Enum ConnectSpec 

pub enum ConnectSpec {
    Filesystem {
        path: PathBuf,
    },
    S3 {
        bucket: String,
        endpoint: Option<String>,
        prefix: Option<String>,
        region: Option<String>,
        disable_tls: bool,
        disable_tls_verification: bool,
        root_ca_pem: Option<String>,
        ambient_credentials: bool,
    },
    Azure {
        container: String,
        storage_account: Option<String>,
        prefix: Option<String>,
    },
    Gcs {
        bucket: String,
        prefix: Option<String>,
        credentials_file: Option<String>,
    },
    B2 {
        bucket: String,
        prefix: Option<String>,
    },
    Sftp {
        host: String,
        path: String,
        port: Option<u16>,
        username: Option<String>,
        keyfile: Option<String>,
        known_hosts: Option<String>,
    },
    WebDav {
        url: String,
    },
    Rclone {
        remote_path: String,
        config_file: Option<String>,
        startup_timeout: Option<String>,
    },
    Gdrive {
        folder_id: String,
        credentials_file: Option<String>,
    },
    FromConfig {
        file: Option<String>,
        token: Option<String>,
    },
    Server {
        url: String,
        fingerprint: Option<String>,
    },
}

A typed description of how to reach a kopia repository. This is the input to KopiaClient::repository_connect / KopiaClient::repository_create. Externally-tagged so exactly one backend is representable (mirrors the API crate’s Backend discipline, though this is a separate, simpler type with no kube dependency).

Credentials are NOT here

Secrets are supplied two ways, never on argv. Env-delivered secrets (set with KopiaClientBuilder::env) cover the backends kopia reads from the environment; file-delivered secrets are written to a file by the caller (the mover) and the path is passed in the relevant ConnectSpec field. Either way only non-secret identifiers (bucket, host, path, …) and file paths live in ConnectSpec, so a secret never leaks into a ConfigMap, a process listing, or an error message. The relevant kopia inputs by backend:

• S3: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN (env)
• Azure: AZURE_STORAGE_KEY / AZURE_STORAGE_SAS_TOKEN (env; or SP env)
• B2: B2_KEY_ID, B2_KEY (env)
• WebDAV:KOPIA_WEBDAV_USERNAME, KOPIA_WEBDAV_PASSWORD (env)
• GCS: Gcs::credentials_file → --credentials-file (a JSON file path)
• SFTP: Sftp::keyfile/known_hosts → --keyfile/--known-hosts (file paths)
• rclone:Rclone::config_file → rclone --config (a file path)
• all: KOPIA_PASSWORD (the repository encryption password; env)

This is the full set of kopia 0.23 repository connect/create backends. The operator’s CRD Backend enum maps onto the first eight; Gdrive, FromConfig, and Server are exposed for client completeness (a kopia client connecting to an existing kopia API server is a legitimate backend — distinct from running a server, which the operator deliberately does not do).

Variants

Filesystem

Filesystem backend at a local path (used in-cluster for hostPath/PVC repos and in tests).

Fields

path: PathBuf

Absolute path to the repository root.

S3

S3-compatible backend.

Fields

bucket: String

Bucket name.

endpoint: Option<String>

Optional custom endpoint (for MinIO / non-AWS).

prefix: Option<String>

Optional key prefix within the bucket.

region: Option<String>

Region, if required by the endpoint.

disable_tls: bool

Talk plain HTTP to the endpoint (--disable-tls). For HTTP-only endpoints (in-cluster MinIO/RustFS); kopia otherwise assumes HTTPS.

disable_tls_verification: bool

Skip TLS certificate verification (--disable-tls-verification).

root_ca_pem: Option<String>

PEM CA bundle used to verify the endpoint’s certificate (--root-ca-pem-base64, base64-encoded on argv — a CA cert is public, and the base64 form needs no file the way --root-ca-pem-path would). kopia persists it into the connection config (s3.Options.RootCA, json:"rootCA"), so one connect covers every later verb reading that config — including an exec’d kopia server start. NOTE: kopia builds a FRESH cert pool from this bundle for the S3 connection (it does not extend the system roots), so a chain that also needs public roots must include them in the bundle.

ambient_credentials: bool

Authenticate via the ambient AWS credential chain (IRSA web-identity, EKS Pod Identity, IMDS) instead of static keys — the workload-identity path. kopia 0.23 marks --access-key/--secret-access-key as required flags (env-bound to AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY), but its storage layer skips empty static credentials and falls through minio-go’s chain — so this renders the flags explicitly empty (--access-key=), which satisfies the parser and engages the chain.

