# encryption-at-rest

Published articles for encryption-at-rest.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## 【kube-apiserver】storage.Interface 与 etcd3：codec、prefix 与 CRUD 路径

DevFeed: [【kube-apiserver】storage.Interface 与 etcd3：codec、prefix 与 CRUD 路径](<https://devfeed.tech/articles/kube-apiserver-storage-interface-etcd3-codec-prefix-crud-33959.md>)

Original publisher: [Read original article](<https://quant67.com/post/apiserver/03-storage-etcd3/03-storage-etcd3.html>)

Author: Liao Tonglang

Published: 2026-08-28T00:00:00Z

Content type: tutorial

Language: zh

Sources: [土法炼钢 - 系统与基础设施](<https://devfeed.tech/sources/source-4.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [API](<https://devfeed.tech/topics/api.md>), [Encryption](<https://devfeed.tech/topics/encryption.md>), [Raft](<https://devfeed.tech/topics/raft.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [apiserver](<https://devfeed.tech/tags/apiserver.md>), [codec](<https://devfeed.tech/tags/codec.md>), [crud](<https://devfeed.tech/tags/crud.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [encryption-at-rest](<https://devfeed.tech/tags/encryption-at-rest.md>), [etcd3](<https://devfeed.tech/tags/etcd3.md>), [guaranteed-update](<https://devfeed.tech/tags/guaranteed-update.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [optimistic-concurrency](<https://devfeed.tech/tags/optimistic-concurrency.md>), [raft](<https://devfeed.tech/tags/raft.md>), [rest](<https://devfeed.tech/tags/rest.md>), [storage](<https://devfeed.tech/tags/storage.md>), [v1-30-3](<https://devfeed.tech/tags/v1-30-3.md>)

### AI overview

This tutorial explains how kube-apiserver's storage.Interface integrates with the etcd3 backend in Kubernetes v1.30.3. It covers key prefixes, codec serialization, value transformation and encryption-at-rest boundaries, optimistic concurrency through GuaranteedUpdate and transactions, and the mapping from etcd3 watch streams to apiserver events.

### Source excerpt

拆解 kube-apiserver 的 storage.Interface 契约与 etcd3 实现：codec 序列化、pathPrefix/resourcePrefix、value.Transformer 加密边界、GuaranteedUpdate 乐观并发，以及 Watch 到 etcd3 的完整路径。版本锚定 Kubernetes v1.30.3 / etcd v3.5.33。

## Incremental backup on AWS Glacier with rustic

DevFeed: [Incremental backup on AWS Glacier with rustic](<https://devfeed.tech/articles/incremental-backup-on-aws-glacier-with-rustic-39783.md>)

Original publisher: [Read original article](<https://anuragbhatia.com/post/2026/08/incremental-backup-on-aws-glacier/>)

Published: 2026-08-19T21:04:01Z

Content type: tutorial

Language: en

Sources: [Personal blog of Anurag Bhatia](<https://devfeed.tech/sources/personal-blog-of-anurag-bhatia.md>)

Topics: [backups](<https://devfeed.tech/topics/backups.md>), [restic](<https://devfeed.tech/topics/restic.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Amazon S3](<https://devfeed.tech/topics/amazon-s3.md>), [Rust](<https://devfeed.tech/topics/rust.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Feathers](<https://devfeed.tech/topics/feathers.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [aws-glacier-deep-archive](<https://devfeed.tech/tags/aws-glacier-deep-archive.md>), [backblaze-b2](<https://devfeed.tech/tags/backblaze-b2.md>), [backup](<https://devfeed.tech/tags/backup.md>), [backups](<https://devfeed.tech/tags/backups.md>), [client](<https://devfeed.tech/tags/client.md>), [config](<https://devfeed.tech/tags/config.md>), [cost](<https://devfeed.tech/tags/cost.md>), [data](<https://devfeed.tech/tags/data.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [encryption-at-rest](<https://devfeed.tech/tags/encryption-at-rest.md>), [incremental](<https://devfeed.tech/tags/incremental.md>), [lifecycle](<https://devfeed.tech/tags/lifecycle.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [password](<https://devfeed.tech/tags/password.md>), [restic](<https://devfeed.tech/tags/restic.md>), [restore](<https://devfeed.tech/tags/restore.md>), [rust](<https://devfeed.tech/tags/rust.md>), [rustic](<https://devfeed.tech/tags/rustic.md>), [s3](<https://devfeed.tech/tags/s3.md>), [snapshots](<https://devfeed.tech/tags/snapshots.md>)

### AI overview

A practical guide to using rustic, a Rust implementation compatible with restic, for incremental backups with AWS Glacier cold storage. It explains keeping backup data in cold storage while maintaining metadata in S3 Standard or Backblaze B2 so snapshots, incremental backups, and targeted restores remain possible.

### Source excerpt

I have been a heavy restic user for several years. In Jan of this year, I tried making restic work with AWS Glacier deep archive but it did not work out. AWS Glacier Deep Archive, for those who may not know, is one of the cheapest storage options, with costs as low as $1/TB, but with very expensive retrieval due to high egress charges from AWS, in addition to retrieval fees, API charges, etc. It can act as a backup of last resort, kind of like insurance if everything else fails, since it costs roughly 1/7th of what Backblaze B2 charges for the same data ($6.95/TB/month). Restic by design is not compatible with Glacier because it stores a mix of data blobs and tree blobs inside /data. Thus, as AWS lifecycle rules move data from S3 Standard to Glacier, basic repo operations start failing. They do have some experimental support as per FAQ, but it did not work out for me when I tried in Jan. A few days back, I came across an open-source project named rustic -- it's a restic implementation in Rust and supports cold storage. The rustic client is compatible with a traditional restic repo. Rustic and cold storage Rustic supports AWS Glacier as well as OVH cold storage. The way it works is: they keep all data in cold storage and a copy of the metadata in hot storage. This additional copy of metadata in hot storage allows operations like incremental backups, viewing snapshots, and requesting restores where only the specific data blobs needed for the restore are pulled from Glacier. This additional hot storage can sit on S3 standard or even Backblaze B2 (which I prefer due to zero API cost). Demo 1) Create repo Let's create two buckets - one in S3 (to store data in Glacier) and one on Backblaze B2 to hold an additional copy of metadata. > rclone mkdir s3:rustic-demo-cold > rclone mkdir b2:rustic-demo-hot 2) Create rustic config profile This file will define the cold and hot repo locations, along with the password file location, restoration command syntax, etc. [repository] repo