-c key.

## Actual Result:

Backups are pushed unencrypted to the bucket, which can be a little tricky for someone not verifying that the backups are effectively encrypted.

## Additional Information:

The issue is coming from this line : [percona-server-mongodb-operator/pkg/psmdb/backup/pbm.go at v1.20.1 · percona/percona-server-mongodb-operator · GitHub](https://github.com/percona/percona-server-mongodb-operator/blob/v1.20.1/pkg/psmdb/backup/pbm.go#L350)

I was able to workaround it by creating an empty secret and referring it in my backup config :

```auto
backup:
  enabled: true
  storages:
    s3-daily:
      main: true
      type: s3
      s3:
        bucket: percona-mongodb-backups
        prefix: daily
        region: us-west-2
        storageClass: STANDARD
        credentialsSecret: percona-mongodb-s3-dummy
        serverSideEncryption:
          sseCustomerAlgorithm: AES256

```

Authentication still works by using IRSA and the plm config is generated as expected :

```auto
storage:
  type: s3
  s3:
    region: us-west-2
    forcePathStyle: true
    bucket: myscript-us-west-2-preprod-license-percona-mongodb-backups
    prefix: daily
    credentials: {}
    serverSideEncryption:
      sseAlgorithm: ""
      kmsKeyID: ""
      sseCustomerAlgorithm: AES256
      sseCustomerKey: '***'
    maxUploadParts: 10000
    storageClass: STANDARD
    insecureSkipTLSVerify: false
pitr:
  enabled: false
  compression: s2
backup:
  oplogSpanMin: 0
  compression: s2
restore: {}

```

Backups files are then encrypted with the aes key provided in sse secret.

I have a concern, however, that the workaround I used may stop working in a future version. Do you think it would be possible to make the operator accept sse-c keys with oidc authentication natively ?

---

<div class="post-metadata">

**Author:** ![Natalia\_Marukovich](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/natalia_marukovich/32/6407_2.png) [@Natalia\_Marukovich](https://forums.percona.com/u/Natalia_Marukovich)\
**Post date:** [October 8, 2025, 10:37am UTC](https://forums.percona.com/t/serversideencryption-ssecustomerkey-ignored-when-authenticating-with-irsa/39492/2 "2025-10-08T10:37:52Z")

</div>

@gnobiron Thank you for your report and the detailed description.  
I’ve checked the code and confirmed that it’s a bug. We’ll fix it in one of the upcoming releases.  
You can track the task here: [Jira](https://perconadev.atlassian.net/jira/software/c/projects/K8SPSMDB/boards/116?selectedIssue=K8SPSMDB-1490)