支持OSS托管加密

scripts/archive-binlog.sh

@@ -22,7 +22,6 @@ require_archive_config() {
   backup_require_env BACKUP_DIR >/dev/null
   backup_require_env BACKUP_OSS_URI >/dev/null
   backup_require_env BACKUP_PASSPHRASE >/dev/null
-  backup_require_env BACKUP_KMS_KEY_ID >/dev/null
 }
 
 closed_binlogs() {
@@ -91,10 +90,10 @@ archive_one() {
     printf 'created_at=%s\n' "$(date -Iseconds)"
   } > "${work_dir}/${object_id}.complete.env"
 
-  backup_oss_upload_kms "${cipher_file}" "${remote_dir}/binlog.enc"
-  backup_oss_upload_kms "${work_dir}/${object_id}.enc.sha256" "${remote_dir}/binlog.enc.sha256"
+  backup_oss_upload "${cipher_file}" "${remote_dir}/binlog.enc"
+  backup_oss_upload "${work_dir}/${object_id}.enc.sha256" "${remote_dir}/binlog.enc.sha256"
   # complete.env 最后上传，恢复程序只使用有该文件的 binlog。
-  backup_oss_upload_kms "${work_dir}/${object_id}.complete.env" "${remote_dir}/complete.env"
+  backup_oss_upload "${work_dir}/${object_id}.complete.env" "${remote_dir}/complete.env"
   write_state "${state_dir}" "${filename}" "${binlog_index}" "${raw_sha}" "${cipher_sha}" "${remote_dir}"
   rm -f -- "${raw_file}" "${cipher_file}" "${work_dir}/${object_id}.enc.sha256" "${work_dir}/${object_id}.complete.env"
 }

scripts/backup-common.sh

@@ -153,13 +153,18 @@ backup_decrypt_file() {
   unset passphrase
 }
 
-backup_oss_upload_kms() {
+backup_oss_upload() {
   local source="$1"
   local destination="$2"
   local kms_key_id
-  kms_key_id="$(backup_require_env BACKUP_KMS_KEY_ID)"
-  ossutil cp "${source}" "${destination}" \
-    --encryption KMS --kms-master-key-id "${kms_key_id}"
+  kms_key_id="$(backup_env_value BACKUP_KMS_KEY_ID)"
+  if [[ -n "${kms_key_id}" ]]; then
+    ossutil cp "${source}" "${destination}" \
+      --encryption KMS --kms-master-key-id "${kms_key_id}"
+    return
+  fi
+  # 未配置 KMS 时依赖 Bucket 已启用的 OSS 托管服务器端加密；备份载荷仍会先经过客户端加密。
+  ossutil cp "${source}" "${destination}"
 }
 
 backup_validate_oss_uri() {

scripts/backup-online.sh

@@ -22,7 +22,6 @@ require_backup_config() {
   backup_require_env BACKUP_DIR >/dev/null
   backup_require_env BACKUP_OSS_URI >/dev/null
   backup_require_env BACKUP_PASSPHRASE >/dev/null
-  backup_require_env BACKUP_KMS_KEY_ID >/dev/null
   backup_require_env BACKUP_MYSQL_USER >/dev/null
   backup_require_env BACKUP_MYSQL_PASSWORD >/dev/null
 }
@@ -36,11 +35,11 @@ upload_backup_set() {
   local remote_dir="${oss_uri}/mysql/full/${level}/${server_uuid}/${ts}"
 
   backup_log "上传 ${level} 全量备份到 ${remote_dir}"
-  backup_oss_upload_kms "${local_dir}/mysql-full.tgz.enc" "${remote_dir}/mysql-full.tgz.enc"
-  backup_oss_upload_kms "${local_dir}/manifest.env" "${remote_dir}/manifest.env"
-  backup_oss_upload_kms "${local_dir}/mysql-full.tgz.enc.sha256" "${remote_dir}/mysql-full.tgz.enc.sha256"
+  backup_oss_upload "${local_dir}/mysql-full.tgz.enc" "${remote_dir}/mysql-full.tgz.enc"
+  backup_oss_upload "${local_dir}/manifest.env" "${remote_dir}/manifest.env"
+  backup_oss_upload "${local_dir}/mysql-full.tgz.enc.sha256" "${remote_dir}/mysql-full.tgz.enc.sha256"
   # complete.env 必须最后上传，作为远端原子完成标识。
-  backup_oss_upload_kms "${local_dir}/complete.env" "${remote_dir}/complete.env"
+  backup_oss_upload "${local_dir}/complete.env" "${remote_dir}/complete.env"
 }
 
 full_backup() {

scripts/deploy-prod.sh

@@ -165,7 +165,6 @@ validate_env() {
   backup_restore_dir="$(require_env BACKUP_RESTORE_DIR)"
   backup_oss_uri="$(require_env BACKUP_OSS_URI)"
   require_env BACKUP_PASSPHRASE >/dev/null
-  require_env BACKUP_KMS_KEY_ID >/dev/null
   backup_user="$(require_env BACKUP_MYSQL_USER)"
   require_env BACKUP_MYSQL_PASSWORD >/dev/null
   backend_uid="$(require_env BACKEND_UID)"