Storage Backend Examples

Ready-to-use StorageBackend and Secret manifests for common storage providers. Retour uses rclone for data transfer and supports any S3-compatible backend. Examples below cover providers from the rclone S3 documentation (excluding Russian providers). See YAML Files for downloadable .yaml files.

AWS S3

apiVersion: v1
kind: Secret
metadata:
  name: s3-credentials
  namespace: retour
type: Opaque
stringData:
  access-key-id: "your-access-key"
  secret-access-key: "your-secret-key"
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: s3-production
  namespace: retour
spec:
  type: s3
  description: "Production AWS S3 bucket"
  s3:
    bucket: retour-backups
    region: us-east-1
    useSSL: true
    secretRef:
      name: s3-credentials
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

MinIO (S3-compatible)

apiVersion: v1
kind: Secret
metadata:
  name: minio-credentials
  namespace: retour
type: Opaque
stringData:
  access-key-id: minio
  secret-access-key: minio123
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: minio
  namespace: retour
spec:
  type: s3
  s3:
    endpoint: https://minio.example.com
    bucket: retour-backups
    region: us-east-1
    useSSL: true
    secretRef:
      name: minio-credentials
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

S3 with IRSA (EKS, no secrets)

When using IAM Roles for Service Accounts on EKS, credentials are injected via environment variables.

apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: s3-aws-irsa
  namespace: retour
spec:
  type: s3
  s3:
    bucket: retour-backups
    region: us-east-1
    useSSL: true
    envAuth: true

Ceph RGW (S3-compatible)

apiVersion: v1
kind: Secret
metadata:
  name: ceph-credentials
  namespace: retour
type: Opaque
stringData:
  access-key-id: "ceph-access-key"
  secret-access-key: "ceph-secret-key"
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: ceph-rgw
  namespace: retour
spec:
  type: s3
  s3:
    endpoint: https://rgw.ceph.example.com
    bucket: retour-backups
    region: default
    useSSL: true
    secretRef:
      name: ceph-credentials
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

Azure Blob Storage

apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: azure-production
  namespace: retour
spec:
  type: azureblob
  azureblob:
    account: retourstorage
    container: retour-backups
    secretRef:
      name: azure-credentials
      keys:
        accountKey: account-key      # or sasToken: sas-url

Under Azure Workload Identity or a managed identity, drop secretRef and set envAuth: true.

Google Cloud Storage

apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: gcs-production
  namespace: retour
spec:
  type: gcs
  gcs:
    bucket: retour-backups
    secretRef:
      name: gcs-credentials
      keys:
        serviceAccountKey: service-account-json

The secret holds the service-account JSON document itself. Under GKE Workload Identity, drop secretRef and set envAuth: true.

Encrypted (Crypt over S3)

Encrypt backups at rest using rclone crypt. The underlying backend is S3.

apiVersion: v1
kind: Secret
metadata:
  name: crypt-credentials
  namespace: retour
type: Opaque
stringData:
  password: "encryption-password"
  access-key-id: "minio"
  secret-access-key: "minio123"
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: s3-encrypted
  namespace: retour
spec:
  type: crypt
  crypt:
    backend: s3
    s3:
      endpoint: http://minio.retour.svc.cluster.local:9000
      bucket: retour-backups
      region: us-east-1
      useSSL: false
    secretRef:
      name: crypt-credentials
      keys:
        password: password
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

Custom Secret Keys

When your Secret uses different key names:

apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: s3-custom-keys
  namespace: retour
spec:
  type: s3
  s3:
    bucket: retour-backups
    region: us-east-1
    secretRef:
      name: my-credentials
      keys:
        accessKeyID: aws_access_key_id
        secretAccessKey: aws_secret_access_key

Secret in Different Namespace

apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: s3-cross-ns
  namespace: retour
spec:
  type: s3
  s3:
    bucket: retour-backups
    region: us-east-1
    secretRef:
      name: s3-credentials
      namespace: secrets
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

Cloudflare R2

S3-compatible object storage with zero egress fees. Replace YOUR_ACCOUNT_ID with your Cloudflare account ID from the R2 dashboard.

apiVersion: v1
kind: Secret
metadata:
  name: r2-credentials
  namespace: retour
type: Opaque
stringData:
  access-key-id: "your-r2-access-key-id"
  secret-access-key: "your-r2-secret-access-key"
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: cloudflare-r2
  namespace: retour
spec:
  type: s3
  description: "Cloudflare R2 - zero egress"
  s3:
    endpoint: https://YOUR_ACCOUNT_ID.r2.cloudflarestorage.com
    bucket: retour-backups
    region: auto
    useSSL: true
    secretRef:
      name: r2-credentials
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

DigitalOcean Spaces

S3-compatible object storage. Use your Space region (e.g., nyc3, ams3, sgp1) in the endpoint and region.

apiVersion: v1
kind: Secret
metadata:
  name: do-spaces-credentials
  namespace: retour
type: Opaque
stringData:
  access-key-id: "your-spaces-key"
  secret-access-key: "your-spaces-secret"
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: digitalocean-spaces
  namespace: retour
spec:
  type: s3
  description: "DigitalOcean Spaces"
  s3:
    endpoint: https://nyc3.digitaloceanspaces.com
    bucket: retour-backups
    region: nyc3
    useSSL: true
    secretRef:
      name: do-spaces-credentials
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

Wasabi

S3-compatible low-cost object storage. Use region-specific endpoints for EU or APAC.