Azure

Azure Blob Storage backend.

Fields

container: String

Blob container name.

storage_account: Option<String>

Storage account name (when not supplied via env).

prefix: Option<String>

Optional object prefix.

Gcs

Google Cloud Storage backend.

Fields

bucket: String

Bucket name.

prefix: Option<String>

Optional object prefix.

credentials_file: Option<String>

Path to a JSON service-account credentials file inside the mover pod (--credentials-file). The mover materializes this from the credentials Secret at runtime; None falls back to ambient ADC.

B2

Backblaze B2 backend.

Fields

bucket: String

Bucket name.

prefix: Option<String>

Optional object prefix.

Sftp

SFTP/SSH backend.

Fields

host: String

Server hostname.

path: String

Path to the repository on the server.

port: Option<u16>

Server port (defaults to 22 when None).

username: Option<String>

SSH username.

keyfile: Option<String>

Path to a private key file inside the mover pod (--keyfile). The mover materializes this from the credentials Secret at runtime.

known_hosts: Option<String>

Path to a known_hosts file inside the mover pod (--known-hosts), pinning the server host key. The mover materializes this from the credentials Secret at runtime.

WebDav

WebDAV backend.

Fields

url: String

WebDAV server URL.

Rclone

Rclone backend (shells out to an rclone binary).

Fields

remote_path: String

Rclone remote:path.

config_file: Option<String>

Path to an rclone.conf inside the mover pod, forwarded to rclone via --rclone-args=--config=<path>. The mover materializes this from the config Secret at runtime; None uses rclone’s default config lookup.

startup_timeout: Option<String>

Go-duration value for kopia’s --rclone-startup-timeout (how long to wait for the embedded rclone serve to come up). None leaves kopia’s default (15s).

Gdrive

Google Drive backend.

Fields

folder_id: String

Drive folder id that holds the repository.

credentials_file: Option<String>

Path to a Google service-account JSON inside the mover pod, passed as --credentials-file. The mover materializes this from the credentials Secret at runtime; None uses kopia’s ambient credential lookup.

FromConfig

Reconnect from a kopia configuration token/file (repository connect from-config). Exactly one of file/token is meaningful.

Fields

file: Option<String>

Path to a kopia config file.

token: Option<String>

A kopia configuration token.

Server

Connect to an existing kopia API server as a client.

Fields

url: String

Server URL.

fingerprint: Option<String>

Expected server TLS certificate fingerprint (sha256 hex).

Implementations

impl ConnectSpec

pub fn kind_str(&self) -> &'static str

Stable discriminant string for logging/metrics (mirrors kopiur_api::backend::Backend::kind_str).

use std::path::PathBuf;
use kopiur_kopia::ConnectSpec;

let fs = ConnectSpec::Filesystem { path: PathBuf::from("/repo") };
assert_eq!(fs.kind_str(), "filesystem");

let s3 = ConnectSpec::S3 {
    bucket: "backups".into(),
    endpoint: Some("https://minio.local".into()),
    prefix: None,
    region: None,
    disable_tls: false,
    disable_tls_verification: false,
    ambient_credentials: false,
    root_ca_pem: None,
};
assert_eq!(s3.kind_str(), "s3");

pub fn direct_credential_env_names(&self) -> &'static [&'static str]

The environment-variable names kopia reads this backend’s credentials from directly (no intermediate file). These are exactly the vars the replication mover remaps from their KOPIUR_DEST_-prefixed copies onto their plain names for the sync-to subprocess, so the destination authenticates with its own keys instead of the source’s identically named ones (issue #200).

Exhaustive over ConnectSpec so a new backend cannot compile until its credential-delivery mechanism is decided. File-based backends (GCS/SFTP/ Rclone/Gdrive) deliver credentials as a materialized file whose path is on argv, so they read no direct credential env var and return &[] — the mover stages their destination file separately. AWS_WEB_IDENTITY_TOKEN_FILE and the other ambient-chain hints are deliberately excluded: they belong to the pod’s ServiceAccount (a workload-identity destination), not to a credential Secret, and must never be remapped or unset.

Trait Implementations

impl Clone for ConnectSpec

fn clone(&self) -> ConnectSpec

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ConnectSpec

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ConnectSpec

impl PartialEq for ConnectSpec

fn eq(&self, other: &ConnectSpec) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for ConnectSpec