apiVersion: v1
kind: Secret
metadata:
  name: wasabi-credentials
  namespace: retour
type: Opaque
stringData:
  access-key-id: "your-wasabi-access-key"
  secret-access-key: "your-wasabi-secret-key"
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: wasabi
  namespace: retour
spec:
  type: s3
  description: "Wasabi US East"
  s3:
    endpoint: https://s3.wasabisys.com
    bucket: retour-backups
    region: us-east-1
    useSSL: true
    secretRef:
      name: wasabi-credentials
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

Linode Object Storage

S3-compatible object storage. Use your cluster region (e.g., us-east-1, eu-central-1).

apiVersion: v1
kind: Secret
metadata:
  name: linode-credentials
  namespace: retour
type: Opaque
stringData:
  access-key-id: "your-linode-access-key"
  secret-access-key: "your-linode-secret-key"
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: linode-object-storage
  namespace: retour
spec:
  type: s3
  description: "Linode Object Storage"
  s3:
    endpoint: https://us-east-1.linodeobjects.com
    bucket: retour-backups
    region: us-east-1
    useSSL: true
    secretRef:
      name: linode-credentials
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

Scaleway Object Storage

S3-compatible object storage. Regions: fr-par, nl-ams, pl-waw.

apiVersion: v1
kind: Secret
metadata:
  name: scaleway-credentials
  namespace: retour
type: Opaque
stringData:
  access-key-id: "your-scaleway-access-key"
  secret-access-key: "your-scaleway-secret-key"
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: scaleway
  namespace: retour
spec:
  type: s3
  description: "Scaleway Object Storage"
  s3:
    endpoint: https://s3.fr-par.scw.cloud
    bucket: retour-backups
    region: fr-par
    useSSL: true
    secretRef:
      name: scaleway-credentials
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

Hetzner Object Storage

S3-compatible object storage. Create a bucket in the Hetzner Cloud Console and use the provided endpoint (e.g., fsn1.your-objectstorage.com).

apiVersion: v1
kind: Secret
metadata:
  name: hetzner-credentials
  namespace: retour
type: Opaque
stringData:
  access-key-id: "your-hetzner-access-key"
  secret-access-key: "your-hetzner-secret-key"
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: hetzner
  namespace: retour
spec:
  type: s3
  description: "Hetzner Object Storage"
  s3:
    endpoint: https://fsn1.your-objectstorage.com
    bucket: retour-backups
    region: eu-central-1
    useSSL: true
    secretRef:
      name: hetzner-credentials
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

Storj (Decentralized S3)

S3-compatible decentralized object storage via S3 gateway. Use the gateway URL from your Storj project.

apiVersion: v1
kind: Secret
metadata:
  name: storj-credentials
  namespace: retour
type: Opaque
stringData:
  access-key-id: "your-storj-access-key"
  secret-access-key: "your-storj-secret-key"
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: storj
  namespace: retour
spec:
  type: s3
  description: "Storj decentralized storage"
  s3:
    endpoint: https://gateway.storjshare.io
    bucket: retour-backups
    region: us-east-1
    useSSL: true
    secretRef:
      name: storj-credentials
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

OVHcloud Object Storage

S3-compatible object storage. Use region-specific endpoints (e.g., s3.eu.cloud.ovh.net, s3.ca.cloud.ovh.net).

apiVersion: v1
kind: Secret
metadata:
  name: ovh-credentials
  namespace: retour
type: Opaque
stringData:
  access-key-id: "your-ovh-access-key"
  secret-access-key: "your-ovh-secret-key"
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: ovhcloud
  namespace: retour
spec:
  type: s3
  description: "OVHcloud Object Storage"
  s3:
    endpoint: https://s3.eu.cloud.ovh.net
    bucket: retour-backups
    region: eu
    useSSL: true
    secretRef:
      name: ovh-credentials
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

IONOS Object Storage

S3-compatible object storage for IONOS Cloud.

apiVersion: v1
kind: Secret
metadata:
  name: ionos-credentials
  namespace: retour
type: Opaque
stringData:
  access-key-id: "your-ionos-access-key"
  secret-access-key: "your-ionos-secret-key"
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: ionos
  namespace: retour
spec:
  type: s3
  description: "IONOS Object Storage"
  s3:
    endpoint: https://s3.eu-central-1.ionos.com
    bucket: retour-backups
    region: eu-central-1
    useSSL: true
    secretRef:
      name: ionos-credentials
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

IBM Cloud Object Storage

S3-compatible IBM COS. Use the endpoint for your bucket's region and cross-region/cross-regional setting.

apiVersion: v1
kind: Secret
metadata:
  name: ibm-cos-credentials
  namespace: retour
type: Opaque
stringData:
  access-key-id: "your-ibm-cos-access-key"
  secret-access-key: "your-ibm-cos-secret-key"
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: ibm-cos
  namespace: retour
spec:
  type: s3
  description: "IBM Cloud Object Storage"
  s3:
    endpoint: https://s3.us.cloud-object-storage.appdomain.cloud
    bucket: retour-backups
    region: us
    useSSL: true
    secretRef:
      name: ibm-cos-credentials
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key

Dreamhost DreamObjects

S3-compatible object storage. Uses Wasabi-compatible API.

apiVersion: v1
kind: Secret
metadata:
  name: dreamhost-credentials
  namespace: retour
type: Opaque
stringData:
  access-key-id: "your-dreamobjects-key"
  secret-access-key: "your-dreamobjects-secret"
---
apiVersion: retour.thebackup.company/v1
kind: StorageBackend
metadata:
  name: dreamhost-dreamobjects
  namespace: retour
spec:
  type: s3
  description: "Dreamhost DreamObjects"
  s3:
    endpoint: https://objects-us-east-1.dream.io
    bucket: retour-backups
    region: us-east-1
    useSSL: true
    secretRef:
      name: dreamhost-credentials
      keys:
        accessKeyID: access-key-id
        secretAccessKey: secret-access-key